<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="16227">
<package pkgid="90a4c1eef24fffa5d16710208dbad897879004b151f4094d13d04751011748f8" name="389-ds" arch="aarch64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="8dcb5fe77d19696a94ca9e848cbc8eb2b85cc0c746af46c68e364085c6064289" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="2d39c7af4e8c9244ac35aa9dce85c2b85771614bb9afd50487384a61eedee5ed" name="389-ds" arch="s390x">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="3000eb82047e37557daf08f4f148058c4da742218b775d3f0e01c86e8cd82ca0" name="389-ds" arch="src">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="0533927276e35ad63cfc368d2bc4fea1e73d93a145d60cd6cd389e1ed83f7f2b" name="389-ds" arch="x86_64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="1410649bb81d070e1859dc9d29b49336e46ed951029f6f82b432c3ec9484ac5c" name="389-ds" arch="aarch64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="1940d036f1828718df1aa8a5978ceefcac68e24b19c66d75fe362fc600fb4457" name="389-ds" arch="ppc64le">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="584de6deddf0322474c6898388605ff4b6b10c55c989cc79a6eb29c6fa83daa1" name="389-ds" arch="s390x">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="ca84a817bbdecdaf04fe9e2bc4f4821102c1b563bab0629c38864957e55fe2d4" name="389-ds" arch="src">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="13bd7092a72f85201b6a7dd1c6a97ceeb39780f8af17b07ff13029e84b77d58e" name="389-ds" arch="x86_64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="b7eb7c86639e7c922870927d55dbc703ba7a520570aca2ca2aa9c1f558f53142" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="8be785395a603347d0dc58588a9c35280146e93b6ee38a2477eb56401575370c" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="769ca0c833413ee1c858d77e9e766863129b4710457aad72eb3c39a777ea6d05" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="7ce3d2661c2157fb1a67487b777f4b268cb172adfd2be398702fdd894afbe998" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="75678a944cd0c8974e3e8e6a930a8d1a4f487a81d5985febe2126f82fff8c9bb" name="389-ds-devel" arch="aarch64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="82175cc1adf10c05577f46494bada109dff76d5c79c615927d27f04a734afdab" name="389-ds-devel" arch="ppc64le">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="234b9d472833404985401014ac6a1f41213fc1430eeb4c5ac0ca364be3c7d691" name="389-ds-devel" arch="s390x">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="16f63eec5c2f7afd5f6b36aa2680d66b4e3d32a4b983406fcad5cafdb3fa2725" name="389-ds-devel" arch="x86_64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="61b16102bfe52d2a8d98ac9852e80df165f8c7076b8c5b01c2a7d2a91ea5fe12" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="72bdadba53e617fac0f65284a380c6632e2b25aba57eb9e779a04cc997ea1eb9" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="f147d7ca2021bdfeb0a205854e8be1524be8bed1e2060fc7195db6c3f4ea80dc" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="4b70b2c8f0e6aa3337c485fd9e00fda8f7a733fc3245861053acded15c032043" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="1.4.4.16~git16.c1926dfc6" rel="3.4.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1579608000">- Update to version 1.4.2.6~git0.e84bbce3f:
  * Bump version to 1.4.2.6
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue 50754 - Add Restore Change Log option to CLI
  * Ticket 50727 - change syntax validate by default in 1.4.2
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Ticket #49761 - Fix CI test suite issues
  * Issue 50499 - Fix npm audit issues
  * Issue 50774 - Account.enroll_certificate() should not check for DS version
  * Issue 50771 - 1.4.2.5 doesn't compile due to error ModuleNotFoundError: No module named 'pkg_resources.extern'
  * Issue 50758 - Need to enable CLI arg completion
  * Ticket 50709: Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue: 50690 - Port Password Storage test cases from TET to python3(create required types in password_plugins)
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match index)
  * Issue 50761 - Parametrized tests are missing ':parametrized' value
  * Bump version to 1.4.2.5
  * Issue 50747 - Port readnsstate to dsctl
  * Issue 50758 - Enable CLI arg completion
  * Issue 50753 - Dumping the changelog to a file doesn't work
  * Ticket 50745: ns-slapd hangs during CleanAllRUV tests
  * Issue 50734 - lib389 creates non-SSCA cert DBs with misleading README.txt
  * Issue: 48851 - investigate and port TET matching rules filter tests(cert)
  * Issue: 50443 - Create a module in lib389 to Convert a byte sequence to a properly escaped for LDAP
  * Ticket 50664 - DS can fail to recover if an empty directory exists in db
  * Ticket 50736 - RetroCL trimming may crash at shutdown if trimming configuration is invalid
  * Ticket 50741 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  * Issue 50572 - After running cl-dump dbdir/cldb/*ldif.done are not deleted
  * Issue 50701 - Fix type in lint report
  * Ticket 50729 - add support for gssapi tests on suse
  * Issue 50701 - Add additional healthchecks to dsconf
  * Issue 50711 - `dsconf security` lacks option for setting nsTLSAllowClientRenegotiation attribute
  * Issue 50439 - Update docker integration for Fedora
  * Issue: 48851 - Investigate and port TET matching rules filter tests(last test cases for match)
  * Issue 50499 - Fix npm audit issues
  * Issue 50722 - Test IDs are not unique
  * Issue 50712 - Version comparison doesn't work correctly on git builds
  * Issue 50499 - Fix npm audit issues
  * Issue 50706 - Missing lib389 dependency - packaging
  * Bump version to 1.4.2.4
  * Issue 49761 - Fix CI test suite issues
  * Issue 50634 - Fix CLI error parsing for non-string values
  * Ticket 50659 AddressSanitizer: SEGV ... in bdb_pre_close
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50644 - fix regression with creating sample entries
  * Issue 50699 - Add Disk Monitor to CLI and UI
  * Issue 50716 - CVE-2019-14824 (BZ#1748199) - deref plugin displays restricted attributes
  * Issue 50536 - After audit log file is rotated, DS version string is logged after each update
  * Issue #50712 - Version comparison doesn't work correctly on git builds
  * Issue 50706 - Missing lib389 dependency - packaging
  * Issue 49761 - Fix CI test suite issues
  * Issue #50683 - Makefile.am contains unused RPM-related targets
  * Issue 50696 - Fix various UI bugs
  * Update based on Marks feedback
  * Update to mark as skipif
  * Ticket 50641 - Update default aci to allows users to change their own password
  * Ticket 50007, 50648 - improve x509 handling.
  * Issue 50689 - Failed db restore task does not report an error
  * Issue 50199 - Disable perl by default
  * Ticket 50633 - Add cargo vendor support for offline builds
  * Issue 50499 - Fix npm audit issues
  * Bump version to 1.4.2.3
  * Issue 50592 - Port Replication Tab to ReactJS
  * Issue 50680 - Remove branding from upstream spec file
  * Issue 50669 - Remove nunc-stans in favour of reworking current conn code (add.)
  * Issue: 48055 -  CI test - automember_plugin(part1)
  * Issue 50677 - Map subtree searches with NULL base to default naming context
  * Issue 50669 - Fix RPM build
  * Ticket 50669 - remove nunc-stans
  * Ticket 49850 cont -fix crash in ldbm_non_leaf
  * Issue 50634 - Clean up CLI errors output - Fix wrong exception
  * Issue 50660 - Build failure on Fedora 31
  * Issue 50634 - Clean up CLI errors output
  * Issue: 48851 - Investigate and port TET matching rules filter tests(match more test cases)
  * Ticket 50428 - Log the actual base DN when the search fails with "invalid attribute request"
  * Issue 49850 -  ldbm_get_nonleaf_ids() slow for databases with many non-leaf entries
  * Issue 50655 - access log etime is not properly formatted
  * Issue 50653 -  objectclass parsing fails to log error message text
  * Issue 50646 - Improve task handling during shutdowns
  * Add new test suite to test migration between RHDS versions
  * Ticket 50627 - Support platforms without pytest_html
  * Ticket 49476 - backend refactoring phase1, fix failing tests
  * Ticket 49476 - refactor ldbm backend to allow replacement of BDB
  * Ticket - 50349 - additional fix: filter schema check must handle subtypes
  * Issue: 48851 - investigate and port TET matching rules filter tests(indexing more test cases)
  * Issue 50638 - RecursionError: maximum recursion depth exceeded while calling a Python object
  * Ticket 50636 - Crash during sasl bind
  * Ticket 50632 - Add ensure attr state so that diffs are easier from 389-ds-portal
  * Ticket 50619 - extend commands to have more modify options
  * Issue 50499 - Fix npm audit issues
  * bump version to 1.4.2.2</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
</package>
<package pkgid="c799f4f0bdf5660a39b9ce6674ae0c0cfa1f273a4599e0814cd8a3cbec4ab260" name="389-ds-snmp" arch="aarch64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="fe1efe9ca1baac1f0407a769eb7e5a52faef4ab6fc49f96f079aa629dae8add0" name="389-ds-snmp" arch="ppc64le">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="9e7836de579966c1d7ee1cb57e70e1dce8a32d5afdd6f76f41dc7ed2d3750408" name="389-ds-snmp" arch="s390x">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="86f58848dabb7396029383b2fb7a578a8d2e4f502884999a3c70b83be76c0e55" name="389-ds-snmp" arch="x86_64">
  <version epoch="0" ver="1.4.4.17~git0.5e1e392ae" rel="3.7.1"/>
  <changelog author="389-ds-maintainer@suse.de" date="1580212800">- Update to version 1.4.2.7~git0.202953d28:
  * Bump version to 1.4.2.7
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1581940800">- Update to version 1.4.2.8~git0.3aaa3e820:
  * Bump version to 1.4.2.8
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors</changelog>
  <changelog author="389-ds-maintainer@suse.de" date="1586260800">- Patch rollup as described in bsc#1169364
- Add rust vendor.tar.gz as a source - rust is still an optional build
  and will be enabled in the future.
- Update ns-slapd ownership to remove dirsrv as an owner as dirsrv will
  not exist in containers with systemd users.
- Add 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch to
  resolve a warning found in static analysis in OBS (upstream #51014)
- Update to version 1.4.2.11~git0.aff1a2831:
  * Bump version to 1.4.2.11
  * Issue 50994 - Fix latest UI bugs found by QE
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50744 - -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Bump version to 1.4.2.10
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Bump version to 1.4.2.9
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue 50499 - Fix npm audit issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Ticket 50618 - support cgroupv2
  * Ticket 50898 - ldclt core dumped when run with -e genldif option</changelog>
  <changelog author="william.brown@suse.com" date="1591012800">- Remove 0001-Ticket-51014-slapi_pal.c-possible-static-buffer-over.patch
  as it is part of 1.4.2.14
- Update to version 1.4.2.14~git0.5ac5b02ce:
  * Bump version to 1.4.2.14
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Bump version to 1.4.2.13
  * Ticket 50787 - fix implementation of attr unique
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.2.12
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50545 - the check for the ds version for the backend config was broken
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value</changelog>
  <changelog author="william.brown@suse.com" date="1591012801">- Update to version 1.4.3.9~git0.3eb8617f6:
  * Bump version to 1.4.3.9
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Issue 50610 - Fix return code when it's nothing to free
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Bump version to 1.4.3.8
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Bump version to 1.4.3.7
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.3.6
  * Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  * Ticket 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  * Ticket 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  * Ticket 51008 - dbhome in containers
  * Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  * Ticket 51014 - slapi_pal.c possible static buffer overflow
  * Issue 50545 - remove dbmon "incr" option from arg parser
  * Issue 50545 - Port dbmon.sh to dsconf
  * Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  * Issue 49731 - Fix additional issues with setting db home directory by default
  * Issue 50337 - Replace exec() with setattr()
  * Ticket 50905 - intermittent SSL hang with rhds
  * Issue 50952 - SSCA lacks basicConstraint:CA
  * Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  * Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  * Bump version to 1.4.3.5
  * Issue 50994 - Fix latest UI bugs found by QE
  * Ticket 50933 - rfc2307compat.ldif
  * Issue 50337 - Replace exec() with setattr()
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 49731 - dscreate fails in silent mode because of db_home_dir
  * Issue 50975 - Revise UI branding with new minimized build
  * Issue 49437 - Fix memory leak with indirect COS
  * Issue 49731 - Do not add db_home_dir to template-dse.ldif
  * Issue 49731 - set and use db_home_directory by default
  * Ticket 50971 - fix BSD_SOURCE
  * -n option of dbverify does not work
  * Issue 50952- SSCA lacks basicConstraint:CA
  * Issue 50976 - Clean up Web UI source directory from unused files
  * Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  * Issue 50966 - UI - Database indexes not using typeAhead correctly
  * Issue 50974 - UI - wrong title in "Delete Suffix" popup
  * Issue 50972 - Fix cockpit plugin build
  * Issue 49761 - Fix CI test suite issues
  * Issue 50971 - Support building on FreeBSD.
  * Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  * Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  * Issue 50963 - We should bundle *.min.js files of Console
  * Issue: 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  * Issue: 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  * Issue 50954 - buildnum.py - fix date formatting issue
  * Bump version to 1.4.3.4
  * Issue 50954 - Port buildnum.pl to python(part 2)
  * Issue 50955 - Fix memory leaks in chaining plugin
  * Issue 50954 - Port buildnum.pl to python
  * Ticket 50947 - change 00core.ldif objectClasses for openldap migration
  * Ticket: 50755 - setting nsslapd-db-home-directory is overriding db_directory
  * Issue 50937 - Update CLI for new backend split configuration
  * Issue: 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  * Ticket 50945 - givenname alias of gn from openldap
  * Ticket 50935 - systemd override in lib389 for dscontainer
  * Issue 50499 - Fix npm audit issues
  * Issue 49761 - Fix CI test suite issues
  * Ticket 50618 - clean compiler warning and log level
  * Ticket 50889 - fix compiler issues
  * Issue 50884 -  Health check tool DSEldif check fails
  * Issue 50926 - Remove dual spinner and other UI fixes
  * Issue 50928 - Unable to create a suffix with countryName
  * Issue 50758 - Only Recommend bash-completion, not Require
  * Issue 50923 - Fix a test regression
  * Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  * Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  * Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  * Issue 50919 - Backend delete fails using dsconf
  * Issue 50872 - dsconf can't create GSSAPI replication agreements
  * Issue 50912 - RFE - add password policy attribute pwdReset
  * Ticket 50914 - No error returned when adding an entry matching filters for a non existing automember group
  * Ticket 50889 - Extract pem files into a private namespace
  * Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  * Issue: 50686 - Port fractional replication test cases from TET to python3 final
  * Issue 49845 - Remove pkgconfig check for libasan
  * Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  * Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  * Ticket 50786 - connection table freelist
  * Ticket 50618 - support cgroupv2
  * Ticket 50900 - Fix cargo offline build
  * Ticket 50898 - ldclt core dumped when run with -e genldif option
  * Bump version to 1.4.3.3
  * Issue 50855 - remove unused file from UI
  * Issue 50855 - UI: Port Server Tab to React
  * Issue 49845 - README does not contain complete information on building
  * Issue: 50686 - Port fractional replication test cases from TET to python3 part 1
  * Ticket - 49623-cont cenotaph errors on modrdn operations
  * Issue 50882 - Fix healthcheck errors for instances that do not have TLS enabled
  * Issue 50886 - Typo in the replication debug message
  * Issue 50873 - Fix healthcheck and virtual attr check
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 50028 - Add a new CI test case
  * Issue 49946 - Add a new CI test case
  * Issue 50117 - Add a new CI test case
  * Ticket 50787 - fix implementation of attr unique
  * Ticket 50859 - support running only with ldaps socket
  * Issue 50823 - dsctl doesn't work with 'slapd-' in the instance name
  * Ticket 49624 cont - DB Deadlock on modrdn appears to corrupt database and entry cache
  * Issue 50867 - Fix minor buildsys issues
  * Issue 50737 - Allow building with rust online without vendoring
  * Ticket 50831 add cargo.lock to allow offline builds
  * Ticket 50694 - import PEM certs on startup
  * Ticket 50857 - Memory leak in ACI using IP subject
  * Issue 49761 - Fix CI test suite issues
  * Issue 50853 - Fix NULL pointer deref in config setting
  * Issue 50850 - Fix dsctl healthcheck for python36
  * Issue 49990 - Need to enforce a hard maximum limit for file descriptors
  * Ticket 48707 - ldapssotoken for authentication
  * Bump version to 1.4.3.2
  * Issue 49254 - Fix compiler failures and warnings
  * Ticket 50741-cont bdb_start - Detected Disorderly Shutdown
  * Issue 50836 - Port Schema UI tab to React
  * Issue 50842 - Decrease 389-console Cockpit component size
  * Ticket 50790 - Add result text when filter is invalid
  * Issue 50627 - Add ASAN logs to HTML report
  * Issue 50834 - Incorrectly setting the NSS default SSL version max
  * Issue 50829 - Disk monitoring rotated log cleanup causes heap-use-after-free
  * Ticket 50709 - (cont) Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  * Ticket 50784 - performance testing scripts
  * Issue 50599 - Fix memory leak when removing db region files
  * Issue 49395 - Set the default TLS version min to TLS1.2
  * Issue 50818 - dsconf pwdpolicy get error
  * Issue 50824 - dsctl remove fails with "name 'ensure_str' is not defined"
  * Issue 50599 - Remove db region files prior to db recovery
  * Issue 50812 -  dscontainer executable should be placed under /usr/libexec/dirsrv/
  * Issue 50816 - dsconf allows the root password to be set to nothing
  * Issue 50798 - incorrect bytes in format string(fix import issue)
  * Bump version to 1.4.3.1
  * Ticket 50798 - incorrect bytes in format string
  * Issue 50545 - Add the new replication monitor functionality to UI
  * Issue 50806 - Fix minor issues in lib389 health checks
  * Issue: 50690 - Port Password Storage test cases from TET to python3 part 1
  * Issue 49761 - Fix CI test suite issues
  * Issue 49761 - Fix CI test suite issues
  * Issue 50754 - Add Restore Change Log option to CLI
  * Issue: 48055 -  CI test - automember_plugin(part2)
  * Ticket 50667 - dsctl -l did not respect PREFIX
  * Issue 50780 - More CLI fixes
  * Ticket 50649 - lib389 without defaults.inf
  * Issue 50780 - Fix UI issues
  * Ticket 50727 - correct mistaken options in filter validation patch
  * Issue 50779 - lib389 - conflict compare fails for DN's with spaces
  * Set branch version to 1.4.3.0</changelog>
  <changelog author="william.brown@suse.com" date="1592568000">- Add 0001-Ticket-51161-fix-SLE15.2-install-issps.patch to resolve bsc#1172328
  This corrects a failure to install on SUSE due to incorrect hostname
  generation, and a python 3 utf8 issue that is triggered by systemd.</changelog>
  <changelog author="william.brown@suse.com" date="1594814400">- Remove patch that is now included in latest release:
  0001-Ticket-51161-fix-SLE15.2-install-issps.patch
- Resolve bsc#1174057 upstream stability and fix rollup.
- Update to version 1.4.3.11~git0.82796f172:
  * Bump version to 1.4.3.11
  * Issue 51192 - Add option to reject internal unindexed searches
  * Ticket 51159 - dsidm ou delete fails
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 50984 - Memory leaks in disk monitoring
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.3.10
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51072 - improve autotune defaults
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Issue 51118 - UI - improve modal validation when creating an instance</changelog>
  <changelog author="william.brown@suse.com" date="1596369600">- Update to version 1.4.3.12~git0.9bc042902:
  * Bump version to 1.4.3.12
  * Issue 51222 - It should not be allowed to delete Managed Entry manually
  * Issue 51129 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  * Issue 51086 - Fix instance name length for interactive install
  * Issue 51136 - JSON Error output has redundant messages
  * Issue 51059 - If dbhome directory is set online backup fails
  * Issue 51000 - Separate the BDB backend monitors
  * Issue 49300 - entryUSN is duplicated after memberOf operation
  * Issue 50984 - Fix disk_mon_check_diskspace types</changelog>
  <changelog author="william.brown@suse.com" date="1602158400">- Update to version 1.4.4.4~git0.318a3ce0c:
  * Bump version to 1.4.4.4
  * Ticket 51175 - resolve plugin name leaking
  * Issue 51187 - UI - stop importing Cockpit's PF css
  * Issue 51192 - Add option to reject internal unindexed searches
  * Issue 50840 - Fix test docstrings metadata-1
  * Issue 50840 - Fix test docstrings metadata
  * Ticket 50980 - fix foo_filter_rewrite
  * Issue 51165 - add more logconv stats for the new access log keywords
  * Issue 50928 - Unable to create a suffix with countryName either via dscreate or the admin console
  * Issue 51188 - db2ldif crashes when LDIF file can't be accessed
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 51165 - add new access log keywords for wtime and optime
  * Issue : 49761 - Fix CI test suite issues ( Port remaning acceptance test suit part 1)
  * Issue: 51070 - Port Import TET module to python3 part2
  * Issue:51142 - Port manage Entry TET suit to python 3 part 1
  * Issue: 50860 - Port Password Policy test cases from TET to python3 final
  * Issue 50696 - Fix Allowed and Denied Ciphers lists - WebUI
  * Issue 51169 - UI - attr uniqueness - selecting empty subtree crashes cockpit
  * Issue 49256 - log warning when thread number is very different from autotuned value
  * Issue 51157 - Reindex task may create abandoned index file
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue:50860 - Port Password Policy test cases from TET to python3 part2
  * Issue 51166 - Log an error when a search is fully unindexed
  * Ticket 50544 - OpenLDAP syncrepl compatability
  * Ticket 51161 - fix SLE15.2 install issps
  * Issue 49999 - rpm.mk build-cockpit should clean cockpit_dist first
  * Issue 51144 - dsctl fails with instance names that contain slapd-
  * Issue 51155 - Fix OID for sambaConfig objectclass
  * Ticket 51159 - dsidm ou delete fails
  * Issue 50984 - Memory leaks in disk monitoring
  * Ticket 51131 - improve mutex alloc in conntable
  * Issue 49761 - Fix CI tests
  * Ticket 49859 - A distinguished value can be missing in an entry
  * Issue 50791 - Healthcheck should look for notes=A/F in access log
  * Issue 51072 - Set the default minimum worker threads
  * Ticket 51140 - missing ifdef
  * Issue 50912 - pwdReset can be modified by a user
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51100 - Correct numSubordinates value for cn=monitor
  * Issue 51136 - dsctl and dsidm do not errors correctly when using JSON
  * Ticket 137 - fix compiler warning
  * Issue 50781 - Make building cockpit plugin optional
  * Issue 51132 - Winsync setting winSyncWindowsFilter not working as expected
  * Ticket 51034 - labeledURIObject
  * Issue 50545 - Port remaining legacy tools to new python CLI
  * Issue 50889 - Extract pem files into a private namespace
  * Ticket 137 - Implement EntryUUID plugin
  * Ticket 51072 - improve autotune defaults
  * Ticket 51115 - enable samba3.ldif by default
  * Issue 51118 - UI - improve modal validation when creating an instance
  * Issue 50746 - Add option to healthcheck to list all the lint reports
  * Bump version to 1.4.4.3
  * Issue 50931 - RFE AD filter rewriter for ObjectCategory
  * Issue: 50860 - Port Password Policy test cases from TET to python3 part1
  * Issue 51113 - Allow using uid for replication manager entry
  * Issue 51095 - abort operation if CSN can not be generated
  * Issue 51110 - Fix ASAN ODR warnings
  * Issue 49850 -ldbm_get_nonleaf_ids() painfully slow for databases with many non-leaf entries
  * Issue 51102 - RFE - ds-replcheck - make online timeout configurable
  * Issue 51076 - remove unnecessary slapi entry dups
  * Issue 51086 - Improve dscreate instance name validation
  * Issue:51070 - Port Import TET module to python3 part1
  * Ticket 51037 - compiler warning
  * Ticket 50989 - ignore pid when it is ourself in protect_db
  * Ticket 51037 - RFE AD filter rewriter for ObjectSID
  * Issue 50499 - Fix some npm audit issues
  * Issue 51091 - healthcheck json report fails when mapping tree is deleted
  * Ticket 51079 - container pid start and stop issues
  * Revert "Issue 51017 - Implement dynamic ds/bz pytest markers"
  * Issue 49761 - Fix CI tests
  * Issue 50610 - Fix return code when it's nothing to free
  * Issue 50610 - memory leaks in dbscan and changelog encryption
  * Issue 51076 - prevent unnecessarily duplication of the target entry
  * Issue 50940 - Permissions of some shipped directories may change over time
  * Issue 50873 - Fix issues with healthcheck tool
  * Issue 51017 - Implement dynamic ds/bz pytest markers
  * Ticket 51082 - abort when a empty valueset is freed
  * Issue:CI test - automember_plugin (Long Duration test)
  * Issue 50201 - nsIndexIDListScanLimit accepts any value
  * Bump version to 1.4.4.2
  * Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  * Issue 51054 - Revise ACI target syntax checking
  * Ticket 51068 - deadlock when updating the schema
  * Issue 51042 - try to use both c_rehash and openssl rehash
  * Issue 51042 - switch from c_rehash to openssl rehash
  * Issue 50992 - Bump jemalloc version and enable profiling
  * Issue 51060 - unable to set sslVersionMin to TLS1.0
  * Issue 51064 - Unable to install server where IPv6 is disabled
  * Issue 51051 - CLI fix consistency issues with confirmations
  * Issue 50655 - etime displayed has an order of magnitude 10 times smaller than it should be
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  * Issue 49761 - Fix CI tests
  * Issue 51047 - React deprecating ComponentWillMount
  * Issue 50499 - fix npm audit issues
  * Issue 50545 - Port dbgen.pl to dsctl
  * Issue 51027 - Test passwordHistory is not rewritten on a fail attempt
  * Bump version to 1.4.4.1
  * Ticket 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  * Ticket 50877 - task to run tests of csn generator
  * Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  * Issue: 48055 - CI test - automember_plugin(part3)
  * Ticket 51035 - Heavy StartTLS connection load can randomly fail with err=1
  * Issue 51031 UI - transition between two instances needs improvement
  * Bump version to 1.4.4</changelog>
  <changelog author="wbrown@suse.de" date="1605182400">- Update to version 1.4.4.8~git0.bf454ad07:
  * Bump version to 1.4.4.8
  * Issue 4415 - unable to query schema if there are extra parenthesis
  * Issue 4176 - CL trimming causes high CPU
  * Bump version to 1.4.4.7
  * Issue 2526 - revert backend validation check
  * Issue 4262 - more perl removal cleanup
  * Issue 2526 - retrocl backend created out of order
  * Bump version to 1.4.4.6
  * Issue 4262 - Remove legacy tools subpackage (final cleanup)
  * Issue 4262 - Remove legacy tools subpackage (restart instances after rpm install)</changelog>
  <changelog author="wbrown@suse.de" date="1606824000">- Lib389 is a hard requirement in 1.4.4, and perl has been completely
  removed. Reflect this in our spec file.
- Add rebased patches for SUSE Feature Completion: jsc#SLE-11501
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.9~git0.b09e60339:
  * Bump version to 1.4.4.9
  * Issue 4105 - Remove python.six (fix regression)
  * Issue 4384 - Use MONOTONIC clock for all timing events and conditions
  * Issue 4243 - Fix test: SyncRepl plugin provides a wrong cookie (#4467)
  * Issue 4460 - BUG  - lib389 should use system tls policy
  * Issue 3657 - Add options to dsctl for dsrc file
  * Issue 3986 - UI - Handle objectclasses that do not have X-ORIGIN set
  * Issue 4297 - 2nd fix for on ADD replication URP issue internal searches with filter containing unescaped chars (#4439)
  * Issue 4449 - dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) (#4451)
  * Issue 4105 - Remove python.six from lib389 (#4456)</changelog>
  <changelog author="wbrown@suse.de" date="1610971200">- Upstream fix for bsc#1180847 - openldap_to_ds can fail if the
  backend has no overlays or indexes.
- Remove patches now merged upstream.
  * 0001-Ticket-51260-fix-potential-syncrepl-data-corruption.patch
  * 0002-Ticket-51260-improve-tests-and-improve-readme-re-ref.patch
  * 0003-Ticket-4224-openldap-can-become-confused-with-entryu.patch
  * 0004-Issue-4410-RFE-ndn-cache-with-arc-in-rust.patch
  * 0005-Issue-4403-RFE-OpenLDAP-pw-hash-migration-tests-4408.patch
  * 0006-Issue-4446-RFE-openldap-password-hashers.patch
  * 0007-Issue-4464-RFE-clang-with-ds-asan-rust.patch
  * 0008-Issue-4229-RFE-Improve-rust-linking-and-build-perfor.patch
- Update to version 1.4.4.10~git0.ebdf25251:
  * Bump version to 1.4.4.10
  * Issue 4418 - fix cherry-pick error
  * Issue 4381 - RFE - LDAPI authentication DN rewritter
  * Issue 4539 - BUG - no such file if no overlays in openldap during migration (#4540)
  * Issue 4513 - CI Tests - fix test failures
  * Issue 4528 - Fix cn=monitor SCOPE_ONE search (#4529)
  * Issue 4535 - lib389 - healthcheck throws exception if backend is not replicated
  * Issue 4504 - insure that repl_monitor_test use ldapi (for RHEL) - fix merge issue (#4533)
  * Issue 4504 - Insure ldapi is enabled in repl_monitor_test.py (Needed on RHEL) (#4527)
  * Issue 4506 - BUG - Fix bounds on fd table population (#4520)</changelog>
  <changelog author="wbrown@suse.de" date="1612353600">- Update to version 1.4.4.12~git0.7b681e1da:
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)
  * Issue 4396 - Minor memory leak in backend (#4558) (#4572)
  * Issue 4324 - Performance search rate: change entry cache monitor to recursive pthread mutex (#4569)
  * Issue 5442 - Search results are different between RHDS10 and RHDS11
  * Bump version to 1.4.4.11
  * Issue 4548 - CLI - dsconf needs better root DN access control plugin validation
  * Issue 4513 - Fix schema test and lib389 task module (#4514)</changelog>
  <changelog author="wbrown@suse.de" date="1613390400">- Update to version 389-ds-base-1.4.4.13~git0.6841d693f:
  * Bump version to 1.4.4.13
  * Update dscontainer (#4564)
  * Issue 4591 - RFE - improve openldap_to_ds help and features (#4607)
  * Issue 4324 - Some architectures the cache line size file does not exist
  * Issue 4593 - RFE - Print help when nsSSLPersonalitySSL is not found (#4614)
  * Issue 4609 - CVE - info disclosure when authenticating
  * Bump version to 1.4.4.12
  * Issue 4579 - libasan detects heap-use-after-free in URP test (#4584)
  * Issue 4563 - Failure on s390x: 'Fails to split RDN "o=pki-tomcat-CA" into components' (#4573)
  * Issue 4526 - sync_repl: when completing an operation in the pending list, it can select the wrong operation (#4553)</changelog>
  <changelog author="wbrown@suse.de" date="1617105600">- bsc#1184142 - restart after openldap migration so that plugins can correctly
    perform data fix ups.
- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="wbrown@suse.de" date="1617883200">- Update to version 1.4.4.14~git0.37dc95673:
  * Bump version to 1.4.4.14
  * Issue 4671 - UI - Fix browser crashes
  * Issue 4229 - Fix Rust linking
  * Issue 4658 - monitor - connection start date is incorrect
  * Issue 4656 - Make replication CLI backwards compatible with role name change
  * Issue 4656 - Remove problematic language from UI/CLI/lib389
  * Issue 4459 - lib389 - Default paths should use dse.ldif if the server is down
  * Issue 4661 - RFE - allow importing openldap schemas (#4662)
  * Issue 4659 - restart after openldap migration to enable plugins (#4660)
  * Issue 4663 - CLI - unable to add objectclass/attribute without x-origin</changelog>
  <changelog author="william.brown@suse.com" date="1617883201">- bsc#1184476 - Add supportconfig utility for customer services to capture
  389-ds support information.</changelog>
  <changelog author="wbrown@suse.de" date="1625832000">- Update to version 1.4.4.16~git0.3d31c6c71:
  * Bump version to 1.4.4.16
  * Update npm packages
  * Issue 4719 - lib389 - fix dsconf passthrough auth bugs
  * Issue 4778 - RFE - Allow setting TOD for db compaction and add task
  * Issue 4764 - replicated operation sometime checks ACI (#4783)
  * Issue 4623 - RFE - Monitor the current DB locks (#4762)
  * Issue 4781 - There are some typos in man-pages
  * Issue 4773 - Enable interval feature of DNA plugin
  * Issue 3555 - Fix UI audit issue
  * Issue 4747 - Remove unstable/unstatus tests from PRCI (#4748)</changelog>
  <changelog author="wbrown@suse.de" date="1625832001">- bsc#1188151 - Update to 1.4.4.16 patch release
- bsc#1188455 - CVE-2021-3652 - fix crypt handling of locked accounts
- Update to version 389dsbase1.4.4.16~git16.c1926dfc6:
  * Issue 4817 - BUG - locked crypt accounts on import may allow all passwords (#4819)
  * Issue 4656 - (2nd) Remove problematic language from UI/CLI/lib389
  * Issue 4262 - Fix Index out of bound in fractional test (#4828)
  * Issue 4822 - Fix CI temporary password: fixture leftover breaks them (#4823)
  * Issue 4656 - remove problematic language from ds-replcheck
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions
  * Issue 4803 - Improve DB Locks Monitoring Feature Descriptions (#4810)
  * Issue 4788 - CLI should support Temporary Password Rules attributes (#4793)
  * Issue 4506 - Improve SASL logging
  * Issue 4093 - Fix MEP test case
  * Issue 4747 - Remove unstable/unstatus tests (followup) (#4809)
  * Issue 4789 - Temporary password rules are not enforce with local password policy (#4790)
  * Issue 4797 - ACL IP ADDRESS evaluation may corrupt c_isreplication_session connection flags (#4799)
  * Issue 4447 - Crash when the Referential Integrity log is manually edited
  * Issue 4773 - Add CI test for DNA interval assignment
  * Issue 4750 - Fix compiler warning in retrocl (#4751)</changelog>
  <changelog author="wbrown@suse.de" date="1632225600">- Update to version 1.4.4.17~git0.5e1e392ae:
  * Bump version to 1.4.4.17
  * Issue 4927 - rebase lib389 and cockpit in 1.4.4
  * Issue 4908 - Updated several dsconf --help entries (typos, wrong descriptions, etc.)
  * Issue 4912 - Account Policy plugin does not set the config entry DN
  * Issue 4796 - Add support for nsslapd-state to CLI &amp; UI
  * Issue 4894 - IPA failure in ipa user-del --preserve (#4907)
  * Issue 4169 - backport lib389 cert list fix
  * Issue 4912 - dsidm command crashing when account policy plugin is enabled
  * Issue 4910 - db reindex corrupts RUV tombstone nsuiqueid index
  * Issue 4869 - Fix retro cl trimming misuse of monotonic/realtime clocks</changelog>
</package>
<package pkgid="9e52fa8fa2a0b792c03d6971b24fd04d69ed1b586d6b46cb4bb75d3355c40f64" name="ClusterTools2" arch="noarch">
  <version epoch="0" ver="3.1.1" rel="8.6.1"/>
  <changelog author="fabian.herschel@suse.com" date="1333540800">- first changes to get package technical preview ready</changelog>
  <changelog author="fabian.herschel@suse.com" date="1334923200">- tools, manpages and config files now renamed for ship with SLES for SAP Applications</changelog>
  <changelog author="fabian.herschel@suse.com" date="1367841600">- upstream fixes for sap simpelstack to be more flexible</changelog>
  <changelog author="lars.pinne@suse.com" date="1378468800">- added cs_show_wwpn, cs_check_lsbinit first alpha</changelog>
  <changelog author="lars.pinne@suse.com" date="1467288000">- version 3.0.0, adaptation of the scripts for the SLE12 platform
- fate#319611</changelog>
  <changelog author="imanyugin@suse.com" date="1473249600">- Obsolete the -doc subpackage, bsc#993014</changelog>
  <changelog author="imanyugin@suse.com" date="1521115200">- added /etc/ClusterTools2/cs_make_sbd_devices, bsc#1084925
- version 3.0.1</changelog>
  <changelog author="kstreitova@suse.com" date="1550750400">- The /etc/cron.d/ClusterTools2 does not contain any active cronjob
  so we can move it to /usr/share/ClusterTools2/samples/ and
  remove "Requires: cron" as it's no longer needed.
  [bsc#1115405] [fate#323635]
- Remove the Vendor line that is now forbidden</changelog>
  <changelog author="abriel@suse.com" date="1576497600">- change version from 3.0.1 to 3.1.0
- Update package to the latest upstream version
  add missing man pages, config files and scripts:
  add new man page man8/cs_show_hana_info.8, man8/cs_dmesg.8,
  man8/cs_show_wwpn.8 , man8/cs_show_hana_autofailover_patterns.8,
  man8/cs_show_cluster_transition.8
  add new kernel modules (ibmvnic.ko, ibmvfc.ko, lin_tape.ko,
  deadman.ko) to search for
  add new config files etc/ClusterTools2/cs_show_memory,
  etc/ClusterTools2/cs_show_cluster_transition
  add new scripts sbin/cs_show_hana_info, sbin/cs_show_wwpn,
  sbin/cs_show_hana_autofailover_patterns, sbin/cs_dmesg,
  sbin/cs_show_cluster_transition, sbin/cs_show_xfs_patterns,
  add new examples for helper scripts (samples/pacemakill)
  enhance the scripts:
  add check for multi-queue scheduler
  change initrd check to support new SLES12/15 format
  adapt the changed sar filename syntax
  add 'systemctl get-default' for SLES12/15 instead of using
  /etc/inittab
  add checks for additional SAP Notes 2655238, 2205917 and 2686011
  remove crontab in favour for systemd timer
  use /etc/os-release instead of old /etc/SuSE-release
  add check for powerVM
  adapt the corosync checks to the new values in the best practice
  documentation
  add additional rpms to look for (e.g. saptune, rear, glibc2,
  kernel-default, kernel-ppc64=4.12.14 ...)
  add additional files (e.g. /boot/grub2/grub.cfg,
  /var/log/mcelog, memory.txt (from supportconfig),
  /etc/systemd/system.conf, /usr/sap/sapservices, /etc/sudoers ...)
  to search for or to search in
  add additional services to check (e.g. sbd.service,
  tuned.service ...)
  add additional error and info pattern to search for in log files
  (e.g. "systemd.*start-limit" and similar search strings)
  enhance the list of cluster related SUSE TIDs
  7022678, 7023149, 7022921, 7021158, 7022255, 7022984, 7023127,
  7021376, 7018571, 7021211, 7018408, 7023236, 7022001, 7019001,
  7017985, 7023007, 7016640, 7018194, 7022644, 7017617, 7018594,
  7022764, 7020256, 7022316, 7022840, 7021065, 7022467, 7022565,
  7022152, 7018352, 7017651, 7023166, 7010249, 3044267, 7004659,
  7018181, 7023324, 7016918, 7023526, 7022310, 7022681, 7023021,
  7023732, 7018233, 7018329, 7018361, 7011860, 7023344, 7021064,
  7022268, 7018744, 7023714, 7023713, 3684654, 3054866, 7022975,
  7022293, 7017750, 7023805, 7021182
  (bsc#1097134, jsc#SLE-9199)
- cleanup the package and the man pages, remove unavailable
  references, adjust Copyright string, adjust feedback address
- script refinement and first steps for an adaption to SLE15 code
  stream
  using 'shellcheck' to find and correct syntax problems,
  spelling errors and other problems</changelog>
  <changelog author="abriel@suse.com" date="1626436800">- change version from 3.1.0 to 3.1.1
- As some of the supportconfig plugins of ClusterTools2 takes very
  log time to process, we will disable these plugins by default in
  /etc/ClusterTools2/supportconfig_plugins.
  That means that after an initial installation of ClusterTools2
  NO supportconfig plugin will be active. To change this behaviour
  manually uncomment the entres of interesst in the file
  /etc/ClusterTools2/supportconfig_plugins.
  During a package update nothing will change. If an active plugin
  is disturbing the creation of a supportconfig archive, please
  comment out the related entry manually in the file
  /etc/ClusterTools2/supportconfig_plugins.
  Please refer to manual page supportconfig_plugins(5) for further
  details.
  (bsc#1186119)
- Add file samples/00_bootstrap_sle15.crm.tmpl to support SLE15
  (bsc#1166943)</changelog>
</package>
<package pkgid="f9dae55e7e509f29b910b238cc7910b871258b01d03b874457ddbfaafb35a120" name="ClusterTools2" arch="src">
  <version epoch="0" ver="3.1.1" rel="8.6.1"/>
  <changelog author="lars.pinne@novell.com" date="1314705600">- added wow on-fail-block, added supportconfig plugins</changelog>
  <changelog author="lars.pinne@novell.com" date="1316692800">- added xmstat, various fixes and updates</changelog>
  <changelog author="lars.pinne@novell.com" date="1317297600">- moved add_softdog_to_initrd to add_watchdog_to_initrd, added grep_cluster_patterns, various fixes and updates</changelog>
  <changelog author="lars.pinne@novell.com" date="1317816000">- added grep_cluster_transition</changelog>
  <changelog author="lars.pinne@novell.com" date="1319198400">- added lsoflog, merged separate crontab and logrotate to one ClusterTools2, fixed grep_supportconfig</changelog>
  <changelog author="fabian.herschel@suse.com" date="1320235200">- 2.2.10 package version</changelog>
  <changelog author="fabian.herschel@suse.com" date="1321012800">- 2.2.11 st martin package version (11.11.2011)</changelog>
  <changelog author="lars.pinne@suse.com" date="1321358400">- more grep patterns, minor fixes</changelog>
  <changelog author="lars.pinne@suse.com" date="1328875200">- eDir back again</changelog>
  <changelog author="lars.pinne@suse.com" date="1332504000">- grep_supportconfig for Oracle and s390x</changelog>
  <changelog author="fabian.herschel@suse.com" date="1333540800">- first changes to get package technical preview ready</changelog>
  <changelog author="fabian.herschel@suse.com" date="1334923200">- tools, manpages and config files now renamed for ship with SLES for SAP Applications</changelog>
  <changelog author="fabian.herschel@suse.com" date="1367841600">- upstream fixes for sap simpelstack to be more flexible</changelog>
  <changelog author="lars.pinne@suse.com" date="1378468800">- added cs_show_wwpn, cs_check_lsbinit first alpha</changelog>
  <changelog author="lars.pinne@suse.com" date="1467288000">- version 3.0.0, adaptation of the scripts for the SLE12 platform
- fate#319611</changelog>
  <changelog author="imanyugin@suse.com" date="1473249600">- Obsolete the -doc subpackage, bsc#993014</changelog>
  <changelog author="imanyugin@suse.com" date="1521115200">- added /etc/ClusterTools2/cs_make_sbd_devices, bsc#1084925
- version 3.0.1</changelog>
  <changelog author="kstreitova@suse.com" date="1550750400">- The /etc/cron.d/ClusterTools2 does not contain any active cronjob
  so we can move it to /usr/share/ClusterTools2/samples/ and
  remove "Requires: cron" as it's no longer needed.
  [bsc#1115405] [fate#323635]
- Remove the Vendor line that is now forbidden</changelog>
  <changelog author="abriel@suse.com" date="1576497600">- change version from 3.0.1 to 3.1.0
- Update package to the latest upstream version
  add missing man pages, config files and scripts:
  add new man page man8/cs_show_hana_info.8, man8/cs_dmesg.8,
  man8/cs_show_wwpn.8 , man8/cs_show_hana_autofailover_patterns.8,
  man8/cs_show_cluster_transition.8
  add new kernel modules (ibmvnic.ko, ibmvfc.ko, lin_tape.ko,
  deadman.ko) to search for
  add new config files etc/ClusterTools2/cs_show_memory,
  etc/ClusterTools2/cs_show_cluster_transition
  add new scripts sbin/cs_show_hana_info, sbin/cs_show_wwpn,
  sbin/cs_show_hana_autofailover_patterns, sbin/cs_dmesg,
  sbin/cs_show_cluster_transition, sbin/cs_show_xfs_patterns,
  add new examples for helper scripts (samples/pacemakill)
  enhance the scripts:
  add check for multi-queue scheduler
  change initrd check to support new SLES12/15 format
  adapt the changed sar filename syntax
  add 'systemctl get-default' for SLES12/15 instead of using
  /etc/inittab
  add checks for additional SAP Notes 2655238, 2205917 and 2686011
  remove crontab in favour for systemd timer
  use /etc/os-release instead of old /etc/SuSE-release
  add check for powerVM
  adapt the corosync checks to the new values in the best practice
  documentation
  add additional rpms to look for (e.g. saptune, rear, glibc2,
  kernel-default, kernel-ppc64=4.12.14 ...)
  add additional files (e.g. /boot/grub2/grub.cfg,
  /var/log/mcelog, memory.txt (from supportconfig),
  /etc/systemd/system.conf, /usr/sap/sapservices, /etc/sudoers ...)
  to search for or to search in
  add additional services to check (e.g. sbd.service,
  tuned.service ...)
  add additional error and info pattern to search for in log files
  (e.g. "systemd.*start-limit" and similar search strings)
  enhance the list of cluster related SUSE TIDs
  7022678, 7023149, 7022921, 7021158, 7022255, 7022984, 7023127,
  7021376, 7018571, 7021211, 7018408, 7023236, 7022001, 7019001,
  7017985, 7023007, 7016640, 7018194, 7022644, 7017617, 7018594,
  7022764, 7020256, 7022316, 7022840, 7021065, 7022467, 7022565,
  7022152, 7018352, 7017651, 7023166, 7010249, 3044267, 7004659,
  7018181, 7023324, 7016918, 7023526, 7022310, 7022681, 7023021,
  7023732, 7018233, 7018329, 7018361, 7011860, 7023344, 7021064,
  7022268, 7018744, 7023714, 7023713, 3684654, 3054866, 7022975,
  7022293, 7017750, 7023805, 7021182
  (bsc#1097134, jsc#SLE-9199)
- cleanup the package and the man pages, remove unavailable
  references, adjust Copyright string, adjust feedback address
- script refinement and first steps for an adaption to SLE15 code
  stream
  using 'shellcheck' to find and correct syntax problems,
  spelling errors and other problems</changelog>
  <changelog author="abriel@suse.com" date="1626436800">- change version from 3.1.0 to 3.1.1
- As some of the supportconfig plugins of ClusterTools2 takes very
  log time to process, we will disable these plugins by default in
  /etc/ClusterTools2/supportconfig_plugins.
  That means that after an initial installation of ClusterTools2
  NO supportconfig plugin will be active. To change this behaviour
  manually uncomment the entres of interesst in the file
  /etc/ClusterTools2/supportconfig_plugins.
  During a package update nothing will change. If an active plugin
  is disturbing the creation of a supportconfig archive, please
  comment out the related entry manually in the file
  /etc/ClusterTools2/supportconfig_plugins.
  Please refer to manual page supportconfig_plugins(5) for further
  details.
  (bsc#1186119)
- Add file samples/00_bootstrap_sle15.crm.tmpl to support SLE15
  (bsc#1166943)</changelog>
</package>
<package pkgid="3fc38d6a09627f194cb932a4b038910609a03faff897bcb91d5b0480856e0d8b" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="ed8a696492dfadb62a8fbfb9037a21aa94770536df040c091dccbc0c038ae59e" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="56fd28862ba77cd9b5be6e21c105b788823bc6310f39cdf9dd635facf630d251" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="0dc1c00d2fb564f7de095da9612d151d5fa0988e8a57f735cbabe016fa4f3498" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="8d56403fbf56038278e894819873b5243bac9669bf1cf6a28ebec9030e9e89f4" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="b03c4a71506cb82c48b0257acd1ff1a2498bb6507fa9c96f249ee11f13191249" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="5107e1613dfcc6c4e577723009e9aba4ade4e3f720c25c6c30d7476f12150156" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="18c1436e7856e9982e2446082e1ea49beb6f34db44223a7930d6712eca85f9c1" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="959ec8d7ca7cec5fc09eabbd511d47c74a39a92f4132e714ffe554587c66ddc2" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="e9581264ca358c67b744697d738f1d9449a46f6df94f2a50abf6b7f7c3cdc738" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="07f7adf4ee3f36960880aba26cda600b3082ac9bf67f3e22937b66602f15afe9" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="5915b07fe134d4cb960c7b8d131e273aea1b05c68e52fe1db13db9cdc52bad1d" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="bf1c185e8f4d366bc0034f7b73ae644f32359b6eca26152bed3599569e3660a8" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="3046ee91a167e4921f6309bd2e424aca7fc7e1221b0f071b97e39a44e28ef24c" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="51ed4060763876b93d7179ef8a8597288b20f212159da03b769e8f8ad3c7191d" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="2e30c91402ed86969812d1ae9729a5b6cfa95be16413f97f9a3f674b5c4278c2" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="53391686b83ca41e599e9c06640e1279fcda4299bdd8ebc1b8e73b7f91b157b4" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="490d6c8fe6f96047cd5e9e51763b8365b1c7bf06a3f7b2c441ebe1128eb8ce19" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="8ec109047d16b86008a4dd7987ca7f472fa5786ac6e4f8ffc0d1e48070f803b7" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="bc0fa15c331afc4bbbae9e9750d2d1732691c5e807dcd6a6eeecf3622df7eddf" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="0ae23e120075e63b940721ad22088c382c32af25dac9135189d5cc0e12ceab1c" name="MozillaFirefox" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="2f15a7318bda7f5fd578968659294d20228618c3b0931b46528a798848329238" name="MozillaFirefox" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="49da31d1972f5c339fa0cf48cee70cf19ed59134a3b377b1f240be9e1cb42c7f" name="MozillaFirefox" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="dec47ea07e60c734b2de3bb8efd75b896495914baf33c546a1541c7798d21400" name="MozillaFirefox" arch="src">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="af1c756821ad77aae10be601044347d0d154ac98a164b14932ef4670df9b292f" name="MozillaFirefox" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="8ff457890b7e411389ae3db6bffc888f652f5e99073866529b1785bee0d970a6" name="MozillaFirefox-branding-SLE" arch="aarch64">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="b8e7b3e2f58f3a939a2953c2a2bf339364ff9f3b96b641088e6276aa3f5024cb" name="MozillaFirefox-branding-SLE" arch="ppc64le">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="171dfe34973653ba912d32d0af0bd914d8bf3f2b5f31bf5175b5384942e432e8" name="MozillaFirefox-branding-SLE" arch="s390x">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="ed7ec23dff22a0be07c8dcac812f072bbaed42ec958139183c0eff4c4c20c41a" name="MozillaFirefox-branding-SLE" arch="src">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="cdenicolo@suse.com" date="1392638400">- license update: BSD-3-Clause
  please use SPDX-filenames.</changelog>
  <changelog author="pcerny@suse.com" date="1392811200">- packaging license file</changelog>
  <changelog author="pcerny@suse.com" date="1396008000">- show protocol in URL</changelog>
  <changelog author="pcerny@suse.com" date="1402660800">- marked as compatible with Firefox 31</changelog>
  <changelog author="pcerny@suse.com" date="1406808000">- disable call home features</changelog>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="9fb21377b6f4dfba0a04c244e06cd5b0b082676091cdbe9b6f2010c2529995cb" name="MozillaFirefox-branding-SLE" arch="x86_64">
  <version epoch="0" ver="91" rel="9.5.1"/>
  <changelog author="meissner@suse.com" date="1417867200">- version should be 31.0 instead of 31 to meet requirement
  from firefox</changelog>
  <changelog author="pcerny@suse.com" date="1439553600">- bumped max Firefox version to 38.*</changelog>
  <changelog author="pcerny@suse.com" date="1446638400">- changing version to 38
  (bumping up max supported Firefox version to 38.* in the extension as
  well)</changelog>
  <changelog author="pcerny@suse.com" date="1447934400">- turn tracking protection on by default</changelog>
  <changelog author="pcerny@suse.com" date="1464868800">- changing required Firefox versions in the branding extension
  as well as in the .spec file (requiring 45.*)</changelog>
  <changelog author="pcerny@suse.com" date="1465473600">- remove extension part of the branding, since it is no longer
  needed</changelog>
  <changelog author="pcerny@suse.com" date="1466078400">- fix homepage in the GNOME schema file</changelog>
  <changelog author="pcerny@suse.com" date="1497787200">- change version to 52</changelog>
  <changelog author="pcerny@suse.com" date="1528286400">- change version to 60</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559822400">- change version to 68</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908800">- Fix wrongly displayed version in Help -&gt; About (bsc#1087200)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1559908801">- Fix bookmarks and clean up old files</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1570536000">- moved extensions preferences to core package (bsc#1153869)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1594123200">- change version to 78</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- change version to 91</changelog>
</package>
<package pkgid="5adffce5976cbe8451b58d88e28622d96d5038b45e044d074b1da7c57dac5325" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="20ea7fc7ed82381ae5a5e21c1804d99b88306c63a635a1f5cd26c17ac1ff2a05" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="b6b8952aee701bb6f493d70b6aa2f77746da0a39b0cbe40a6c120b8de13e7337" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="e542fc256ba709a7e6e4bcb7af6117e673bc30a7f5ad835ef52a0500feebff47" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="86ced91c05a948f70cdf8545cea9720c775f04bf03c8c6cbc67c34f373f8a875" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="7984c5e97643a8e6db5e2f7f9af54854d82d139b462dff9ee0e4c51b2b4ddae4" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="c3af79d07b674c95186fec636979e68ea33a5bce71bd79ac8e4ddc65b30e8c90" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="258a5ae1164a256b731bb025561e328292a47526881625e3d1a3454304d59472" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="673350f5fcb5704b498b263fb9f70659025d3318c69c9309c3c6f36722e858ae" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="f37cc0891cc7e05726861e67ab653893d9961e61290870248ccb60406148f922" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="6bf4f138d81308c95dec54b2c88954cc46ffb85e01860ab4bd5ea0511bb327bc" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="86966753facab1ec455bd5ee063eb96c5052be5391ad7d60a6b15472e84ea464" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="c569d57e01a18177d721c12c53e1ba992ecb25a2b72f795425ced593c30eefe8" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="19c82efa3eb5cd0cfcad7de2cba961c3ceb001725692a7eee4bb4663af50a50b" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="104b12fe1f80d08d9eb0f713818e49dae606053ca45cd93e3f676304665789b8" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="3e218451b538f5f2794a24c22ff23a7f2cf894846f3996c8f064a8a1c6e2b60a" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="14437c20d44deb8e276036e5e19bc330216412380a96280585ead77f6298e59c" name="MozillaFirefox-branding-upstream" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="028665ee63551f8b7f8eaade95e9092ce0e1bbca4cc4993c327acbe221f4ecae" name="MozillaFirefox-branding-upstream" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="e1553d5ce58b53d14c5842c1fbf736b3b590751b2e3dabf3ea6378620297aaf6" name="MozillaFirefox-branding-upstream" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="67fb48b7201a3eeb4ad798a27880bfd9fb5c624bf51d7f159d75ca7830458063" name="MozillaFirefox-branding-upstream" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="cbd496448c3988e7b687f25ee94954126de88e616e9685352dd9304c60916384" name="MozillaFirefox-buildsymbols" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="a43f7de9a097d94f1e3d912a9cefe039b004b8073707f20df364579ad1d87d7c" name="MozillaFirefox-buildsymbols" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="b7ca9498e4339327c00566e75fb56f626bfde2c6307c35aa9565b30dc8771229" name="MozillaFirefox-buildsymbols" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="767cdca8ad1e28ea1837ffa42902f2188bbd73d31e852bbf06d0602647102542" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="75269154c7e046223d5834d0d43524117c2dcb5704e8ab2fa1d22eaa754c65ac" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="99a67d7f39ff25517361c23cc68cf9b3314976cae517e7e257d9d591c1f07207" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="66d4fede02a2d0f20fde9b773a33bcd9626af4c5ac40edd39df5acebce938f78" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="e007a6ae0ebef7f0a662192af5e7d51ea7282533675e79fd9713d433c4ba371b" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="42af0b2a4b0ff4928ddd78a20195c0ce8d097fda76a4ffbc9455237535fd7fe1" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="d524576ff92302353824a2d076b945db564f0b87110233701de2b59d36410d7e" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="4f7013974bc582914660d76f7f4cfc1ba8b9adca8de6fa8f573bd235b8451577" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="ba6a1f79d68c2ffafe0add6897f1bb19a7d80ec8ca16e99acdb5974beafc98c3" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="924f03e0215f2f2e89a501bc2a5e61bff92b4e1a3dbff020e20fe5e1e64ff8f0" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="c554b25adb0f67e274f526208d8695dbcf4991bc8373c6b3d8e23b5a64d88743" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="17522885f2b33d939cd552b5e79e79f1ac25d6d3679ac06c2f01a6057671b27e" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="690885d30cc2b3035de3e724c2e9273f1230682603b455e25d5a5fa538f81986" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="7536a1f4a62172d824bc96023071eb6e59250f945485e007aed7b58f69de9b1f" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="989a862b8d02941c8220663c5ccc9ba81a7ad07f35a2805de32130528d2da5d4" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="1588c2c06d4fc7797150e21db1c89cfe1fecac634f173065bf43e88a0da2dbb1" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="ee27f558595a8a6ea577c81f13a99d06a18c1dfbf613b90afd4ec5511b4307a8" name="MozillaFirefox-devel" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="7e400cda7d73fe6f8d46f16cdcdec84e76b3149a7643a0dae247390e24c9983e" name="MozillaFirefox-devel" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="699820ea3e730843a1f4c4361fd63c3fddec9c42d664b2b59befe36eb34111db" name="MozillaFirefox-devel" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="8e40a855bb16f08c8b3628c31ec13779131868416353b73b2802351e055ff4b6" name="MozillaFirefox-devel" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="7fb2176d883c63a990f0de46c37d7a1902da82dd99ad026c0e0b7f1491ba78b8" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="219581665a0117e5a84f1ef90a6082d1790bc016e2f2b6bde835bbd0d821be9b" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="468d45bb34114c1a1fd6a3d17394e3a846a1f08e8adf823ed78df474fa59d436" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="34324bceba15dff47b43585fb30c8e94670963c901faa82b208a10abb8baa09c" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="8eabf53d400da2816a823a3b7d2b8d14263dafe2c0636ad5097d79f5c82469d5" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="0f984634ed3051e07ce7aad641492f20d9da953004b602d770987fbb2e98e092" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="cb6b566f168c3af99c52e99b95694aabfb36ddb0c952dcfe6fd28e98d66ee6bd" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="dccaac6c8b290b6b611ff9bc1245ea2e64ab0e445214a9a77c5443ca6ee51efb" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="b8eb9c3de6bd3dd8393512add758eed1af26b4f56a116063bdf0c7f6f9178c3f" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="581462dd6e26a826652dfb985c28f7d7b9b93a95d056de77e45f6ef46f49096a" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="6b17fb2ffb02c32a1e3c3726bc2d1d86d3e6948d9d8de6ceeeb66cf527c079fc" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="a960c8ea53967d59e90a36e5ea499436204a7c83226f7757cc0151f0f3873c1f" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="96f91e181d595f2a581785eede5bb7007ebaa609a6c3caa03170e315ee50b535" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="ae69133e0b08b2b58b6e4ff0c7bc05c55ce280fdf09381fedf3b03dce745cf3a" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="ba198f074b9d4ab3a14daae0fb7df02a64b05f3eae4647ad8b89907ab27d8657" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="01e7026c5856f9cb2659fae2a8a9c0d34f7326d9299aaf5dee61b2fbaa9befd6" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="fbece1125c3f3a793019a8be5d456edbddf023ea5051d93280e2bb452bec186d" name="MozillaFirefox-translations-common" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="18378a3573bd3344a572bb0296fcafae35da9170b8a21dae29ecdb2302f1a41f" name="MozillaFirefox-translations-common" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="e13dcd154c2dc0d23f15346ab9b3db3e854c3de41cbc5a03a43d3ce436e8e1b6" name="MozillaFirefox-translations-common" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="688f8561302963cff07c615fb4c7c8a44ab4368b76f7b72bdd23c4dc836978fb" name="MozillaFirefox-translations-common" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="dcae16ab18d68314b50e66f9f8f4e4c8ce12026edde734b5ec37d1f10465d190" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="6c605ea88a086a0a722dde5391c3bf6c95dec2f78935a3efe91b6e50d22e90a8" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="2ef7de6341a7edb0950f77bdd43e60297682bd5f1c13d31bf41f279d6bff9980" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="b064724f52fea1bf907e4e7ef5f943a2c1803b3e71ef800fd9124f2094123092" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.43.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596628800">- Activate ccache
- Parallelize langpack build</changelog>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="84f26426cef4e0af5b276b8abb2ade2e844621d01a2c4e3cf2c28afe286f1de3" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="8ee82eadedf27f20585a99eaae3e853f73c4ee4236cf93b21597d8146f6f1e66" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="911a1fa31009555d5c05dea4c0cd011031c8c1b68cfe371b8006e4414d1c63be" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="125622ff958eab1cfa583304777a5dc62bb5106a2643fa58d7152a2431764975" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.46.1"/>
  <changelog author="cgrobertson@suse.com" date="1597406400">- Fix: Do not allow Firefox to use wayland on SLED15-SP0/1
  (bsc#1174420)</changelog>
  <changelog author="cgrobertson@suse.com" date="1598270400">- Added patch: firefox-dev-random-sandbox.patch (bsc#1174284)
  * Firefox tab crash in FIPS mode</changelog>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
</package>
<package pkgid="f01e573a8c037d17109761ccf8691c8cee4bb4e9a3c35a26c9760ffcfe6e1a80" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="d17aa0432bbd1abef9330794377ef4134872412965aa19f355d0e410b5f2dd2d" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="01fa03cb97d2a16c6d47dfcc7117818b889332840c531e9075489461aa3d0d97" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="867a8c117374d2ac17d7181687658e9b9ea23adaaeff5b4e00bbe7096d056a93" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.49.1"/>
  <changelog author="cgrobertson@suse.com" date="1598356800">- Firefox Extended Support Release 78.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.2
  MFSA 2020-38 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15670 (bmo#1651001, bmo#1651449, bmo#1653626,
    bmo#1656957)
    Memory safety bugs fixed in Firefox 80 and Firefox ESR 78.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257600">- Try to fix langpack-parallelization by introducing separate
  obj-dirs for each lang (boo#1173986, boo#1167976)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600257601">- Enhance fix for wayland-detection (bsc#1174420)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1600776000">- Firefox Extended Support Release 78.3.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-43 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Firefox 81 and Firefox ESR 78.3</changelog>
  <changelog author="cgrobertson@suse.com" date="1601553600">- Firefox Extended Support Release 78.3.1 ESR (bsc#1176756)
  * Fixed: Fixed legacy preferences not being properly applied
    when set via GPO (bmo#1666836)</changelog>
  <changelog author="cgrobertson@suse.com" date="1603195200">- Firefox Extended Support Release 78.4.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-46 (bsc#1177872)
  * CVE-2020-15969 (bmo#1666570, bmo#https://github.com/sctplab/u
    srsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Firefox 82 and Firefox ESR 78.4</changelog>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
</package>
<package pkgid="cb3d8ed64e1116a5be76fc30c779a1cfb51f2d660731f03a0af6f8261f49c075" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="3e611f4bfb866c6a459f436333fc2cc4501b4a9be7a11d0547b992a12458c9f0" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="a97a59d89577548fa28fa16ad26eff6332158fce3134ec64578f7dff66ba65bc" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="c2b07ca642cca27e3637b7ec0f81b33a76a0e1af34691cbbaed8da7aa72bcf04" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="152.3.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1634731200">- Rebase mozilla-sandbox-fips.patch to punch another hole in the
  sandbox containment, to be able to open /proc/sys/crypto/fips_enabled
  from within the newly introduced socket process sandbox.
  This fixes bsc#1191815 and bsc#1190141
- Add a way to let users overwrite MOZ_ENABLE_WAYLAND
- Rename mozilla-neqo-fix-fips-crash.patch to mozilla-bmo1735309.patch
  and rebase to the official upstream patch</changelog>
</package>
<package pkgid="72ead71031a04562677febcc81034faa0dcb5c2f7112b3e70f3a370a1021cac6" name="MozillaFirefox-translations-other" arch="aarch64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="ebb747ad2ad9b142de4b4d82610e0419bb57851888825b8ac4ba35270e6c1e7f" name="MozillaFirefox-translations-other" arch="ppc64le">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="8585ec76bd697834baf0b9dba1be1070665b57186aa6937ddf022686c35413dc" name="MozillaFirefox-translations-other" arch="s390x">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="19aacedf0fa430ee8c0a6f298bb80fece49ab6ccdc63458cca00ff42d90aba37" name="MozillaFirefox-translations-other" arch="x86_64">
  <version epoch="0" ver="91.2.0" rel="8.54.1"/>
  <changelog author="cgrobertson@suse.com" date="1604923200">- Firefox Extended Support Release 78.4.1 ESR
  * Fixed: Security fix
  MFSA 2020-49 (bsc#1178588)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605614400">- Firefox Extended Support Release 78.5.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-51 (bsc#1178824)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security
    UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Firefox 83 and Firefox ESR 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Firefox Extended Support Release 78.6.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2020-55 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Firefox 84 and Firefox ESR 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610020800">- Firefox Extended Support Release 78.6.1 ESR
  * Fixed: Security fix
  * Fixed: Fixed a crash during video playback on Apple Silicon
    devices (bmo#1683579)
  MFSA 2021-01 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611662400">- Firefox Extended Support Release 78.7.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-04 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Firefox 85 and Firefox ESR 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Firefox Extended Support Release 78.7.1 ESR
  * Fixed: Prevent access to NTFS special paths that could lead
    to filesystem corruption. (bmo#1689598)
  * Fixed: Security fix
  MFSA 2021-06 (bsc#1181848)
  * MOZ-2021-0001 (bmo#1676636)
    Buffer overflow in depth pitch calculations for compressed
    textures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614081600">- Firefox Extended Support Release 78.8.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-08 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Firefox 86 and Firefox ESR 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616587200">- Firefox Extended Support Release 78.9.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-11 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Firefox 87 and Firefox ESR 78.9</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618833600">- Firefox Extended Support Release 78.10.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.10
  MFSA 2021-15 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Firefox Extended Support Release 78.10.1 ESR
  * Fixed: Resolved an issue caused by a recent Widevine plugin
    update which prevented some purchased video content from
    playing correctly (bmo#1705138)
  * Fixed: Security fix
  MFSA 2021-18 (bsc#1185633)
  * CVE-2021-29951 (bmo#1690062)
    Mozilla Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1622548800">- Firefox Extended Support Release 78.11.0 ESR
  * Fixed: Various stability, functionality, and security fixes
- Mozilla Firefox ESR 78.11
  MFSA 2021-24 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Firefox 89 and Firefox ESR 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626177600">- Firefox Extended Support Release 78.12.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-29 (bsc#1188275)
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Firefox 90 and Firefox ESR 78.12</changelog>
  <changelog author="william.brown@suse.com" date="1626350400">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Update Firefox to use the 1.43 version of Rust.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628596800">- Firefox Extended Support Release 78.13.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-34 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13</changelog>
  <changelog author="cgrobertson@suse.com" date="1628683200">- Firefox Extended Support Release 91.0 ESR
  * New: Some of the highlights of the new Extended Support
    Release are:
  - A number of user interface changes. For more information,
    see the Firefox 89 release notes.
  - Firefox now supports logging into Microsoft, work, and
    school accounts using Windows single sign-on. Learn more
  - On Windows, updates can now be applied in the background
    while Firefox is not running.
  - Firefox for Windows now offers a new page about:third-party
    to help identify compatibility issues caused by third-party
    applications
  - Version 2 of Firefox's SmartBlock feature further improves
    private browsing. Third party Facebook scripts are blocked to
    prevent you from being tracked, but are now automatically
    loaded "just in time" if you decide to "Log in with Facebook"
    on any website.
  - Enhanced the privacy of the Firefox Browser's Private
    Browsing mode with Total Cookie Protection, which confines
    cookies to the site where they were created, preventing
    companis from using cookies to track your browsing across
    sites. This feature was originally launched in Firefox's ETP
    Strict mode.
  - PDF forms now support JavaScript embedded in PDF files.
    Some PDF forms use JavaScript for validation and other
    interactive features.
  - You'll encounter less website breakage in Private Browsing
    and Strict Enhanced Tracking Protection with SmartBlock,
    which provides stand-in scripts so that websites load
    properly.
  - Improved Print functionality with a cleaner design and
    better integration with your computer's printer settings.
  - Firefox now protects you from supercookies, a type of
    tracker that can stay hidden in your browser and track you
    online, even after you clear cookies. By isolating
    supercookies, Firefox prevents them from tracking your web
    browsing from one site to the next.
  - Firefox now remembers your preferred location for saved
    bookmarks, displays the bookmarks toolbar by default on new
    tabs, and gives you easy access to all of your bookmarks via
    a toolbar folder.
  - Native support for macOS devices built with Apple Silicon
    CPUs brings dramatic performance improvements over the non-
    native build that was shipped in Firefox 83: Firefox launches
    over 2.5 times faster and web apps are now twice as
    responsive (per the SpeedoMeter 2.0 test). If you are on a
    new Apple device, follow these steps to upgrade to the latest
    Firefox.
  - Pinch zooming will now be supported for our users with
    Windows touchscreen devices and touchpads on Mac devices.
    Firefox users may now use pinch to zoom on touch-capable
    devices to zoom in and out of webpages.
  - We?ve improved functionality and design for a number of
    Firefox search features:
  * Selecting a search engine at the bottom of the search
    panel now enters search mode for that engine, allowing you to
    see suggestions (if available) for your search terms. The old
    behavior (immediately performing a search) is available with
    a shift-click.
  * When Firefox autocompletes the URL of one of your search
    engines, you can now search with that engine directly in the
    address bar by selecting the shortcut in the address bar
    results.
  * We?ve added buttons at the bottom of the search panel to
    allow you to search your bookmarks, open tabs, and history.
  - Firefox supports AcroForm, which will allow you to fill in,
    print, and save supported PDF forms and the PDF viewer also
    has a new fresh look.
  - For our users in the US and Canada, Firefox can now save,
    manage, and auto-fill credit card information for you, making
    shopping on Firefox ever more convenient.
  - In addition to our default, dark and light themes, with
    this release, Firefox introduces the Alpenglow theme: a
    colorful appearance for buttons, menus, and windows. You can
    update your Firefox themes under settings or preferences.
  * Changed: Firefox no longer supports Adobe Flash. There is no
    setting available to re-enable Flash support.
  * Enterprise: Various bug fixes and new policies have been
    implemented in the latest version of Firefox. See more
    details in the Firefox for Enterprise 91 Release Notes.
  MFSA 2021-33 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29981 (bmo#1707774)
    Live range splitting could have led to conflicting
    assignments in the JIT
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29983 (bmo#1719088)
    Firefox for Android could get stuck in fullscreen mode
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29987 (bmo#1716129)
    Users could have been tricked into accepting unwanted
    permissions on Linux
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29982 (bmo#1715318)
    Single bit data leak due to incorrect JIT optimization and
    type confusion
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Firefox 91 and Firefox ESR 78.13
  * CVE-2021-29990 (bmo#1544190, bmo#1716481, bmo#1717778,
    bmo#1719319, bmo#1722073)
    Memory safety bugs fixed in Firefox 91</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1629288000">- Firefox 91.0.1esr ESR
  * Fixed: Fixed an issue causing buttons on the tab bar to be
    resized when loading certain websites (bug 1704404)
    (bmo#1704404)
  * Fixed: Fixed an issue which caused tabs from private windows
    to be visible in non-private windows when viewing switch-to-
    tab results in the address bar panel (bug 1720369)
    (bmo#1720369)
  * Fixed: Various stability fixes
  * Fixed: Security fix
  MFSA 2021-37 (bsc#1189547)
  * CVE-2021-29991 (bmo#1724896)
    Header Splitting possible with HTTP/3 Responses
- Re-add mozilla-silence-no-return-type.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631102400">- Firefox Extended Support Release 91.1.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-40 (bsc#1190269, bsc#1190274)
  * CVE-2021-38492 (bmo#1721107)
    Navigating to `mk:` URL scheme could load Internet Explorer
  * CVE-2021-38495 (bmo#1723391, bmo#1723920, bmo#1724101,
    bmo#1724107)
    Memory safety bugs fixed in Firefox 92 and Firefox ESR 91.1
- Removed mozilla-disable-wasm-emulate-arm-unaligned-fp-access.patch
  made obsolete by upstream changes.
- Rebased patches:
    firefox-branded-icons.patch
    firefox-kde.patch
    mozilla-aarch64-startup-crash.patch
    mozilla-bmo1504834-part1.patch
    mozilla-bmo1504834-part4.patch
    mozilla-bmo1512162.patch
    mozilla-bmo1626236.patch
    mozilla-bmo849632.patch
    mozilla-kde.patch
    mozilla-ntlm-full-path.patch
    mozilla-s390-context.patch
    mozilla-sandbox-fips.patch</changelog>
  <changelog author="cgrobertson@suse.com" date="1631188800">- Added firefox-i586-conflict-typedef-error.patch
    to fix 32bit i586 compile error</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633089600">- Add mozilla-neqo-fix-fips-crash.patch to fix crash in FIPS mode
  (bsc#1190710)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1633435200">- Firefox Extended Support Release 91.2.0 ESR
  * Fixed: Various stability, functionality, and security fixes
  MFSA 2021-45 (bsc#1191332)
  * CVE-2021-38496 (bmo#1725335)
    Use-after-free in MessageTask
  * CVE-2021-38497 (bmo#1726621)
    Validation message could have been overlaid on another origin
  * CVE-2021-38498 (bmo#1729642)
    Use-after-free of nsLanguageAtomService object
  * CVE-2021-32810 (bmo#1729813,
    https://github.com/crossbeam-rs/crossbeam/security/advisories/GHSA-pqqp-xmhj-wgcw)
    Data race in crossbeam-deque
  * CVE-2021-38500 (bmo#1725854, bmo#1728321)
    Memory safety bugs fixed in Firefox 93, Firefox ESR 78.15,
    and Firefox ESR 91.2
  * CVE-2021-38501 (bmo#1685354, bmo#1715755, bmo#1723176)
    Memory safety bugs fixed in Firefox 93 and Firefox ESR 91.2</changelog>
</package>
<package pkgid="cee756064649749e887bd66b66d222043869ba89b9828013bfc4976418f7afb6" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="6f94d38d831817bb5e74e41b8ec64d129acf9007f073dbfc7029a36a1a1fba60" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="feeee8505c068e0f23034d3d9a4c4ccb1b8353456b7c279d47fb0d061fbd10e4" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="71cd5844e27c01a670403730b8867ce3b6437afb623f25ce5c3690d07c77987b" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="3d2967d79c889d521c89c60ff9a116116fba3b48bdce3e17612e2c6ad57de068" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="506e82734537e46473461e0a3af99ffa1d0da2ac3b34426bc3f8d807c37bcf9a" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="c2fd129285f53c98b329907b167c1c52ead839819bb1479fac0fe81b0a1c5e0f" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="fe53ea33b5638f966d72d267daf82d48edf635bf95a7a38524467d3ef7d739b6" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="f26ffaffd86ee320197d397459525f41371af0c9a690dca353b7e123af39d7a9" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="7f5d31cf9aa970da3494de95aad3c2ef6ece38c58856656e7f5a433c59e6768a" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="c815ce3786a0bc8638a2f161e0034c4540c14284774384f91194abbb4ff5cf88" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="78561a748005b59a725eae2227597ef9bdcfffd63bb98963bdede9d4c86ff383" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="55a5303f024afe9d8bc547d739510a0aed8b1376578f080805d28f5a9b96ee23" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="fe49565c9279edbd03249f0827c54928a92915284c58f0609fb7bc3c1ee3011b" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="aa73c18b8ca8abd256b1d671c45352dceb8ca9168abf2f0ec74311094a3b8180" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="84d9bfb3a0027b59092644b59f4deba384b5af8a7552ebfc4be6296862b88c8d" name="MozillaThunderbird" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="5fe2f87a758cbdba58cfd7eca0c6bc6648490b1123800306e5849ebd5c88b5d4" name="MozillaThunderbird" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="4848402913dbbd1a4baf8c9d77c3757fa28ebe1497058e36a2aa292f45a3040b" name="MozillaThunderbird" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="1a9aefbb250c4dbf14b962937aba483a2940e1cfadd278307a0db3aa50dbefa1" name="MozillaThunderbird" arch="src">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="f5b394629a32b66333213e3131bade95982b843cf922197a8eb05ac63e133ede" name="MozillaThunderbird" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="ae8e7320c5a77a1c7c946944c184c151c4d333e25484959c3901830b427206d6" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="9ec92d753242bab8c24b14d303d48f271ed5779050b7ed5255a210c72962161d" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="8a1cb50328ba4fefa4c35aada19f278543fe979e8aadf635efb7aea7cdac55fb" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="3cfe350fdb87c6bea431a35b14baebc633ef2bcd3507fcf6e314de83f63b1ef2" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="f5fdeb91ac8bf0e5e3f91f35f7b864a9a9a4520aabb4426a5dc6cfc565c77db4" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="4023a53e8612cfaa1c096cfc9ac6164d94c524f6a2f66a4fc24b26cb35045724" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="340853a4eb4701dbc5e74dc16895b96310fbd9fc8e63d765f1cf1e5b5dbd3740" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="e457f5ef01f89a1f022921baac4a1d35230c57ea32ec8d7978563110f5cfffa2" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="b0ac97b40d87c6d9502fed1c5285f898cb75f31e906f4dc3f52746d749fcd252" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="d399456b4a1b8164966ab87cedfbb2d438d48e009f41e7740c12150543f494a9" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="6039b8b0bc5515e07d4aaba1b7cc1eb3392b081cf4f1668066c2e5ffea90154c" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="1a1b3e5454ef2e41e0c241517e546d2a7689bf64b2b45658103bf1f6975c2ee5" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="765c3c0ffdb5f114ea052de9fd2ea5e704baad326b61dabe0b733d5f3f88af14" name="MozillaThunderbird-translations-common" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="92826377dbcb622c28f978f152121aba730e7e40c44e12b8ac07eac8cd632038" name="MozillaThunderbird-translations-common" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="c4012221bf66fcc1f4b2003da578318f3742e3acc5f1c03f2da8827ff820e8de" name="MozillaThunderbird-translations-common" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="e9e7999625fd7f3ff66bad652b16800ee37575264ba28359eafae0bd03570292" name="MozillaThunderbird-translations-common" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="b384ee28e49f0b8977a71c2c199f7f8fb56174be9b16dfc14616d6b14e8f95cc" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="e9355e8410a074d2aa49336754cf80cfc7b727268dbb46bc59830ee0320d102a" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="f91eb9225dd23e696c014c5c6f6c5be73e58d5659d6eb606af5efe1914cf699c" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="e6689b71b75d1902cc21df80ae874b467bfeba0aae742d57672000dcc166cbf6" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="78.10.2" rel="8.27.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1593777600">- Mozilla Thunderbird 68.10.0
  * fixed: Chat: Topics displayed some characters improperly
    (bmo#1644024)
  * fixed: Calendar: Filtering tasks did not work when
    "Incomplete Tasks" was selected (bmo#1593711)
  MFSA 2020-26 (bsc#1173576)
  * CVE-2020-12417 (bmo#1640737)
    Memory corruption due to missing sign-extension for ValueTags
    on ARM64
  * CVE-2020-12418 (bmo#1641303)
    Information disclosure due to manipulated URL object
  * CVE-2020-12419 (bmo#1643874)
    Use-after-free in nsGlobalWindowInner
  * CVE-2020-12420 (bmo#1643437)
    Use-After-Free when trying to connect to a STUN server
  * MFSA-2020-0001 (bmo#1606610)
    Automatic account setup leaks Microsoft Exchange login
    credentials
  * CVE-2020-12421 (bmo#1308251)
    Add-On updates did not respect the same certificate trust
    rules as software updates</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
</package>
<package pkgid="ddc034e1387ec0f3a274961766b00d1afbc98e51dea288a48ce9edae104b8556" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="65a861a2562c0ae29afda9d144a7ab81b127641e9c89565ec721aebbc156f51d" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="1c6acfbd5a3c17788616ef5f0153198fb5576e99cbcf3f51eeb0ca73521930a0" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="74c9fd975001d30cd785bd68ef77c700ea5a31a803d75cb3ac2afae51404a9de" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="78.11.0" rel="8.30.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1596196800">- Mozilla Thunderbird 68.11
  * fixed: FileLink attachments included as a link and file when
    added from a network drive via drag &amp; drop (bmo#793118)
  * fixed: Various security fixes
  MFSA 2020-35 (bsc#1174538)
  * CVE-2020-15652 (bmo#1634872)
    Potential leak of redirect targets when loading scripts in a
    worker
  * CVE-2020-6514 (bmo#1642792)
    WebRTC data channel leaks internal address to peer
  * CVE-2020-6463 (bmo#1635293)
    Use-after-free in ANGLE gl::Texture::onUnbindAsSamplerTexture
  * CVE-2020-15659 (bmo#1550133, bmo#1633880, bmo#1646787,
    bmo#1650811)
    Memory safety bugs fixed in Thunderbird 68.11</changelog>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
</package>
<package pkgid="fa56187df86f58759ec24236b73676b5ea2ba8b980fce0dc75ec49b4f875769f" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="ca53a36767b3692c21f3005b5117a0c32cea22e1c197b57c0625297eeb111c26" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="32394d0df7b96a6c82a10e5a57d230a18dbbd6f1644f10acbc103cc569be9916" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="4697b3e1587524879e06e0e206fd9f4188a778496e12756e7c169262ce589d78" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="78.12.0" rel="8.33.1"/>
  <changelog author="cgrobertson@suse.com" date="1598875200">- Mozilla Thunderbird 68.12
  * fixed: Various security vulnerabilities
  MFSA 2020-40 (bsc#1175686)
  * CVE-2020-15663 (bmo#1643199)
    Downgrade attack on the Mozilla Maintenance Service could
    have resulted in escalation of privilege
  * CVE-2020-15664 (bmo#1658214)
    Attacker-induced prompt for extension installation
  * CVE-2020-15669 (bmo#1656957)
    Use-After-Free when aborting an operation</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
</package>
<package pkgid="9fb52c0da6defe6e076acd31a5eed2aab4d4661ec83a5d7a3458e557be3aa292" name="MozillaThunderbird-translations-other" arch="aarch64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="fa0729bdf5938f47a40ec42b0fe049125dab2fb908f69ff2d8bf0e1a1273853a" name="MozillaThunderbird-translations-other" arch="ppc64le">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="8e6e4b31496479994052c9eb01d7f049f158df23cc6b1d5b88f2d3ce2c3efdef" name="MozillaThunderbird-translations-other" arch="s390x">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="84faa5270cdeca9108a14ff4eb7bc9dab2e8885a498ab73071433235d5021162" name="MozillaThunderbird-translations-other" arch="x86_64">
  <version epoch="0" ver="78.13.0" rel="8.36.1"/>
  <changelog author="martin.sirringhaus@suse.com" date="1602676800">- Mozilla Thunderbird 78.3.2 (bsc#1176899)
  * OpenPGP: Improved support for encrypting with subkeys
  * OpenPGP: Encrypted messages with international characters were
    sometimes displayed incorrectly
  * Single-click deletion of recipient pills with middle mouse
    button restored
  * Searching an address book list did not display results
  * Dark mode, high contrast, and Windows theming fixes
- Mozilla Thunderbird 78.3.1
  * fix crash in nsImapProtocol::CreateNewLineFromSocket (bmo#1667120)
- Mozilla Thunderbird 78.3.0
  MFSA 2020-44 (bsc#1176756)
  * CVE-2020-15677 (bmo#1641487)
    Download origin spoofing via redirect
  * CVE-2020-15676 (bmo#1646140)
    XSS when pasting attacker-controlled data into a
    contenteditable element
  * CVE-2020-15678 (bmo#1660211)
    When recursing through layers while scrolling, an iterator
    may have become invalid, resulting in a potential use-after-
    free scenario
  * CVE-2020-15673 (bmo#1648493, bmo#1660800)
    Memory safety bugs fixed in Thunderbird 78.3
- requires NSPR &gt;= 4.25.1
- removed obsolete thunderbird-bmo1664607.patch
- Mozilla Thunderbird 78.2.2
  https://www.thunderbird.net/en-US/thunderbird/78.2.2/releasenotes
- added thunderbird-bmo1664607.patch required for builds w/o updater
  (boo#1176384)
- Mozilla Thunderbird 78.2.1 (bsc#1174230)
  * based on Mozilla's 78 ESR codebase
  * many new and changed features
    https://www.thunderbird.net/en-US/thunderbird/78.0/releasenotes/#whatsnew
  * built-in OpenPGP support (enigmail neither required nor supported)
- added platform patches:
  * mozilla-s390x-skia-gradient.patch
  * mozilla-pipewire-0-3.patch
  * mozilla-bmo1512162.patch
  * mozilla-bmo1626236.patch
  * mozilla-bmo998749.patch
  * mozilla-sandbox-fips.patch
  * thunderbird-remove-python2.patch
- removed obsolete platform patches
  * mozilla-s390-bigendian.patch
  * mozilla-nestegg-big-endian.patch
  * mozilla-openaes-decl.patch
  * mozilla-cubeb-noreturn.patch</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603108800">- Mozilla Thunderbird 78.3.3
  * OpenPGP: Improved support for encrypting with subkeys
    (bmo#1665497)
  * OpenPGP message status icons were not visible in
    message header pane (bmo#1670067)
  * OpenPGP Key Manager was missing from Tools menu on
    macOS (bmo#1662279)
  * Creating a new calendar event did not require an event
    title (bmo#1663303)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1603368000">- Mozilla Thunderbird 78.4
  * new: MailExtensions: browser.tabs.sendMessage API added
    (bmo#1641576)
  * new: MailExtensions: messageDisplayScripts API added
    (bmo#1504475)
  * changed: Yahoo and AOL mail users using password
    authentication will be migrated to OAuth2 (bmo#1606339)
  * changed: MailExtensions: messageDisplay APIs extended to
    support multiple selected messages (bmo#1617461)
  * changed: MailExtensions: compose.begin functions now support
    creating a message with attachments (bmo#1662018)
  * fixed: Thunderbird could freeze when updating global search
    index (bmo#1669872)
  * fixed: Multiple issues with handling of self-signed SSL
    certificates addressed (bmo#1590474)
  * fixed: Recipient address fields in compose window could
    expand to fill all available space (bmo#1666463)
  * fixed: Inserting emoji characters in message compose window
    caused unexpected behavior (bmo#1638874)
  * fixed: Button to restore default folder icon color was not
    keyboard accessible (bmo#1663075)
  * fixed: Various keyboard navigation fixes (bmo#1667567)
  * fixed: Various color-related theme fixes (bmo#1668410)
  * fixed: MailExtensions: Updating attachments with
    onBeforeSend.addListener() did not work (bmo#1662015)
  MFSA 2020-47 (bsc#1177977)
  * CVE-2020-15969 (bmo#1666570, https://github.com/sctplab/
    usrsctp/commit/ffed0925f27d404173c1e3e750d818f432d2c019)
    Use-after-free in usersctp
  * CVE-2020-15683 (bmo#1576843, bmo#1656987, bmo#1660954,
    bmo#1662760, bmo#1663439, bmo#1666140)
    Memory safety bugs fixed in Thunderbird 78.4</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605009600">- Mozilla Thunderbird 78.4.2
  MFSA 2020-49 (bsc#1178611)
  * CVE-2020-26950 (bmo#1675905)
    Write side effects in MCallGetProperty opcode not accounted
    for
- Mozilla Thunderbird 78.4.1
  * new: Thunderbird prompts for an address to use when starting
    an email from an address book entry with multiple addresses
    (bmo#84028)
  * fixed: Searching global search results did not work
    (bmo#1664761)
  * fixed: Link location was not focused by default when adding a
    hyperlink in message composer (bmo#1670660)
  * fixed: Advanced address book search dialog was unusable
    (bmo#1668147)
  * fixed: Encrypted draft reply emails lost "Re:" prefix
    (bmo#1661510)
  * fixed: Replying to a newsgroup message did not open the
    compose window (bmo#1672667)
  * fixed: Unable to delete multiple newsgroup messages
    (bmo#1657988)
  * fixed: Appmenu displayed visual glitches (bmo#1636243)
  * fixed: Visual glitches when selecting multiple messages in
    the message pane and using Ctrl+click (bmo#1671800)
  * fixed: Switching between dark and light mode could lead to
    unreadable text on macOS (bmo#1668989)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605528000">- Mozilla Thunderbird 78.4.3
  * fixed: User interface was inconsistent when switching from
    the default theme to the dark theme and back to the default
    theme (bmo#1659282)
  * fixed: Email subject would disappear when hovering over it
    with the mouse when using Windows 7 Classic theme
    (bmo#1675970)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1605787200">- Mozilla Thunderbird 78.5.0
  * new: OpenPGP: Added option to disable attaching the public
    key to a signed message (bmo#1654950)
  * new: MailExtensions: "compose_attachments" context added to
    Menus API (bmo#1670822)
  * new: MailExtensions: Menus API now available on displayed
    messages (bmo#1670825)
  * changed: MailExtensions: browser.tabs.create will now wait
    for "mail-delayed-startup-finished" event (bmo#1674407)
  * fixed: OpenPGP: Support for inline PGP messages improved
    (bmo#1672851)
  * fixed: OpenPGP: Message security dialog showed unverified
    keys as unavailable (bmo#1675285)
  * fixed: Chat: New chat contact menu item did not function
    (bmo#1663321)
  * fixed: Various theme and usability improvements (bmo#1673861)
  * fixed: Various security fixes
  MFSA 2020-52 (bsc#1178894)
  * CVE-2020-26951 (bmo#1667113)
    Parsing mismatches could confuse and bypass security
    sanitizer for chrome privileged code
  * CVE-2020-16012 (bmo#1642028)
    Variable time processing of cross-origin images during
    drawImage calls
  * CVE-2020-26953 (bmo#1656741)
    Fullscreen could be enabled without displaying the security UI
  * CVE-2020-26956 (bmo#1666300)
    XSS through paste (manual and clipboard API)
  * CVE-2020-26958 (bmo#1669355)
    Requests intercepted through ServiceWorkers lacked MIME type
    restrictions
  * CVE-2020-26959 (bmo#1669466)
    Use-after-free in WebRequestService
  * CVE-2020-26960 (bmo#1670358)
    Potential use-after-free in uses of nsTArray
  * CVE-2020-15999 (bmo#1672223)
    Heap buffer overflow in freetype
  * CVE-2020-26961 (bmo#1672528)
    DoH did not filter IPv4 mapped IP Addresses
  * CVE-2020-26965 (bmo#1661617)
    Software keyboards may have remembered typed passwords
  * CVE-2020-26966 (bmo#1663571)
    Single-word search queries were also broadcast to local
    network
  * CVE-2020-26968 (bmo#1551615, bmo#1607762, bmo#1656697,
    bmo#1657739, bmo#1660236, bmo#1667912, bmo#1671479,
    bmo#1671923)
    Memory safety bugs fixed in Thunderbird 78.5</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1606910400">- Mozilla Thunderbird 78.5.1
  * new: OpenPGP: Added option to disable email subject
    encryption (bmo#1666073)
  * changed: OpenPGP public key import now supports multi-file
    selection and bulk accepting imported keys (bmo#1665145)
  * changed: MailExtensions: getComposeDetails will wait for
    "compose-editor-ready" event (bmo#1675012)
  * fixed: New mail icon was not removed from the system tray at
    shutdown (bmo#1664586)
  * fixed: "Place replies in the folder of the message being
    replied to" did not work when using "Reply to List"
    (bmo#522450)
  * fixed: Thunderbird did not honor the "Run search on server"
    option when searching messages (bmo#546925)
  * fixed: Highlight color for folders with unread messages
    wasn't visible in dark theme (bmo#1676697)
  * fixed: OpenPGP: Key were missing from Key Manager
    (bmo#1674521)
  * fixed: OpenPGP: Option to import keys from clipboard always
    disabled (bmo#1676842)
  * fixed: The "Link" button on the large attachments info bar
    failed to open up Filelink section in Options if the user had
    not yet configured Filelink (bmo#1677647)
  * fixed: Address book: Printing members of a mailing list
    resulted in incorrect output (bmo#1676859)
  * fixed: Unable to connect to LDAP servers configured with a
    self-signed SSL certificate (bmo#1659947)
  * fixed: Autoconfig via LDAP did not work as expected
    (bmo#1662433)
  * fixed: Calendar: Pressing Ctrl-Enter in the new event dialog
    would create duplicate events (bmo#1668478)
  * fixed: Various security fixes
  MFSA 2020-53 (bsc#1179530)
  * CVE-2020-26970 (bmo#1677338)
    Stack overflow due to incorrect parsing of SMTP server
    response codes</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1608033600">- Mozilla Thunderbird 78.6
  * new: MailExtensions: Added
    browser.windows.openDefaultBrowser() (bmo#1664708)
  * changed: Thunderbird now only shows quota exceeded
    indications on the main window (bmo#1671748)
  * changed: MailExtensions: menus API enabled in messages being
    composed (bmo#1670832)
  * changed: MailExtensions: Honor allowScriptsToClose argument
    in windows.create API function (bmo#1675940)
  * changed: MailExtensions: APIs that returned an accountId will
    reflect the account the message belongs to, not what is
    stored in message headers (bmo#1644032)
  * fixed: Keyboard shortcut for toggling message "read" status
    not shown in menus (bmo#1619248)
  * fixed: OpenPGP: After importing a secret key, Key Manager
    displayed properties of the wrong key (bmo#1667054)
  * fixed: OpenPGP: Inline PGP parsing improvements (bmo#1660041)
  * fixed: OpenPGP: Discovering keys online via Key Manager
    sometimes failed on Linux (bmo#1634053)
  * fixed: OpenPGP: Encrypted attachment "Decrypt and Open/Save
    As" did not work (bmo#1663169)
  * fixed: OpenPGP: Importing keys failed on macOS (bmo#1680757)
  * fixed: OpenPGP: Verification of clear signed UTF-8 text
    failed (bmo#1679756)
  * fixed: Address book: Some columns incorrectly displayed no
    data (bmo#1631201)
  * fixed: Address book: The address book view did not update
    after changing the name format in the menu (bmo#1678555)
  * fixed: Calendar: Could not import an ICS file into a CalDAV
    calendar (bmo#1652984)
  * fixed: Calendar: Two "Home" calendars were visible on a new
    profile (bmo#1656782)
  * fixed: Calendar: Dark theme was incomplete on Linux
    (bmo#1655543)
  * fixed: Dark theme did not apply to new mail notification
    popups (bmo#1681083)
  * fixed: Folder icon, message list, and contact side bar visual
    improvements (bmo#1679436)
  * fixed: MailExtensions: HTTP refresh in browser content tabs
    did not work (bmo#1667774)
  * fixed: MailExtensions: messageDisplayScripts failed to run in
    main window (bmo#1674932)
  * fixed: Various security fixes
  MFSA 2020-56 (bsc#1180039)
  * CVE-2020-16042 (bmo#1679003)
    Operations on a BigInt could have caused uninitialized memory
    to be exposed
  * CVE-2020-26971 (bmo#1663466)
    Heap buffer overflow in WebGL
  * CVE-2020-26973 (bmo#1680084)
    CSS Sanitizer performed incorrect sanitization
  * CVE-2020-26974 (bmo#1681022)
    Incorrect cast of StyleGenericFlexBasis resulted in a heap
    use-after-free
  * CVE-2020-26978 (bmo#1677047)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2020-35111 (bmo#1657916)
    The proxy.onRequest API did not catch view-source URLs
  * CVE-2020-35112 (bmo#1661365)
    Opening an extension-less download may have inadvertently
    launched an executable instead
  * CVE-2020-35113 (bmo#1664831, bmo#1673589)
    Memory safety bugs fixed in Thunderbird 78.6</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1610452800">- Mozilla Thunderbird 78.6.1
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  MFSA 2021-02 (bsc#1180623)
  * CVE-2020-16044 (bmo#1683964)
    Use-after-free write when handling a malicious COOKIE-ECHO
    SCTP chunk</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1611748800">- Mozilla Thunderbird 78.7
  * changed: MailExtensions: browserAction, composeAction, and
    messageDisplayAction toolbar buttons now support label and
    default_label properties (bmo#1583478)
  * fixed: Running a quicksearch that returned no results did not
    offer to re-run as a global search (bmo#1663153)
  * fixed: Message search toolbar fixes (bmo#1681010)
  * fixed: Very long subject lines distorted the message compose
    and display windows, making them unusable (bmo#77806)
  * fixed: Compose window: Recipient addresses that had not yet
    been autocompleted were lost when clicking Send button
    (bmo#1674054)
  * fixed: Compose window: New message is no longer marked as
    "changed" just from tabbing out of the recipient field
    without editing anything (bmo#1681389)
  * fixed: Account autodiscover fixes when using MS Exchange
    servers (bmo#1679759)
  * fixed: LDAP address book stability fix (bmo#1680914)
  * fixed: Messages with invalid vcard attachments were not
    marked as read when viewed in the preview window
    (bmo#1680468)
  * fixed: Chat: Could not add TLS certificate exceptions for
    XMPP connections (bmo#1590471)
  * fixed: Calendar: System timezone was not always properly
    detected (bmo#1678839)
  * fixed: Calendar: Descriptions were sometimes blank when
    editing a single occurrence of a repeating event
    (bmo#1664731)
  * fixed: Various printing bugfixes (bmo#1676166)
  * fixed: Visual consistency and theme improvements
    (bmo#1682808)
  * fixed: Various security fixes
  MFSA 2021-05 (bsc#1181414)
  * CVE-2021-23953 (bmo#1683940)
    Cross-origin information leakage via redirected PDF requests
  * CVE-2021-23954 (bmo#1684020)
    Type confusion when using logical assignment operators in
    JavaScript switch statements
  * CVE-2020-15685 (bmo#1622640)
    IMAP Response Injection when using STARTTLS
  * CVE-2020-26976 (bmo#1674343)
    HTTPS pages could have been intercepted by a registered
    service worker when they should not have been
  * CVE-2021-23960 (bmo#1675755)
    Use-after-poison for incorrectly redeclared JavaScript
    variables during GC
  * CVE-2021-23964 (bmo#1662507, bmo#1666285, bmo#1673526,
    bmo#1674278, bmo#1674835, bmo#1675097, bmo#1675844,
    bmo#1675868, bmo#1677590, bmo#1677888, bmo#1680410,
    bmo#1681268, bmo#1682068, bmo#1682938, bmo#1683736,
    bmo#1685260, bmo#1685925)
    Memory safety bugs fixed in Thunderbird 78.7</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1612785600">- Mozilla Thunderbird 78.7.1 (bsc#1181848)
  * changed: Building OpenPGP shared library linked to system
    libraries now supported (bmo#1634963)
  * changed: MailExtension errors now shown in Developer Tools
    console by default (bmo#1650149)
  * changed: MailExtensions: Dynamic registration of calendar
    providers now supported (bmo#1652885)
  * fixed: OpenPGP improvements (bmo#1655210)
  * fixed: Message preview was sometimes blank after upgrading
    from Thunderbird 68 (bmo#1653168)
  * fixed: Email addresses whitelisted for remote content not
    displayed in preferences (bmo#1652575)
  * fixed: Importing data from Seamonkey did not work
    (bmo#272292)
  * fixed: Renaming a mail list did not update the side bar
    (bmo#1632331)
  * fixed: MailExtensions: messenger.* namespace was undefined
    (bmo#1641573)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1614168000">- Mozilla Thunderbird 78.8
  * fixed: Importing an address book from a CSV file always
    reported an error (bmo#1685048)
  * fixed: Security information for S/MIME messages was not
    displayed correctly prior to a draft being saved
    (bmo#1683701)
  * fixed: Calendar: FileLink UI fixes for Caldav calendars
    (bmo#1669803)
  * fixed: Recurring tasks were always marked incomplete; unable
    to use filters (bmo#1686466)
  * fixed: Various UI widgets not working (bmo#1690098)
  * fixed: Dark theme improvements (bmo#1691106)
  * fixed: Extension manager was missing link to addon support
    web page (bmo#1642219)
  * fixed: Various security fixes
  MFSA 2021-09 (bsc#1182614)
  * CVE-2021-23969 (bmo#1542194)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23968 (bmo#1687342)
    Content Security Policy violation report could have contained
    the destination of a redirect
  * CVE-2021-23973 (bmo#1690976)
    MediaError message property could have leaked information
    about cross-origin resources
  * CVE-2021-23978 (bmo#1682928, bmo#1687391, bmo#1687597,
    bmo#786797)
    Memory safety bugs fixed in Thunderbird 78.8
- Update create-tar.sh to use https instead of http (bsc#1182357)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1616760000">- Mozilla Thunderbird 78.9
  * fixed: New mail notification displayed old messages that were
    unread
  * fixed: Spaces following soft line breaks in messages using
    quoted-printable and format=flowed were incorrectly encoded;
    existing messages which were previously incorrectly encoded
    may now display with some words not separated by a space
  * fixed: Some fields were unreadable in the Dark theme in the
    General preferences panel
  * fixed: Sending a message containing an anchor tag with an
    invalid data URI failed
  * fixed: When switching tabs, input focus was not moved to the
    new tab
  * fixed: Address Book: Syncing a read-only Google address book
    via CardDAV failed
  * fixed: Address Book: Importing VCards with non-ascii
    characters would fail
  * fixed: Address Book: Some values may not have been parsed
    when syncing from Google address books.
  * fixed: Add-ons Manager did not show if an addon used
    experiment APIs
  * fixed: Calendar: Removing a recurring task was not possible
  * fixed: Various security fixes
  MFSA 2021-12 (bsc#1183942)
  * CVE-2021-23981 (bmo#1692832)
    Texture upload into an unbound backing buffer resulted in an
    out-of-bound read
  * MOZ-2021-0002 (bmo#1691547)
    Angle graphics library out of date
  * CVE-2021-23982 (bmo#1677046)
    Internal network hosts could have been probed by a malicious
    webpage
  * CVE-2021-23984 (bmo#1693664)
    Malicious extensions could have spoofed popup information
  * CVE-2021-23987 (bmo#1513519, bmo#1683439, bmo#1690169,
    bmo#1690718)
    Memory safety bugs fixed in Thunderbird 78.9
- cleaned up and fixed mozilla.sh.in for wayland (boo#1177542)</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1617969600">- Mozilla Thunderbird 78.9.1
  * new: Support recipient aliases for OpenPGP encryption.
    Documentation can be found https://wiki.mozilla.org/
    Thunderbird:OpenPGP:Aliases.
  * fixed: The key and signature parts of the message security
    popup on a received message could not be selected for
    copy/paste.
  * fixed: Various UX and theme improvements
  MFSA 2021-13 (bsc#1184536)
  * CVE-2021-23991 (bmo#1673240)
    An attacker may use Thunderbird's OpenPGP key refresh
    mechanism to poison an existing key
  * MOZ-2021-23992 (bmo#1666236)
    A crafted OpenPGP key with an invalid user ID could be used
    to confuse the user
  * CVE-2021-23993 (bmo#1666360)
    Inability to send encrypted OpenPGP email after importing a
    crafted OpenPGP key</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1618920000">- Mozilla Thunderbird 78.10
  * fixed: Usability &amp; theme improvements on Windows
  * fixed: Various security fixes
  MFSA 2021-14 (bsc#1184960)
  * CVE-2021-23994 (bmo#1699077)
    Out of bound write due to lazy initialization
  * CVE-2021-23995 (bmo#1699835)
    Use-after-free in Responsive Design Mode
  * CVE-2021-23998 (bmo#1667456)
    Secure Lock icon could have been spoofed
  * CVE-2021-23961 (bmo#1677940)
    More internal network hosts could have been probed by a
    malicious webpage
  * CVE-2021-23999 (bmo#1691153)
    Blob URLs may have been granted additional privileges
  * CVE-2021-24002 (bmo#1702374)
    Arbitrary FTP command execution on FTP servers using an
    encoded URL
  * CVE-2021-29945 (bmo#1700690)
    Incorrect size computation in WebAssembly JIT could lead to
    null-reads
  * CVE-2021-29946 (bmo#1698503)
    Port blocking could be bypassed
  * CVE-2021-29948 (bmo#1692899)
    Race condition when reading from disk while verifying
    signatures</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1620216000">- Mozilla Thunderbird 78.8.1
  * changed: Removed the fix for bug 1689804 introduced in
    Thunderbird 78.9.0, restoring the previous behavior
  * fixed: Various security fixes
  MFSA 2021-17 (bsc#1185633)
  * CVE-2021-29950 (bmo#1673239)
    Logic issue potentially leaves key material unlocked</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1621339200">- Mozilla Thunderbird 78.10.2
  * new: Added support for importing OpenPGP keys without a
    primary secret key
  * new: Add-ons manager displays a preferences icon for mail
    extensions that include an options page
  * fixed: OpenPGP messages with a high compression ratio (over
    10x) could not be decrypted
  * fixed: Selected OpenPGP key was lost after opening the Key
    Properties dialog in Account Settings
  * fixed: Parsing some OpenPGP user IDs failed
  * fixed: Various improvements to OpenPGP partial encryption
    reminders
  * fixed: Troubleshooting information page did not display row
    labels on macOS
  * fixed: Mail toolbar buttons were too big when displaying both
    icons and text
  * fixed: Various security fixes
  MFSA 2021-22
  * CVE-2021-29957 (bmo#1673241, bsc#1186198)
    Partial protection of inline OpenPGP message not indicated
  * CVE-2021-29956 (bmo#1710290, bsc#1186199)
    Thunderbird stored OpenPGP secret keys without master
    password protection
- Mozilla Thunderbird 78.10.1
  MFSA 2021-19
  * CVE-2021-29951 (bmo#1690062, bsc#1185633)
    Thunderbird Maintenance Service could have been started or
    stopped by domain users</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1623153600">- Mozilla Thunderbird 78.11
  * fixed: OpenPGP could not be disabled for an account if a key
    was previously configured
  * fixed: Recipients were unable to decrypt some messages when
    the sender had changed the message encryption from OpenPGP to
    S/MIME
  * fixed: Contacts moved between CardDAV address books were not
    synced to the new server
  * fixed: CardDAV compatibility fixes for Google Contacts
  * fixed: Folder pane had no clear indication of focus on macOS
  * fixed: Windows theme improvements
  * fixed: Various security fixes
  MFSA 2021-26 (bsc#1186696)
  * CVE-2021-29964 (bmo#1706501)
    Out of bounds-read when parsing a `WM_COPYDATA` message
  * CVE-2021-29967 (bmo#1602862, bmo#1703191, bmo#1703760,
    bmo#1704722, bmo#1706041)
    Memory safety bugs fixed in Thunderbird 78.11
- Added the new Mozilla's GPG key, expiring on 2023-05-17 to the
  mozilla.keyring file</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1626350400">- Mozilla Thunderbird 78.12
  * fixed: Sending an email containing HTML links with spaces in
    the URL sometimes resulted in broken links
  * fixed: Folder Pane display theme fixes for macOS
  * fixed: Chat account settings did not always save as expected
  * fixed: RSS feed subscriptions sometimes lost
  * fixed: Calendar: A parsing error for alarm triggers of type
    "DURATION" caused sync problems for some users
  * fixed: Various security fixes
  MFSA 2021-30 (bsc#1188275)
  * CVE-2021-29969 (bmo#1682370)
    IMAP server responses sent by a MITM prior to STARTTLS could
    be processed
  * CVE-2021-29970 (bmo#1709976)
    Use-after-free in accessibility features of a document
  * CVE-2021-30547 (bmo#1715766)
    Out of bounds write in ANGLE
  * CVE-2021-29976 (bmo#1700895, bmo#1703334, bmo#1706910,
    bmo#1711576, bmo#1714391)
    Memory safety bugs fixed in Thunderbird 78.12</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1628769600">- Mozilla Thunderbird 78.13
  * changed: WeTransfer FileLink provider removed
  * changed: The fix for bmo#1707360, from Thunderbird 78.12.0,
    was removed for causing regressions
  * fixed: OpenPGP: Homebrew's GPG Smartcard libraries not found
    on M1 Macs
  * fixed: Various security fixes
  MFSA 2021-35 (bsc#1188891)
  * CVE-2021-29986 (bmo#1696138)
    Race condition when resolving DNS names could have led to
    memory corruption
  * CVE-2021-29988 (bmo#1717922)
    Memory corruption as a result of incorrect style treatment
  * CVE-2021-29984 (bmo#1720031)
    Incorrect instruction reordering during JIT optimization
  * CVE-2021-29980 (bmo#1722204)
    Uninitialized memory in a canvas object could have led to
    memory corruption
  * CVE-2021-29985 (bmo#1722083)
    Use-after-free media channels
  * CVE-2021-29989 (bmo#1662676, bmo#1666184, bmo#1719178,
    bmo#1719998, bmo#1720568)
    Memory safety bugs fixed in Thunderbird 78.13</changelog>
</package>
<package pkgid="28ffa7b1bc90d8114d32927bc3348553d197dee27f341d6132d1af4f3af4de2d" name="NetworkManager" arch="aarch64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="451113bf3b658171408b27f98f4efec66105f11b5ebf7f66945761541bfcdc8a" name="NetworkManager" arch="ppc64le">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="18653e9e2eb6a4c0c095878acb3eb00b50299827da3c5b2a4d4900a148a3bf98" name="NetworkManager" arch="s390x">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="5e62ef1ba63d2ea3bfede10a3ad229dff01539f267173caa2eb4612bfe3feb37" name="NetworkManager" arch="src">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="097db9f921e12bcb1d4ae081a431d54df9f14046235d3d2fb848b0d07d56edf0" name="NetworkManager" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="251edd8f9cba0252a04ce59a30eaf4cf371c7c73562ced5c547a4d2b77a45f28" name="NetworkManager-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="b50f2421af8a783fe01c9e05da019fb2b796847eb53956a39d4af25b8001b757" name="NetworkManager-devel" arch="aarch64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="d5dcbdaa39bc3c0ebefd8c59aba44a32ea6c817c651ea41aafb506665ba47d2c" name="NetworkManager-devel" arch="ppc64le">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="7f46e3af834ee1c3e345df7a08716d033af54f03ba64d610e2e186309d2ff941" name="NetworkManager-devel" arch="s390x">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="74b8359bc63dcf6458dde4544a777b814e2610693b943497728ea02500d646d2" name="NetworkManager-devel" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="00e97a7ef391d8ead6bac561f1d2a91658946d8dbabb416512f017087baca879" name="NetworkManager-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="d328ded46b25bad3ff7f05f5c41c09567e7b2b78a3a8e7e329aa3cefd3ec2078" name="NetworkManager-lang" arch="noarch">
  <version epoch="0" ver="1.22.10" rel="3.10.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1570622400">- Update to version 1.20.4:
  + Fix crash related to Wi-Fi-P2P.
  + Support rd.znet option in initrd generator to support s390.
  + Fix not creating default-wired-connection when a suitable
    profile exists which is not tied to the device by
    interface-name.
  + tui: support WPA3-Personal (SAE).
  + Fixes for OLPC Mesh Wi-Fi.
  + Various bug fixes. Notably, fix unit test and build issues.
- Drop nm-fix-gtk-doc.patch: Fixed upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1572523200">- Drop NetworkNanager-client recommends: this is no longer needed,
  as NM itself ships a frontend by now (nmtui). If a DE has a
  better way to manage NM (by means of applets or other way of
  integration) it is up to the DE to depend on the applets.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1573041600">- Update to version 1.20.6:
  + Fix updating agent-owned VPN secrets.
  + Adjust IWD support to new D-Bus path of IWD 1.0.
  + Introduce an 'optional' property in the 802-1x setting to
    allow the activation to proceed in case of missing
    authenticator.
  + Fix ARP announcements for IP addresses configured on
    interfaces.
  + Use proper interface when adding s390 specific details in
    initrd generator.
  + Don't disable PMF on Wi-Fi connections using SAE.
  + Properly handle uint16 property types in libnm.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574683200">- Update to version 1.20.8:
  + Fix handling of system CA certificates in the ifcfg parser.
  + Handle ReachableTime and RetransTimer from IPv6 Router
    Advertisements.
  + Fixed setting of MTU according to its parent device for some
    device types.
  + Various fixes for the initramfs configuration genertor.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1576584000">- Update to version 1.22.0:
  + Drop support for BlueZ 4. BlueZ 5 was released in 2012 and
    should nowadays be available everywhere.
  + DHCP: switch "internal" DHCPv4 plugin from code based on
    systemd to use nettools' n-dhcp4 library.
  + Add support for "scope" attribute for IPv4 routes.
  + Add support for specifying IAID and FQDN flags for DHCP
    request.
  + Add a '802-1x.optional' property to consider the wired 802.1X
    authentication as optional.
  + Use the Network Cost Wi-Fi information element to determine
    metered device state.
  + Support main.auth-polkit=root-only setting to disable PolicyKit
    use and restrict authorization to root user.
  + core: declare "startup complete" when device reaches
    "connected" state, even if IP addressing methods did not yet
    fully complete. This changes behavior for unblocking
    "NetworkManager-wait-online.service", and
    "network-online.target" earlier. If this causes issues in your
    setup, you may need to configure "ipv4.may-fail=no" or
    "ipv6.may-fail=no", which delays reaching "connected" state for
    the address family accordingly.
  + libnm: hide NMObject and NMClient typedefs from header files.
    This prevents the user from subclassing these types and is an
    ABI change (in the unlikely case that a user was subclassing
    the types, which is no longer supported).
  + libnm: retire deprecated WiMAX API NMDeviceWimax and
    NMWimaxNsp. WiMAX support was removed from NetworkManager in
    version 1.2 (2016) and no such type instances would have been
    created by NMClient for a while now.
  + Deprecate synchronous API for D-Bus calls in libnm. We don't
    remove libnm API so you are free to continue using it. But
    tells you that using it might be a bad idea.
  + libnm: heavily internal rework NMClient. This slims down libnm
    and makes the implementation more efficient. NMClient should
    work now well with a separate GMainContext.
  + Add `nmcli general reload` subcommand to reload NetworkManager
    configuration and DNS settings.
  + nm-cloud-setup: add new tool for automatically configuring
    NetworkManager in cloud. This is still experimental and
    currently only EC2 and IPv4 is supported.
  + Add new NetworkManager logo to "contrib/art/logo".
  + Various bug fixes and improvements.
- Disable networkmanager-checks-po.patch: Needs rebase.
- Add new nm-cloud-setup.service to pre/post/preun/postun calls.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1577188800">- Update to version 1.22.2:
  + Fix multiple issues in the internal DHCP client, including
    wrong parsing of search domains and classless routes options,
    and failures in obtaining and renewing the lease with certain
    server configurations.
  + Export NM_CAPABILITY_OVS capability on D-Bus and in libnm to
    indicate that the OVS plugin is loaded.
  + Fix libnm annotations for nm_sriov_vf_get_vlan_ids() to allow
    the usage of the function through GObject introspection.</changelog>
  <changelog author="dev@stellardeath.org" date="1578484800">- Fix 'nfs' dispatcher script
  It was checking for an enabled unit 'nfs.service' - which does not
  exist (anymore?). Switched to a check for an enabled unit
  'nfs-client.target'</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578657600">- Update to version 1.22.4:
  + Fix behavior of internal DHCP client when the server sends a
    NAK.
  + Support 31-bit prefixes on IPv4 point-to-point links according
    to RFC 3021.
  + Fix memory leak parsing RequestScan D-Bus method arguments.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1580472000">- Update to version 1.22.6:
  + Various fixes for the internal DHCP client.
  + Slave devices now do not get created/activated if master is
    missing.
  + Fixed 'startup-complete' bug where NetworkManager would reach
    the network-online.target even when not all the connections had
    been tried.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1580904000">- Add -fcommon to CFLAGS. This is currently being done upstream
  (boo#1160381).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1582027200">- Update to version 1.22.8:
  + Added configuration option to customize IPv6 RA timeout.
  + Internal DHCP client will now request a lease renewal using the
    previously obtained IP address when expired.
  + Removed length limitation for OVS Bridge, Patches and
    Interfaces (only Patch types) names.
  + Fixed initialization of 'secs' DHCP header field, this caused
    some DHCP relays to drop packets.
  + Fixed failure when creating team interfaces using 'nmstate'.
  + Various bug fixes and improvements.</changelog>
  <changelog author="werner@suse.de" date="1583928000">- Modify nfs script (boo#1164642)
  * Also mount nfs4 shares
  * Ignore nfs or nfs4 shares in case if the noauto option is set</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1584014400">- Update to version 1.22.10:
  + core: periodically cleanup stale device state files from /run.
  + dhcp: fix crash in nettools client.
  + bond: fixed the validation of the miimon option.
  + Various minor bug fixes and improvements.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1593691200">- Rebase nm-add-CAP_SYS_ADMIN-permission.patch.</changelog>
  <changelog author="hpj@urpla.net" date="1604059200">- Exclude systemd.automount from nfs processing: fix boo#1116625
  as suggested from Neil Brown</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616673600">- Add NM-restore-MAC-on-release-only-when-cloned.patch: bond:
  restore MAC on release only when there is a cloned MAC address
  (glfo#NetworkManager/NetworkManager!775, bsc#1183967).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1617969600">- Add nm-fix-dhcp-client-timeout.patch: Better handle dhclient's
  timeout so that a recorded lease can be used when dhcp server
  is down(glfo#NetworkManager/NetworkManager!811, bsc#1183202).
- Modified NetworkManager.conf: Use dhclient as the default dhcp
  client(glfo#NetworkManager/NetworkManager!811, bsc#1183202).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1621339200">- Add nm-add-CAP_CHOWN-capability.patch: Add CAP_CHOWN to
  CapabilityBoundingSet to make teamd work properly
  (glfo#NetworkManager/NetworkManager!860, bsc#1185424).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1632312000">- Drop nm-add-CAP_CHOWN-capability.patch: This solution was denied
  by upstream maintainers.</changelog>
</package>
<package pkgid="0e662d9232cf0edc80b3770666c4f5af374e070414b07e112aa568284f7cbc5b" name="POS_Image-Graphical7" arch="noarch">
  <version epoch="0" ver="0.1.1620138994.d7f39a0" rel="1.18.1"/>
  <changelog author="nadvornik@suse.com" date="1567166400">- New package</changelog>
  <changelog author="nadvornik@suse.com" date="1571745600">- Comment out plymouth-plugin-label-ft which is not
  available on SLE15 SP1
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="nadvornik@suse.com" date="1575288000">- Enable install-local-bootloader.service (bsc#1158032)
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1579867200">- Add xfsprogs to the image description to make XFS available
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="nadvornik@suse.com" date="1585569600">- Enable Secure Boot by default
- Update to version 0.1.1585755274.cacc6dc</changelog>
  <changelog author="oholecek@suse.com" date="1595505600">- Add plymouth-plugin-label-ft package to all *7 templates and set
  them to be of SLE15SP2 version
- Add optional dracut-wireless comment section and move wpa_suplicant
  there
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1611921600">- Use linuxefi only on x86</changelog>
  <changelog author="nadvornik@suse.com" date="1613995200">- Update install-local-bootloader.service for recent saltboot
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1618401600">- Use absolute path in bootloader service
- Update to version 0.1.1620138994.d7f39a0</changelog>
</package>
<package pkgid="6c32c5b9ae232924fcad4e3651a752f00a3c6f7f3e9cba0bd7cfadbd2dafd118" name="POS_Image-Graphical7" arch="src">
  <version epoch="0" ver="0.1.1620138994.d7f39a0" rel="1.18.1"/>
  <changelog author="nadvornik@suse.com" date="1567166400">- New package</changelog>
  <changelog author="nadvornik@suse.com" date="1571745600">- Comment out plymouth-plugin-label-ft which is not
  available on SLE15 SP1
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="nadvornik@suse.com" date="1575288000">- Enable install-local-bootloader.service (bsc#1158032)
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1579867200">- Add xfsprogs to the image description to make XFS available
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="nadvornik@suse.com" date="1585569600">- Enable Secure Boot by default
- Update to version 0.1.1585755274.cacc6dc</changelog>
  <changelog author="oholecek@suse.com" date="1595505600">- Add plymouth-plugin-label-ft package to all *7 templates and set
  them to be of SLE15SP2 version
- Add optional dracut-wireless comment section and move wpa_suplicant
  there
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1611921600">- Use linuxefi only on x86</changelog>
  <changelog author="nadvornik@suse.com" date="1613995200">- Update install-local-bootloader.service for recent saltboot
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1618401600">- Use absolute path in bootloader service
- Update to version 0.1.1620138994.d7f39a0</changelog>
</package>
<package pkgid="da424b0de121648cd4edade09f00f9ed51ac418b8ea5735ac319bb83d96ee5f3" name="POS_Image-JeOS7" arch="noarch">
  <version epoch="0" ver="0.1.1620138994.d7f39a0" rel="1.18.1"/>
  <changelog author="nadvornik@suse.com" date="1567166400">- New package</changelog>
  <changelog author="nadvornik@suse.com" date="1571745600">- Comment out plymouth-plugin-label-ft which is not
  available on SLE15 SP1
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="nadvornik@suse.com" date="1575288000">- Enable install-local-bootloader.service (bsc#1158032)
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1579867200">- Add xfsprogs to the image description to make XFS available
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="nadvornik@suse.com" date="1585569600">- Enable Secure Boot by default
- Update to version 0.1.1585755274.cacc6dc</changelog>
  <changelog author="oholecek@suse.com" date="1595505600">- Add plymouth-plugin-label-ft package to all *7 templates and set
  them to be of SLE15SP2 version
- Add optional dracut-wireless comment section and move wpa_suplicant
  there
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1611921600">- Use linuxefi only on x86</changelog>
  <changelog author="nadvornik@suse.com" date="1613995200">- Update install-local-bootloader.service for recent saltboot
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1618401600">- Use absolute path in bootloader service
- Update to version 0.1.1620138994.d7f39a0</changelog>
</package>
<package pkgid="7ce49fd4b33dc2d83f8988abda4f7f7b003cfb49a6c3c6123e5e4d5e1575010b" name="POS_Image-JeOS7" arch="src">
  <version epoch="0" ver="0.1.1620138994.d7f39a0" rel="1.18.1"/>
  <changelog author="nadvornik@suse.com" date="1567166400">- New package</changelog>
  <changelog author="nadvornik@suse.com" date="1571745600">- Comment out plymouth-plugin-label-ft which is not
  available on SLE15 SP1
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="nadvornik@suse.com" date="1575288000">- Enable install-local-bootloader.service (bsc#1158032)
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1579867200">- Add xfsprogs to the image description to make XFS available
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="nadvornik@suse.com" date="1585569600">- Enable Secure Boot by default
- Update to version 0.1.1585755274.cacc6dc</changelog>
  <changelog author="oholecek@suse.com" date="1595505600">- Add plymouth-plugin-label-ft package to all *7 templates and set
  them to be of SLE15SP2 version
- Add optional dracut-wireless comment section and move wpa_suplicant
  there
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1611921600">- Use linuxefi only on x86</changelog>
  <changelog author="nadvornik@suse.com" date="1613995200">- Update install-local-bootloader.service for recent saltboot
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1618401600">- Use absolute path in bootloader service
- Update to version 0.1.1620138994.d7f39a0</changelog>
</package>
<package pkgid="e9cd953afd62942010bf96a595bbeaa2cf30eb11f64adfe2bc39f6104e4d5e96" name="PackageKit" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="4a2db1e4eae6d408ccae4879a491ec8e55480d1bc5e737221e098889ff000506" name="PackageKit" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="a64adbc3d719d4bbbfe39a8653950516f3f0f649542b4e0c1deba8697e13f0c8" name="PackageKit" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="cef055595ba8f1c619cf4a85b69f021216dc3f9a7f7322288b7bf3cc9ded936a" name="PackageKit" arch="src">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="d50e53630da21fec51cee81cd1c53a780380e28a260dabbbce9b5f4aedb222e5" name="PackageKit" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="dcab01878e959bb52c44ae76ae06fd02947cbd945e4d5e8c8aa700b4a2b65349" name="PackageKit-backend-dnf" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="63e708dc1fce49f2065b5c32ef0f2e21b8ed95e36e8a9af4b25b94ecded4a3e6" name="PackageKit-backend-dnf" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="7da023ffc3a7b3d177aa7f3f55617084279d59c2b0caea6a2f343686b5aadd2b" name="PackageKit-backend-dnf" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="9bbddbec88b97ee3e899c3857127448969b1eb445aed89b9fef17e86a0ee9e32" name="PackageKit-backend-dnf" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="88e9f7ec441d6d01b7da961b82710a037e6effa5d443fd8067b510a2b0a71626" name="PackageKit-backend-zypp" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="e5fe007c55115c9ba1f6041e5d13482143528d69a552aa7e18d846b6b0b706c4" name="PackageKit-backend-zypp" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="797093243e7d21be48d33e93f39fbdfe3f189433313503b05cf759ee5457e6b0" name="PackageKit-backend-zypp" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="ddd606831e2f235ef3b7418b9c3a63a9047b917f4093f5e9a36dec9d09ac5f96" name="PackageKit-backend-zypp" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="7e1b055d55f33b47ebabd17989b57adacb004945e6cacb5b8e52cd28406e5d77" name="PackageKit-branding-upstream" arch="noarch">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="dce8b5876d78addc196ce2761edd9a771317d849f1213caf9530f4fb472036dc" name="PackageKit-devel" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="9f4f3548fe952774ebe515b2fcc2f9f4871838ac1622cd0a701be85a2c7bac4b" name="PackageKit-devel" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="816d0c9456657a61bcac4d92e922ddbfdcfbcc46c09b79eed412d7e1f53202c5" name="PackageKit-devel" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="71ab83170efd299d5d0032cb8065517cd0b95b39f0b46a09e4e3a499ec90a817" name="PackageKit-devel" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="c3ea28f039061672ff3667bb5d28c582442db60e23e0856511d149ae970483b4" name="PackageKit-gstreamer-plugin" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="5c8d135bff522d5729c4ecd39b6ea43c23ad7a6f484a66640711231d89cacd91" name="PackageKit-gstreamer-plugin" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="233282a2edd96034713daf6cd962c3609b1fbcc2ef4e3f09c2f7781f36f1cd19" name="PackageKit-gstreamer-plugin" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="d9a5d5a1e7ce6b97490386d169f0c349f9d88cb739a66c230b4945f8f855fee4" name="PackageKit-gstreamer-plugin" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="bc742e38fca5a9fecdcef0d1399e4b6695c99678c76bc5ff22629c98aecbd49a" name="PackageKit-gtk3-module" arch="aarch64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="149a8779a6a39a33e2e84d9dd97052dd370567e35ad9f38763135d293af73c31" name="PackageKit-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="6a5dcf6f924282b43e3e46c24714c7915c6874dcdc7732b9f09f12da884aa803" name="PackageKit-gtk3-module" arch="s390x">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="1be72363506082a9a58d004de8086af2185cb041a1963eda2ea2778c7124dbf0" name="PackageKit-gtk3-module" arch="x86_64">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="48282598a298139590dbd2be5cbdab9558bcba087310dd493d25e59523291772" name="PackageKit-lang" arch="noarch">
  <version epoch="0" ver="1.1.13" rel="4.23.1"/>
  <changelog author="sckang@suse.com" date="1571054400">- Remove zypp-Switch-to-doUpgrade-solver-when-required-by-distribution.patch,
  rebase zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch,
  add PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch:
  zypp: Don't set upgrade mode in update-packages
  (gh#hughsie/PackageKit#345).</changelog>
  <changelog author="sckang@suse.com" date="1573646400">- Add PackageKit-zypp-upgrade-system.patch: zypp: implement
  upgrade-system method (bsc#1155638, bsc#1154973,
  gh#hughsie/PackageKit/commit/d060dd24).
- Add PackageKit-zypp-get-files-string-array.patch: zypp: pass an
  array of strings to pk_backend_job_files()
  (gh#hughsie/PackageKit#351).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1574337600">- Add PackageKit-zypp-update-packages-in-all-openSUSE.patch: Handle
  Tumbleweed upgrade in update-packages as well so that it doesn't
  break other components.</changelog>
  <changelog author="ngompa13@gmail.com" date="1578830400">- Update to version 1.1.13
  + New APIs for pk-client-helper in packagekit-glib2
  + dnf, zypp: Various fixes related to upgrades
  + Added support for user services
  + New plymouth "system-upgrade" and "reboot" modes used now
  + Add mutex lock to protect EULAs array
  + Correct bug tracker links on website
  + Support non-x86 arches in gstreamer helper
  + List installed, removed and obsoleted packages in pkcon get-updates
  + Properly mark obsoleted packages when simulating upgrade
  + Provide information about obsoleted packages
  + Return directly when its state is going backwards
  + Shrink the progress bar to fit when run in small spaces
  + Improve the 'using' documentation with a link to API
- Remove upstreamed patches:
  + PackageKit-add-mutex-lock-to-protect-backend-priv-eulas.patch
  + PackageKit-return-on-transactions-going-backwards.patch
  + PackageKit-zypp-dont-set-upgrade-mode-on-updating-specific-packages.patch
  + PackageKit-zypp-fix-newest-filter.patch
  + PackageKit-zypp-fix-what-provides-newest-filter.patch
  + PackageKit-zypp-get-files-string-array.patch
  + PackageKit-zypp-get-updates-dup-or-up.patch
  + PackageKit-zypp-upgrade-system.patch
  + zypp-perform-actions-disallowed-by-update-in-upgrade-mode.patch
  + 0001-dnf-Don-t-override-DnfContext-s-release_ver-for-the-.patch
  + 0001-dnf-Invalidate-the-sack-cache-after-downloading-new-.patch
  + 0001-offline-update-Use-new-plymouth-system-upgrade-and-r.patch
- Add new openSUSE specific patches for DNF backend:
  + PackageKit-dnf-Add-openSUSE-vendor.patch
  + PackageKit-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Remove old openSUSE patches for the DNF backend:
  + 1001-dnf-Add-openSUSE-Tumbleweed-vendor.patch
  + 1002-dnf-Add-support-for-AppStream-repodata-basenames-use.patch
- Refresh patches:
  + PackageKit-drop-gtk2.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Fix autotools modifications in openSUSE vendor patch
  + Patch: PackageKit-dnf-Add-openSUSE-vendor.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="ngompa13@gmail.com" date="1583582400">- Add patch to stop zypp backend failing on already installed packages (boo#1155624)
  + Patch: PackageKit-zypp-revert-fail-on-already-installed.patch</changelog>
  <changelog author="songchuan.kang@suse.com" date="1583841600">- Fix source URL in the spec file.</changelog>
  <changelog author="songchuan.kang@suse.com" date="1584014400">- Add PackageKit-zypp-ignore-already-installed-packages.patch,
  remove PackageKit-zypp-revert-fail-on-already-installed.patch:
  zypp: Ignore already installed package when installing
  (bsc#1155624, gh#/hughsie/PackageKit/commit/d9233011).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1587556800">- Remove is_opensuse macro in spec file to sync SLE and openSUSE
  differences(jsc#SLE-11804).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1590494400">- Add PackageKit-zypp-ensure-ResPool-before-is_tumbleweed.patch:
  zypp: Ensure ResPool is built before is_tumbleweed()
  (gh#/hughsie/PackageKit/commit/5c0fd7d7).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1592308800">- Add PackageKit-pkcon-exit-with-retval-5.patch: pkcon: exit with
  retval 5 if no packages needed be installed
  (gh#/hughsie/PackageKit#405 bsc#1170562).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1598011200">- Add PackageKit-zypp-cleanup-tmp-files.patch: zypp: Cleanup
  temporary files when PackageKit quits
  (gh#/hughsie/PackageKit/commit/807f410, bsc#1169739).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1600862400">- Add PackageKit-zypp-set-PATH.patch: zypp: Set PATH variable
  (gh#/hughsie/PackageKit/commit/2fb7fc6e, bsc#1175315).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1604491200">- Update summary and description of gstreamer-plugin and
  gtk3-module subpackages in spec file (bsc#1104313).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1607083200">- Add PackageKit-CVE-2020-16121.patch: Information disclosure in
  InstallFiles, GetFilesLocal and GetDetailsLocal
  (gh#hughsie/PackageKit/commit/d5e8c597, bsc#1176930).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1611748800">- Add PackageKit-zypp-reset-update-mode-after-get-updates.patch:
  zypp: Reset update mode after getting updates
  (gh#hughsie/PackageKit/commit#b208f551, bsc#1180150).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1614600000">- Add PackageKit-zypp-initialize-pool.patch: zypp: Make sure pool
  is initialized at the beginning of some methods
  (gh#hughsie/PackageKit/commit#3efa0c524, bsc#1180597).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1616760000">- Add PackageKit-cancel-transaction-if-daemon-disappears.patch:
  Fix hangs in packagekit-glib2 client if daemon crashes
  (gh#hughsie/PackageKit#464).</changelog>
  <changelog author="songchuan.kang@suse.com" date="1629460800">- Add PackageKit-zypp-fix-crash-with-empty-search-string.patch:
  zypp: Fix crash when search string is NULL (bsc#1179287,
  gh#hughsie/PackageKit/commit#21ccf49).</changelog>
</package>
<package pkgid="4a112da3970a524e1d9b5b6e878b332e74579d988253b856da5d55ecc7f4605e" name="SAPHanaSR-ScaleOut" arch="noarch">
  <version epoch="0" ver="0.180.1" rel="3.19.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name serve died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
</package>
<package pkgid="3a4a20b965ebbf83463fcc6ee7a9a27e2649a51145ff465b883f1c8e7fdeb652" name="SAPHanaSR-ScaleOut" arch="src">
  <version epoch="0" ver="0.180.1" rel="3.19.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name serve died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
</package>
<package pkgid="0cf057edb0e1b2f3967208c7850d7731c8011ec5dedc3753e46c7710951ba77b" name="SAPHanaSR-ScaleOut-doc" arch="noarch">
  <version epoch="0" ver="0.180.1" rel="3.19.1"/>
  <changelog author="imanyugin@suse.com" date="1465819200">- Initial technical preview release. fate#318793</changelog>
  <changelog author="imanyugin@suse.com" date="1468497600">- Version 0.161.1
- Added a package conflict for SAPHanaSR, bsc#989162
- Restructure package and the .spec file</changelog>
  <changelog author="imanyugin@suse.com" date="1522756800">- Version 0.163.0
- Fix bsc#1045603: Update man pages
- Fix bsc#1045536: SAPHanaSR-ScaleOut missing update to use SLES python
- Fix bsc#1086545: minor typos in package description and man pages</changelog>
  <changelog author="imanyugin@suse.com" date="1525780800">- Fix bsc#1092331: SAPHanaSR: SAPHanaSR-showAttr fails to open an archived cib file
- Fix bsc#1091988:SAPHanaSR-ScaleOut SAPHanaSR-monitor depends on package not existing in SLES
- SAPHanaSR-showAttr, SAPHanaSR-monitor moved to /usr/sbin to match the file layout in SAPHanaSR-ScaleUp</changelog>
  <changelog author="imanyugin@suse.com" date="1530014400">- Version 0.163.1</changelog>
  <changelog author="clanig@suse.de" date="1536753600">- Version 0.163.2
- Fix bsc#1098979: SAPHanaSR-ScaleOut SAPHanaTopology and
  SAPHanaController allowing virtual host names</changelog>
  <changelog author="abriel@suse.com" date="1573473600">- change version to 0.164.0
- restart sapstartsrv service on master nameserver node
  (bsc#1156150)
- Use a fall-back scoring for the master nameserver nodes, if the
  current roles of the node(s) got lost.
  (bsc#1156067)
- clean up package, add checks, correct typos</changelog>
  <changelog author="abriel@suse.com" date="1589457600">- let the SAPHanaSR-ScaleOut-doc package conflict with the
  SAPHanaSR-doc package
  (bsc#1157685)</changelog>
  <changelog author="abriel@suse.com" date="1600689600">- PROMOTED/PROMOTED Fix - The PROMOTED/PROMOTED values happened
  after the main tenance procedure and the refresh of the resource
  did not fixed that
  (bsc#1176330)
- Improved SCORING and logging
  Score of secondary in takeover phase increased from 122 to 145 to
  avoid promotion of former primary masternameserver candidates
  (bsc#1174610)
- Fixed typos and improved descriptions in comments
- Change default timeouts and intervals to match the official
  recommendations</changelog>
  <changelog author="abriel@suse.com" date="1604491200">- change version to 0.164.1
- adapt man page SAPHanaSR-showAttr(8) and the README
  (bsc#1144729)</changelog>
  <changelog author="abriel@suse.com" date="1614859200">- change version to 0.164.2
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop'.
  We will use 95% of this action timeouts to calculate the new
  resource start and stop timeout for the 'WaitforStarted' and
  'WaitforStopped' functions. If the new, calculated timeout value
  is less than '3600', it will be set to '3600', so that we do not
  decrease this timeout by accident
  (bsc#1182545)
- add return codes for saphana_stop and saphana_StopSystem
  (bsc#1182115)
- man page SAPhanaSR-ScaleOut minor mistakes
  (bsc#1144442)</changelog>
  <changelog author="abriel@suse.com" date="1627905600">- change version to 0.180.1
- Multi-target SAP HANA Scale-out replication support.
  Extent the SAP HANA ressource agents from single replication
  automation to multi replication automation, which means
  adding multi-target support (srHook - SAPHanaSrMultiTarget.py)
  /usr/sbin/SAPHanaSR-manageAttr - Add a helper tool to support the
  customer during the update from a single replication automation
  to multi replication automation.
  (jsc#SLE-17452, jsc#SLE-20081)
- The resource start and stop timeout is now configurable by
  increasing the timeout for the action 'start' and/or 'stop' in
  the cluster. We will use 95% of this action timeouts to calculate
  the new resource start and stop timeout for the 'WaitforStarted'
  and 'WaitforStopped' functions. If the new, calculated timeout
  value is less than '3600', it will be set to '3600', so that we
  do not decrease this timeout by accident in currently running
  clusters
  (bsc#1182545)
- improve handling of return codes in saphana_stopSystem and
  saphana_stop function.
  (bsc#1182115)
- If the cluster is down during a SR change event, these events
  need special care. They need to pick-up separately to not get
  lost.
- integrate man pages back to the base package SAPHanaSR-ScaleOut.
  The doc package SAPHanaSR-ScaleOut-doc will still exists, but
  only contain the file 'SAPHanaSR-Setup-Guide.pdf'
- During a SR takeover there may be a small time frame where the
  srHook gets a state change from the API with an empty site name.
  This results in a mis-configuration of the cluster. So log the
  occurrence of an empty site name, but do not generate bad
  formatted cluster attribute name.
  (analog to ScaleUp - bsc#1173581)
- add SAPHanaSR-call-monitor
- handle 'leftover instances'
  if HANA is configured to have only one master name server, but
  no additional master name server candidates, there may be the
  situation, where the master name serve died and so the landscape
  has no active name server anymore.
  But there are other instances running with active communication
  channels. To prevent data corruption or operations on outdated
  data, we identify and stop these 'leftover' instances.
- manual page updates:
  SAPHanaSR-ScaleOut.7 (bsc#1144442)
  SAPHanaSR-showAttr.8 (bsc#1144312)
  and others</changelog>
</package>
<package pkgid="31bb9020fc1b8b49846d1baab200f2c91d7c3c01733aab4d40d9d77630928d9a" name="SUSEConnect" arch="aarch64">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="c14569ff6ccf20cc4349779a18d972ce0126deb8b8eba86d4eb5edc90a596ddb" name="SUSEConnect" arch="ppc64le">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="96b29c0ea068eb2a2bc7916161a722ea2ffcda191fff7ccd5ee5aa3089ed6eb1" name="SUSEConnect" arch="s390x">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="a11017d7d4b55f4de1c2e6e26c621c2486f5849520a3e53ed0bee79ddd5e6dc7" name="SUSEConnect" arch="src">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="62bd331fd9bbf335858309f4d92328cd4f782aa0b88522cd08354fa793e1507d" name="SUSEConnect" arch="x86_64">
  <version epoch="0" ver="0.3.29" rel="10.1"/>
  <changelog author="hschmidt@suse.com" date="1540209600">- Update to 0.3.14
  - Fix s390 activation fails due to unavailable 'dmidecode' bsc#1112702</changelog>
  <changelog author="hschmidt@suse.com" date="1540296000">- Changed "openssl" recommendation to "openssl(cli)"
  on SLE 12 SP3+ and SLE 15+ (bsc#1101470).</changelog>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
</package>
<package pkgid="55a65ad689de3b9405a35e8776897a88944081ea350a5f335093c02d71db1e77" name="SUSEConnect" arch="aarch64">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="fb678f51d9ad62bdad3908f4fbe7911e62a11ebc172f02f17cfce5c7540b02be" name="SUSEConnect" arch="ppc64le">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="e4f21dd3b9437725a0520167d1e5462f0f0b1ba49f3871e1ace14092ce4495e7" name="SUSEConnect" arch="s390x">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="a20a326e04ddbf685cb53f7fc29dc8339fca922eb495d440c4414026f680a07a" name="SUSEConnect" arch="src">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="4326ef2016a4ccfa2216c7652452becd2c8b6ac20508af00396e550e6706780e" name="SUSEConnect" arch="x86_64">
  <version epoch="0" ver="0.3.31" rel="13.1"/>
  <changelog author="fschueller@suse.com" date="1541764800">- Output proper message when SUSEConnect is called without parameters (bsc#959561)
- Default to https URI when no protocol prefix is provided for --url
- Support transactional-update systems (fate#326482)</changelog>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
</package>
<package pkgid="e0ba1f9bf13fd82c5005f405dd7c75fde7cac3d3b7f471b81e044b4abd0e53fc" name="SUSEConnect" arch="aarch64">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="d3085c926ffa66a025c8f1a53182e4c7a3514c4e0e50e28bad2bcdfce05a6abd" name="SUSEConnect" arch="ppc64le">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="82a516eab771035805ab654d6fb11120da5ec38cf7ed7fa54a9c473ed88a2063" name="SUSEConnect" arch="s390x">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="35ea57ad1842131c143c519ca43b6395d221e49f41a1f0bcdcdc88665e92467e" name="SUSEConnect" arch="src">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="33fc1e7cb50388102af3a5ff9f6abe490386b609fa641d935bb86014d76db8d9" name="SUSEConnect" arch="x86_64">
  <version epoch="0" ver="0.3.32" rel="16.1"/>
  <changelog author="fschueller@suse.com" date="1542369600">- Update to 0.3.15
  - Output information about registration and de-registration progress</changelog>
  <changelog author="fschueller@suse.com" date="1544184000">- Update to 0.3.16
  - Show non-enabled extensions with a remark about availability</changelog>
  <changelog author="coolo@suse.com" date="1549368000">- Replace --no-ri --no-rdoc with --no-document - these options
  are obsolete since at least ruby 2.1 - and finally removed in
  ruby 2.6
- Only overwrite --bindir on fedora, it will overwrite --buildroot
  (which needs to be combined on newer fedoras)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1554206400">- Update to 0.3.17
  - Don't try to remove a service during migration if a zypper service
    plugin already exists (bsc#1128969)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1559131200">- Update to 0.3.18
- Fix base product service removal during de-registration in public clouds (bsc#1136752)</changelog>
  <changelog author="giovanni.filippetti@suse.com" date="1565179200">- Update to 0.3.19
  - Fix failing on registered system without arguments (bsc#1144020)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1565265600">- Update to 0.3.20
- Fix getting the list of installed products when zypper plugins are
  present (bsc#1143635)</changelog>
  <changelog author="tschmidt@suse.com" date="1569499200">- Update to 0.3.21
  Fix error on first activation of packagehub extension (bsc#1124318)</changelog>
  <changelog author="tschmidt@suse.com" date="1569844800">- Update to 0.3.22
  switch_server_cert_location_to_etc.patch: add patch to switch server cert path for SLE15.2+ to /etc (bsc#1130864)</changelog>
  <changelog author="tschmidt@suse.com" date="1571054400">- 0.3.23
  fix .spec file to correctly apply switch_server_cert_location_to_etc.patch to SLE15SP2+ (bsc#1130864)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1572955200">- Update to 0.3.24
- Forbid de-registration for on-demand Public Cloud instances (bsc#1155911)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1577966400">- Update to 0.3.25
- Fix cloud_provider detection on AWS large instances (bsc#1160007)</changelog>
  <changelog author="tschmidt@suse.com" date="1593518400">- Don't fail de-activation when '-release' package already got removed</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1598443200">- Update to 0.3.26
  - Extend the YaST API in order to access to the package search
    functionality (jsc#SLE-9109)</changelog>
  <changelog author="tmuntaner@suse.com" date="1598875200">- Update to 0.3.27
- SUSEConnect now ensures that it writes its configuration when it
  encounters errors. This helps in the situation where SUSEConnect
  announces itself, but fails during a later step. Without the saved
  configuration, a system could have credentials, but be unsure which
  registration proxy they're valid for.</changelog>
  <changelog author="tschmidt@suse.com" date="1601294400">- Recognize more formats when parsing .curlrc for proxy credentials (bsc#1155027)
- Add rpmlintrc to filter false-positive warning about patch not applied</changelog>
  <changelog author="tamara.schmitz@suse.com" date="1605614400">- Update to 0.3.29
- replace env ruby path with native ruby path during build phase</changelog>
  <changelog author="tschmidt@suse.com" date="1624190400">- Update to 0.3.30
- send payload of GET requests as part of the url,
  not in the body (see bsc#1185611)</changelog>
  <changelog author="ngetahun@suse.com" date="1626868800">- Update to 0.3.31
- Disallow registering via SUSEConnect if the system is managed by SUSE Manager.
- Add subscription name to output of 'SUSEConnect --status'</changelog>
  <changelog author="tschmidt@suse.com" date="1635336000">- Update to 0.3.32
- Allow --regcode and --instance-data attributes at the same time (jsc#PCT-164)
- Document that 'debug' can also get set in the config file
- --status will also print the subscription name</changelog>
</package>
<package pkgid="c0197bd1741d031748781c961a5c99d61a3d9eeab582794c07b3ab653213d43e" name="ServiceReport" arch="noarch">
  <version epoch="0" ver="2.2.3+git1.55a13db1c256" rel="3.3.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
</package>
<package pkgid="32511b30ab802173c68c975a9888aec9f753eef8bb4caab94a93d37fd94e1de9" name="ServiceReport" arch="src">
  <version epoch="0" ver="2.2.3+git1.55a13db1c256" rel="3.3.1"/>
  <changelog author="sourabhjain@linux.ibm.com" date="1573819200">Version 2.2.1
- First Open source release
- Initial Commit of Open Source release</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589457600">Update to version 2.2.2
- Update crashkernel memory reservation limit
- Remove rpm postscript
- Add servicereport.spec file
- Move systemd service file to a generic location
- Run service only once at boot time without repair action
- fix initrd repair function
- [fadump] No boolean return from check_* function
- [fadump] indent the code with spaces instead of tabs
- Fix the option_string for --plugin option
- [fadump] update the logic to extract the FADump mem reservation
- Add irqbalance daemon check
- Add irqbalance package check
- Fix the system platform string extraction from /proc/cpuinfo
- Fix powerpc-ibm-utils package name
- Fix typo in README.md</changelog>
  <changelog author="sourabhjain@linux.ibm.com" date="1589716800">- Move setup.cfg metadata to setup.py file</changelog>
  <changelog author="msuchanek@suse.com" date="1599048000">- Run throuhg spec-cleaner and split off changelog.
- Fix license and dependencies
- Re-download the source</changelog>
  <changelog author="msuchanek@suse.de" date="1604404800">- Update to upstream git (jsc#SLE-13288).
  + 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  + 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  + 0003-HTX-Mark-HTX-plugin-as-optional.patch
  + 0004-Add-new-option-to-run-all-applicable-plugins.patch
  + 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  + 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  + 0007-Update-data-files-of-the-project.patch
  + 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1612353600">- Update to version 2.2.2+git10.1caca0630e36 (bsc#1181729 ltc#191203):
  * Update SLES crashkernel recommendation values
  * update HTX service name
- Remove the already included patches
  - 0001-Add-active-dump-check-in-kdump-and-FADump-plugin.patch
  - 0002-Introduce-a-new-option-to-mark-plugins-optional.patch
  - 0003-HTX-Mark-HTX-plugin-as-optional.patch
  - 0004-Add-new-option-to-run-all-applicable-plugins.patch
  - 0005-Allow-distro-classes-to-redefine-the-capture-kernel-.patch
  - 0006-utils-remove-the-invalid-function-call-to-walk_packa.patch
  - 0007-Update-data-files-of-the-project.patch
  - 0008-Run-servicereport-using-python3-binary.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1626350400">- Update to version 2.2.3 (jsc#SLE-18193):
  * ServiceReport v2.2.3 release
  * [Daemon] check active status along with enabled
  * Run-on supported architectures only
  * Take crashkernel recommendation from kdump-lib.sh scripts</changelog>
  <changelog author="jsegitz@suse.com" date="1627387200">- Added hardening to systemd service(s). Added harden_servicereport.service.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1632484800">- Update to version 2.2.3+git1.55a13db1c256:
  * [fadump] Update crashkernel recommendation (tid#7023277).</changelog>
</package>
<package pkgid="6ac7bf42b68c64cb01b22c1357376fb57357e29225fcd4fff44aa452286662c4" name="amazon-ecs-init" arch="aarch64">
  <version epoch="0" ver="1.52.1" rel="4.8.1"/>
  <changelog author="rjschwei@suse.com" date="1442923200">- Update to version 1.4.0.2 (1.4.0-2 upstream)
  + Enhancement - Add support for Docker 1.7.1
  + Enhancement: Cache Agent version 1.4.0
  + Feature: Read Docker endpoint from environment variable
    DOCKER_HOST if present</changelog>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
</package>
<package pkgid="3d05ccb7f44d4fd62a13686c7b3dd495da1ac360cd7adbe55138505dd822c7f6" name="amazon-ecs-init" arch="src">
  <version epoch="0" ver="1.52.1" rel="4.8.1"/>
  <changelog author="rjschwei@suse.com" date="1442923200">- Update to version 1.4.0.2 (1.4.0-2 upstream)
  + Enhancement - Add support for Docker 1.7.1
  + Enhancement: Cache Agent version 1.4.0
  + Feature: Read Docker endpoint from environment variable
    DOCKER_HOST if present</changelog>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
</package>
<package pkgid="2a4a9511eb7dc17fdfc1b4ed30a13a98ead8a925ce61436836679e1ebae83103" name="amazon-ecs-init" arch="x86_64">
  <version epoch="0" ver="1.52.1" rel="4.8.1"/>
  <changelog author="rjschwei@suse.com" date="1442923200">- Update to version 1.4.0.2 (1.4.0-2 upstream)
  + Enhancement - Add support for Docker 1.7.1
  + Enhancement: Cache Agent version 1.4.0
  + Feature: Read Docker endpoint from environment variable
    DOCKER_HOST if present</changelog>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
</package>
<package pkgid="21d4ce0509b05df2955022e52e764409b95d4d154b044f10225e69268c31b336" name="amazon-ecs-init" arch="aarch64">
  <version epoch="0" ver="1.53.0" rel="4.11.1"/>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624449600">- Update to version 1.53.0-1 (bsc#1187661, bsc#1187662)
  * Cache Agent version 1.53.0
- from version 1.52.2-2
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: fix incorrect download url when running in cn region
- from version 1.52.2-1
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: remove dependency on gpg key server
  * ecs-anywhere-install: allow sandboxed apt installations</changelog>
</package>
<package pkgid="555b81e1c2395b23694f2e14473b80da249fbf0b849e055163b8a75b10c319f1" name="amazon-ecs-init" arch="src">
  <version epoch="0" ver="1.53.0" rel="4.11.1"/>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624449600">- Update to version 1.53.0-1 (bsc#1187661, bsc#1187662)
  * Cache Agent version 1.53.0
- from version 1.52.2-2
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: fix incorrect download url when running in cn region
- from version 1.52.2-1
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: remove dependency on gpg key server
  * ecs-anywhere-install: allow sandboxed apt installations</changelog>
</package>
<package pkgid="b6a59a994e9dee2d499d7c6e6586b40c2d8d5265c188a53631ffa5747ee653bf" name="amazon-ecs-init" arch="x86_64">
  <version epoch="0" ver="1.53.0" rel="4.11.1"/>
  <changelog author="rjschwei@suse.com" date="1443096000">- Rename the service file, request from upstream
- Spec file improvements to better match the requirements of the code</changelog>
  <changelog author="rjschwei@suse.com" date="1443096001">- Drop the extra version number
  + Going forward we do not care about picking up -x tarball releases
    the do not contain source changes</changelog>
  <changelog author="rjschwei@suse.com" date="1443355200">- Add patch cgroup_location.patch
  + Modify location where the agent looks for cgroup information</changelog>
  <changelog author="rjschwei@suse.com" date="1443441600">- Update long description</changelog>
  <changelog author="rjschwei@suse.com" date="1444305600">- Update to version 1.5.0 (bsc#949602)
  + Enhancement - Cache Agent version 1.5.0
  + Enhancement - Improved merge strategy for user-supplied environment
  + Enhancement - Add default supported logging drivers
- Add build switch for SUSE, modify cgroup_location.patch</changelog>
  <changelog author="rjschwei@suse.com" date="1453896000">- Update to version 1.7.1 (bsc#963837)
  + remove cgroup_location.patch, system path is integrated in build
    configuration
  + Cache Agent version 1.7.1
- From 1.7.0
  + Cache Agent version 1.7.0
  + Add support for Docker 1.9.1
- From 1.6.0
  + Cache Agent version 1.6.0
  + Updated source dependencies</changelog>
  <changelog author="rjschwei@suse.com" date="1478174400">- Update to version 1.13.0 (bsc#1008298)
  + Cache agent version 1.13.0
- From 1.12.2
  + Cache Agent version 1.12.2
- From 1.12.1
  + Cache Agent version 1.12.1
- From 1.12.0
  + Enable Task IAM Role for containers launched with 'host' network mode
  + Cache Agent version 1.12.0
- From 1.11.1
  + Cache Agent version 1.11.1
- From 1.11.0
  + Enhancement - Support Task IAM Roles feature of Agent
  + Enhancement - Start Agent with host network mode
  + Enhancement - Cache Agent version 1.11.0
  + Enhancement - Add support for Docker 1.11.2
- From 1.10.0
  + Enhancement - Cache Agent version 1.10.0
  + Enhancement - Add support for Docker 1.11.1
- From 1.9.0
  + Enhancement - Cache Agent version 1.9.0
  - From 1.8.2
  + Enhancement - Cache Agent version 1.8.2
- From 1.8.1
  + Enhancement - Cache Agent version 1.8.1</changelog>
  <changelog author="rjschwei@suse.com" date="1478174401">- Service needs to run after we know the network is fully configured
  thus use network-online.target instead of network.target</changelog>
  <changelog author="rjschwei@suse.com" date="1526990400">- Update to version 1.17.3
  + No upstream changelog</changelog>
  <changelog author="rjschwei@suse.com" date="1527249600">- Modify dependencies to work around module dependency issues in SLE</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1531828800">- Update to version 1.18.0
  + Cache Agent version 1.18.0
  + Add support for regional buckets
  + Bundle ECS Agent tarball in package
  + Download agent based on the partition
  + Mount Docker plugin files dir</changelog>
  <changelog author="bwiedemann@suse.com" date="1535630400">- Add reproducible.patch to use constant build path (boo#1062303)</changelog>
  <changelog author="rjschwei@suse.com" date="1554292800">- Enable aarch64 build (bsc#1131459)</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="rjschwei@suse.com" date="1613476800">- Update to version 1.50.1 (bsc#1182343, bsc#1182344)
  + Cache Agent version 1.50.1
  + Does not restart ECS Agent when it exits with exit code 5
- For detailed changes between the previous version and this version see
  the included Changelog.md file</changelog>
  <changelog author="rjschwei@suse.com" date="1614340800">- Only build for x86_64 and aarch64</changelog>
  <changelog author="rjschwei@suse.com" date="1615809600">- Add info about bundled dependencies in spec
- Fix required go version
- Handle go 1.16 or later by switching GO111MODULE to previous default</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 1.52.1 (bsc#1186239, bsc#1186262)
  + Cache Agent version 1.52.1
  + Add support for ECS EXTERNAL launch type (ECS Anywhere)</changelog>
  <changelog author="rjschwei@suse.com" date="1622030400">- Add use-agent-container-built-in-certs.patch to use the built in certs from
  the downloaded agent container
- Update amazon-ecs.service to consider the proper environment files
- Set the cache state to ensure the latest agent container gets pulled</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1624449600">- Update to version 1.53.0-1 (bsc#1187661, bsc#1187662)
  * Cache Agent version 1.53.0
- from version 1.52.2-2
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: fix incorrect download url when running in cn region
- from version 1.52.2-1
  * Cache Agent version 1.52.2
  * ecs-anywhere-install: remove dependency on gpg key server
  * ecs-anywhere-install: allow sandboxed apt installations</changelog>
</package>
<package pkgid="2dd8bc9a1b2a884c1650d01340ff4c9ac660537f304b49011ee833724d11d6a0" name="amazon-ssm-agent" arch="aarch64">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="8cbb45b83a80a3b12dd82d37bf5bde501076c43442796ccaf2babf7c38771687" name="amazon-ssm-agent" arch="ppc64le">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="32eba959605faee26539e203fb3150b06797a2165437757f625cf95c0253b22f" name="amazon-ssm-agent" arch="s390x">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="f546e8d65981c20759eefe6c87e33f43bae22e07fabb1b1a877f57717830eabe" name="amazon-ssm-agent" arch="src">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="15c24d9b5f8f5c2c554b648ecdee78393d267c14bc327e8096cdb0bfc42aa1a7" name="amazon-ssm-agent" arch="x86_64">
  <version epoch="0" ver="3.0.1209.0" rel="5.6.1"/>
  <changelog author="sean.marlow@suse.com" date="1481889600">- Initial package 1.2.290.0 2016-07-20</changelog>
  <changelog author="sean.marlow@suse.com" date="1484827200">- Update to 2.0.663.0 2017-01-18
  - Added support for aws:softwareInventory plugin to upload
    inventory related log messages to S3
  - Added support for running Powershell on Linux
  - Added support for State Manager that automates the process of
    keeping your Amazon EC2 and hybrid infrastructure in a state that
    you define You can use State Manager to ensure that your instances
    are bootstrapped with specific software at startup, configured
    according to your security policy, joined to a Windows domain,
    or patched with specific software updates throughout their
    lifecycle
  - Added support for Systems Manager Inventory that allows you to
    specify the type of metadata to collect, the instances from
    where the metadata should be collected, and a schedule for
    metadata collection
  - Added support for installing, uninstalling, and updating AWS
    packages published by AWS
  - Added support for installing Docker on Windows and running
    Docker actions
  - Added support for Windows Server 2016
  - Added support for Windows Server Nano
  - Fixed CloudWatch crash issue
  - Fixed Domain Join to support customized OU
  - Fixed CloudWatch doesn't work with creating association from
    Console
  - Fixed SSM Agent not able to start on Windows Server 2003
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1487332800">- Update to 2.0.672.0 2017-02-17
  - Added bucket-owner-full-control ACL to S3 outputs to support
    cross-account upload
  - Standardized S3 result paths across plugins; commands append
    command-id/instance-id/plugin-name/step-id associations append
    instance-id/association-id/execution-date/plugin-name/step-id
  - step-id is the id field in plugin input if present and
    supported, otherwise the step name (in 2.0 schema documents),
    otherwise the plugin-name again
  - plugin-name and step-id have : characters removed
  - FreeBSD patches from external contributor
  - Various bug fixes</changelog>
  <changelog author="lchiquitto@suse.de" date="1488369600">- Add package to SLE-12 codestream (bsc#1017899, fate#322303)</changelog>
  <changelog author="sean.marlow@suse.com" date="1496232000">- Update to 2.0.790.0 2017-05-31 (bsc#1047581)
  - Added support for step-level preconditions
  - Added support for rate/interval based schedule expressions for
    associations
  - Added Summary and PackageID fields to inventory's
    aws:application gatherer
  - Changed inventory's aws:application gatherer to use
    win32_processor: addressWidth to detect OS architecture to
    avoid localization based errors
  - Fixed CloudWatch issue with large configuration
  - Fixed S3 upload when instance and bucket are not in the same
    region
  - Fixed bug that prevented native language AMIs (Japanese AMI)
    from launching Cloudwatch
  - Various bug fixes
- Update to 2.0.767.0 2017-05-31
  - Returning longer StandardOutput and StandardError from
    RunShellScript and RunPowerShellScript which show up in the
    results of GetCommandInvocation and the detailed output of
    ListCommandInvocation
  - Added Document v2.0 support for Run Command, which includes
    support for multiple actions of same plugin type
  - Various bug fixes
- Update to 2.0.755.0 2017-05-31
  - Fixed bugs that prevented CloudWatch from launching and allowed
    multiple instances of CloudWatch to launch on Windows
  - Various bug fixes
- Update to 2.0.730.0 2017-05-31
  - Fixed issues with agent starting before network is ready on
    systemd systems.
- Update to 2.0.716.0 2017-05-31
  - Pass proxy settings to domain join and CloudWatch
  - Added support for installing Docker on Linux
  - Removed the upper limit for the maximum number of parallel
    executing documents on the agent (previously the max was 10)
  - You can configure this number by setting the
    ?CommandWorkerLimit? attribute in amazon-ssm-agent.json file
  - Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1503662400">- Add ssm-cli to package.
- Remove requirement on lsb-release. Agent now parses os-release
  by default.
- Use gzip archive from GitHub instead of converting to xz.
- Update to 2.0.922.0 2017-08-14 (bsc#1055766)
  + Added Raspbian support for armv6 to support Raspberry Pi
  + Various bug fixes
- Update to 2.0.913.0 2017-08-07
  + Updated golang/sys dependency to the latest
  + Increased run command document maximum execution timeout to 48 hours
  + Various bug fixes
- Update to 2.0.902.0 2017-07-31
  + Added support for uploading agent logs to CloudWatch for SSM Agent diagnostics
  + Added additional gatherers for inventory
  + Added configuration compliance support for association
  + Various bug fixes
- Update to 2.0.879.0 2017-07-26
  + Add capability to configure custom s3 endpoint for the agent
  + Various bug fixes
- Update to 2.0.847.0 2017-07-03
  + Various bug fixes
- Update to 2.0.842.0 2017-06-26
  + Added rollback support in aws:configurePackage
  + Various bug fixes
- Update to 2.0.834.0 2017-06-23
  + Various bug fixes
- Update to 2.0.805.0 2017-06-07
  + Added support for SLES (SUSE) (64-bit, v12 and above)
  + Various bug fixes
- Update to 2.0.796.0 2017-05-29
  + Linux platform version now based on os-release when available
  + Various bug fixes</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142400">- Update to 2.2.45.0 2017-10-18 (bsc#1067256)
  + Refresh version patch with new version.
  + Adding versioning support for Parameter Store.
  + Added additional gatherers for inventory, including windows
    service gatherer, windows registry gatherer, file metadata
    gatherer, windows role gatherer.
  + Added support for aws:downloadContent plugin to download
    content from GitHub, S3 and documents from SSM documents.
  + Added support for aws:runDocument plugin to execute SSM
    documents.
- Update to 2.2.30.0 2017-10-09
  + Improved speed of initial association application on boot
  + Various aws:configurePackage service integration changes
  + Improved home directory detection in non-x64 linux platforms
    to address cases where shared AWS SDK credentials were not
    available in on-prem instances
- Update to 2.2.24.0 2017-10-02
  + Added exponential backoff in bucket region check for s3 upload
  + Fixed an issue with orchestration directory cleanup for
    RunCommand
- Update to 2.2.16.0 2017-09-25
- Update to 2.1.4.0 2017-09-11
  + Support for command execution out-of-process
- Update to 2.0.952.0 2017-08-28</changelog>
  <changelog author="sean.marlow@suse.com" date="1510142401">- Add ssm-document-worker binary to agent package.</changelog>
  <changelog author="sean.marlow@suse.com" date="1511784000">- Update Go version requirement to 1.7.4.</changelog>
  <changelog author="ro@suse.de" date="1517486400">- do not build on s390, only on s390x (no go on s390)</changelog>
  <changelog author="sean.marlow@suse.com" date="1521028800">- Update to 2.2.325.0 2018-03-07 (bsc#1085670)
  + Bug fix to change sourceHashType to be default sha256 on
    psmodule.
- Update to 2.2.257.0 2018-02-23
  + Bug fix to address an issue that can prevent the agent from
    processing associations after a restart.
- Update to 2.2.160.0 2018-01-15
  + Execute "pwsh" on linux when using runPowershellScript plugin.
- Update to 2.2.93.0 2017-11-14
  + Update to latest AWS SDK.
- Update to 2.2.58.0 2017-10-23
  + Switching to use Birdwatcher distribution service for AWS
    packages.</changelog>
  <changelog author="sean.marlow@suse.com" date="1551873600">- Update version patch.
- Update to 2.3.415.0 (2019-03-05)
  + Bug fix addressing issues in Distributor package upgrade
- Update to 2.3.372.0 (2019-03-05)
  + Bug fix to allow installation of Distributor packages that do
    not have a version name.
  + Bug fix for agent crash with message "WaitGroup is reused
    before previous Wait has returned".
- Update to 2.3.344.0 (2019-03-05)
  + Add frequent collector to detect changed inventory types and
    upload it to SSM service between two scheduled collections.
  + Change AWS Systems Manager Distributor to reduce calls to
    GetDocument by calling DescribeDocument.
  + Add exit code when ssm-cli execution fails.
  + Create ssm-user only after the control channel has been
    successfully created.
- Update to 2.3.274.0 (2019-03-05)
  + Enabled AWS Systems Manager Distributor that lets you securely
    distribute and install software packages.
  + Add support for the arm64 architecture on Amazon Linux 2,
    Ubuntu 16.04/18.04, and RHEL 7.6 to support EC2 A1 instances.
- Update to 2.3.235.0 (2019-03-05)
  + Bug fix for session manager logging on Windows
  + Bug fix for ConfigureCloudWatch plugin
  + Bug fix for update SSM agent occasionally failing due to SSM
    agent service stuck in starting state
- Update to 2.3.193.0 (2019-03-05)
  + Bug fix for past sessions occasionally stuck in terminating
    state
  + Darwin masquerades as Linux to bypass OS validation on the
    backend until official support can be added
- Update to 2.3.169.0 (2019-03-05)
  + Update managed instance role token more frequently
- Update to 2.3.136.0 (2019-03-05)
  + Bug fix for issue that GatherInventory throw out error when
    there is no Windows Update in instance
  + Add more filters when getting the Windows event logs at
    startup to improve performance
  + Add random jitter before call PutInventory in inventory
    datauploader
- Update to 2.3.117.0 (2019-03-05)
  + Bug fix for issues during process termination on instances
    where IAM policy does not grant ssmmessages permissions.
- Update to 2.3.101.0 (2019-03-05)
  + Bug fix to prevent defunct processes when creating the local
    user ssm-user.
  + Bug fix for sudoersFile permission to avoid "sudo" command
    warnings in Session Manager.
  + Disable hibernation on Windows platform if Cloudwatch
    configuration is present.
- Update to 2.3.68.0 (2019-03-05)
  + Enables the Session Manager capability that lets you manage
    your Amazon EC2 instance through an interactive one-click
    browser-based shell or through the AWS CLI.
  + Beginning this agent version, SSM Agent will create a local
    user "ssm-user" and either add it to /etc/sudoers (Linux) or
    to the Administrators group (Windows) every time the agent
    starts. The ssm-user is the default OS user when a Session
    Manager session is started, and the password for this user is
    reset on every session. You can change the permissions by
    moving the ssm-user to a less-privileged group or by changing
    the sudoers file. The ssm-user is not removed from the system
    when SSM Agent is uninstalled.
- Update to 2.3.13.0 (2019-03-05)
  + Bug fix for the SSM Agent service remaining in "Starting"
    state on Windows when unable to authenticate to the Systems
    Manager service.
- Update to 2.2.916.0 (2019-03-05)
  + Bug fix for missing cloudwatch.exe seen in SSM Agent version
    2.2.902.0
- Update to 2.2.902.0 (2019-03-05)
  + Initial support for developer builds on macOS
  + Retry sending Run Command execution results for up to 2 hours
  + More detailed error messages are returned for inventory plugin
    failures during State Manager association executions
- Update to 2.2.800.0 (2019-03-05)
  + Bug fix to clean the orchestration directory
  + Streaming AWS Systems Manager Run Command output to CloudWatch
    Logs
  + Reducing number of retries for serial port opening
  + Add retry logic to installation verification
- Update to 2.2.619.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.607.0 (2019-03-05)
  + Various bug fixes
- Update to 2.2.546.0 (2019-03-05)
  + Bug fix to retry sending document results if they couldn't
    reach the service
- Update to 2.2.493.0 (2019-03-05)
  + Added support for Ubuntu Snap packaging
  + Bug fix so that aws:downloadContent does not change permissions
    of directories
  + Bug fix to Cloudwatch plugin where StartType has duplicated
    Enabled value
- Update to 2.2.392.0 (2019-03-05)
  + Added support for agent hibernation so that Agent backs off or
    enters hibernation mode if it does not have access to the
    service
  + Various bug fixes
- Update to 2.2.355.0 (2019-03-05)
  + Fix S3Download to download from cross regions.
  + Various bug fixes</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588248000">- Update to 2.3.978.0 (2020-04-08) (bsc#1170744)
  + Stop pty on receiving TerminateSession request
  + Add support for Debian arm64 architecture
  + Refactoring session log generation logic
- Update to 2.3.930.0  (2020-03-17)
  + Bug fix for CloudWatch agent version showing twice in Inventory console
  + Bug fix for retrieving minor version for CentOS7
  + Add snap appData collection for inventory in ubuntu 18
  + Add validation for contents of os release files
  + Add retry for fingerprint generation
- Update to 2.3.871.0 (2020-02-20)
  + Various bug fix for SSM Agent
- Update to 2.3.842.0 (2020-01-29)
  + Bug fix for updating document state file prior agent reboot
  + Add support to restart agent after SIGPIPE exit status
- Update to 2.3.814.0 (2020-01-16)
  + Bug fix for metadata service V2
  + Update Golang version 1.12 for travis
  + Optimize session manager retry logic
- Update to 2.3.786.0 (2019-12-19)
  + Add support for Oracle Linux v7.5 and v7.7
  + Bug fix for Inventory data provider to support special characters
  + Bug fix for SSM MDS service name
- Update to 2.3.772.0 (2019-12-13)
  + Upgrade AWS SDK
  + Add logging for fingerprint generation
- Update to 2.3.760.0 (2019-11-15)
  + Session manager supports handling of Task metadata
- Update to 2.3.758.0 (2019-11-11)
  + Add support to update SSM Distributor packages in place
- Update to 2.3.756.0 (2019-11-05)
  + Terminate port forwarding session on receiving TerminateSession flag
  + Bug fix to reload SSM client if region has not been initialize correctly
  + Bug fix for retrieval of user groups on Linux
- Update to 2.3.722.0 (2019-10-11)
  + Bug fix for the delay when registering non-EC2 on-prem instances
  + Bug fix for missing ACL when uploading logs to S3 buckets
  + Upgrade GoLang version from 1.9 to 1.12
- Update to 2.3.714.0 (2019-09-26)
  + For port forwarding session, close server connection when client drops it's connection
  + Bug fix for missing condition of rules from inventory registry
  + Update service domain information fetch logic from EC2 Metadata
- Update to 2.3.707.0 (2019-09-11)
  + Bug fix for characters dropping from session manager shell output
  + Bug fix for session manager freezing caused by non utf8 character
  + Switch the request protocol order for getting S3 Header
  + Keep port forwarding session open until session is terminated
- Update to 2.3.701.0 (2019-08-21)
  + Send platform type information in controlChannel input
- Update to 2.3.687.0 (2019-08-05)
  + Bug fix for runPowershellScript plugin on linux platform
  + Add support for document 2.x version to ssm-cli
- Update to 2.3.680.0 (2019-07-24)
  + Added a new Inventory gatherer AWS:BillingInfo which will gather the billing product ids for LicenseIncluded and Marketplace instance
- Update to 2.3.672.0 (2019-07-09)
  + Add Port plugin for SSH/SCP
  + Add support for Session Manager RunAs functionality on Linux platform
- Update to 2.3.668.0 (2019-07-01)
  + Add Session Manager InteractiveCommands plugin
  + Bug fix for log formatting issue for session manager
- Update to 2.3.662.0 (2019-06-19)
  + Bug fix for Session Manager when handling line endings on Windows platform
  + Bug fix for token validation for aws:downloadContent plugin
  + Check if log group exists before uploading Session Manager logs to CloudWatch
  + Bug fix for broken S3 urls when using custom documents
- Update to 2.3.634.0 (2019-05-28)
  + Disable appconfig to load credential from specific profile path, add EC2 credentials as the default fallback
  + Remove sudoers file creation logic if ssm-user already exists
  + Enable supplementary groups for ssm-user on Linux
- Update to 2.3.612.0 (2019-05-08)
  + Bug fix for UTF-8 encoded issue caused by locale activation on Ubuntu 16.04 instance
  + Refactor ssm-user creation logic
  + Bug fix for reporting IP address with wrong network interface
  + Update configure package document arn pattern
- Update to 2.3.542.0 (2019-04-18)
  + Bug fix for on-premises instance registration in CN region
- Update to 2.3.539.0 (2019-04-04)
  + Add support for further encryption of session data using AWS KMS
  + Bug fix for excessive instance-id fetching by document workers
- Update to 2.3.479.0 (2019-03-06)
  + Bug fix for downloading content failure caused by wrong S3 endpoint
  + Bug fix for reboot failure caused by session manager panic
  + Bug fix for session manager shell output dropping character
  + Bug fix for mgs endpoint configuration consistency
- Update to 2.3.444.0 (2019-02-10)
  + Updates to UpdateInstanceInformation call, Windows initialization
- Add patch to remove unused import
  + remove-unused-import.patch
- Refresh patches for new version
  + fix-version.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1590580800">- Update to 2.3.1205.0:
  * Updated the SSM Agent Snap to core18
  * Bug fix for expired in-progress documents being resumed
  * Bug fix for update specific files not being deleted after agent update is finished
  * Bug fix for cached manifest files not being deleted in the configurepackage plugin</changelog>
  <changelog author="rjschwei@suse.com" date="1621425600">- Update to version 3.0.1209.0 (bsc#1186239, bsc#1186262)
  + For detailed changes see RELEASENOTES.md
  + Drop fix-version.patch replaced by sed expression in spec file
  + Drop remove-unused-import.patch no longer included from upstream
  + Drop fix-config.patch all SUSE distros use systemd
  + Remove amazon-ssm-agent.service included in upstream source, use it
  + Move all binaries into sbin and fix the hard coded config path via sed</changelog>
</package>
<package pkgid="9e9a30914a0daa97081c30176ec7fac45539121ed441074ec4418ec899a6a035" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.3.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="80430cd3b3ccb7a43b1af555816b47c4c02550b84d4f39d235d7da636833a84b" name="ansible" arch="src">
  <version epoch="0" ver="2.9.21" rel="1.3.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="f655b2d0b4c01abdee85e987979b3fff66ce338b40a4b5e0085eeec664d18ea2" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.5.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="3b87913c32544f3ec23bc6b8bc3faefd881e5b7132fdc27d0e79f2d8eaa3cbf4" name="ansible" arch="src">
  <version epoch="0" ver="2.9.21" rel="1.5.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="832bc23d68a64bd1523f1f8397208b950e283299471f9abb8161d81f48379ab2" name="ansible" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.7.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="e33403909535f61e00fb4f221a01d42138a67e2a9120d8c5ef1393b4bd0421c2" name="ansible" arch="src">
  <version epoch="0" ver="2.9.21" rel="1.7.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="d35161ca5800c5bb785bde871bf27a21b13303f9cf55926717f8ed72b6088e27" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.3.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="c847c431f8deb8f1372132f973adbe8842c357b8b5e8c24f32c3c20841fd8729" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.5.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="1d5be04fe2800ea1c5961070392168b34bc4a5d96a66b8142c66335a8083a777" name="ansible-doc" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.7.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="110b6a369644482653406e5d67cd98fcdb504e3fcd1150e2432372d6d596686e" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.3.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="43974d4be84070e320a2518dd3dcbfafc77903f92e0f5877d5a216fca6b80a6b" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.5.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="2a6aa4d0cd6c92e7fdec9ed59f517f6856025e182fb0dbb572e7e710415aaaef" name="ansible-test" arch="noarch">
  <version epoch="0" ver="2.9.21" rel="1.7.1"/>
  <changelog author="michael@stroeder.com" date="1589284800">- update to version 2.9.8
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="michael@stroeder.com" date="1589284801">- update to version 2.9.9
  * fix for a regression introduced in 2.9.8</changelog>
  <changelog author="mcepl@suse.com" date="1590494400">- Add CVE-2020-1733_avoid_mkdir_p.patch to fix CVE-2020-1733
  (bsc#1164140)
- Add metadata information to this file to mark which SUSE
  bugzilla have been already fixed.</changelog>
  <changelog author="mcepl@suse.com" date="1590667200">- Correct ID of CVE and rename the patch to
  CVE-2020-1744_avoid_mkdir_p.patch</changelog>
  <changelog author="michael@stroeder.com" date="1592827200">- update to version 2.9.10 with many bug fixes.
- removed CVE-2020-1744_avoid_mkdir_p.patch obsoleted by upstream update</changelog>
  <changelog author="egdfree@opensuse.org" date="1594641600">- added ansible_bugfix_640.diff to fix gh#ansible-collections/community.general#640</changelog>
  <changelog author="michael@stroeder.com" date="1595332800">- update to version 2.9.11 with many bug fixes
- removed ansible_bugfix_640.diff obsoleted by upstream update</changelog>
  <changelog author="michael@stroeder.com" date="1597147200">- update to version 2.9.12 with many bug fixes,
  most notably the following security fixes:
  * security issue - copy - Redact the value of the no_log 'content'
    parameter in the result's invocation.module_args in check mode.
    Previously when used with check mode and with '-vvv', the module would
    not censor the content if a change would be made to the destination path.
    (CVE-2020-14332)
  * security issue atomic_move - change default permissions when creating
    temporary files so they are not world readable
    (https://github.com/ansible/ansible/issues/67794) (CVE-2020-1736)
  * Fix warning for default permission change when no mode is specified.
    Follow up to https://github.com/ansible/ansible/issues/67794.
    (CVE-2020-1736)
  * Sanitize no_log values from any response keys that might be returned
    from the uri module (CVE-2020-14330).
  * reset logging level to INFO due to CVE-2019-14846.</changelog>
  <changelog author="michael@stroeder.com" date="1597233600">- added fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1598961600">- update to version 2.9.13 with many bug fixes, most notably:
  * A security issue was addressed in the "dnf" module, which previously
    did not check GPG signatures of packages.
  * A bug in the "cron" module was fixed. In some cases prior to this
    fix, the module would inadvertently remove cron entries.
- removed obsolete fix-cron-regression-71207.patch</changelog>
  <changelog author="michael@stroeder.com" date="1601985600">- update to version 2.9.14 with many small improvements and bug fixes,
  most notably:
  * kubectl - connection plugin now redact kubectl_token and
    kubectl_password in console log (CVE-2020-1753).
- avoid trailing comments after %endif</changelog>
  <changelog author="michael@stroeder.com" date="1604404800">- update to version 2.9.15 with following breaking change:
  * ansible-galaxy login command has been removed</changelog>
  <changelog author="michael@stroeder.com" date="1608033600">- update to version 2.9.16 with minor changes and many bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1611057600">- update to version 2.9.17 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1613736000">- update to version 2.9.18
  * CVE-2021-20228 where default and fallback values for no_log parameters
    to modules were not previously masked.
  * CVE-2021-20178 where several parameters to the snmp_facts module were
    logged and displayed despite containing sensitive information.
  * CVE-2021-20180 where several parameters to the
    bitbucket_pipeline_variable were logged and displayed despite
    containing sensitive information.
  * CVE-2021-20191 which addresses a number of modules whose parameters
    were logged and displayed despite containing sensitive
    information. For the full list of affected modules, refer to the
    changelog linked below.</changelog>
  <changelog author="michael@stroeder.com" date="1615896000">- update to version 2.9.19 with minor changes and a few bug fixes</changelog>
  <changelog author="michael@stroeder.com" date="1618315200">- update to version 2.9.20
  maintenance release containing numerous bugfixes</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574400">- Switch to python3-cryptography in openSUSE/SLE</changelog>
  <changelog author="alexander.graul@suse.com" date="1618574401">- Drop python-coverage run-time requirement from openSUSE/SLE</changelog>
  <changelog author="michael@stroeder.com" date="1620129600">- update to 2.9.21</changelog>
</package>
<package pkgid="1183d6108d41d25f3d9cae5321d93646e8d492fdef842adbe54a5272cd7ecfab" name="anthy" arch="aarch64">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="f41e9701800e1e0dce84d98fa23c85e67d5e1ec1b33057ac1d70643923750078" name="anthy" arch="ppc64le">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="814169dfa5aa35117e1a7b3d6c989523a98fee3d9f7fa28c12c76a0046e01a0e" name="anthy" arch="s390x">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="fad19b790a25944f4af9d2e89407871c40da56a95d00f824c6b60f9e405d9c24" name="anthy" arch="src">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="coolo@suse.com" date="1317384000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="meissner@suse.de" date="1323604800">- does not need openldap2 direct dependency, libraries are enough</changelog>
  <changelog author="i@marguerite.su" date="1338724800">- fix sles builds.</changelog>
  <changelog author="coolo@suse.com" date="1359979200">- update license to new format</changelog>
  <changelog author="tiwai@suse.de" date="1373630400">- work around the build error with xemacs 21.5.33</changelog>
  <changelog author="tiwai@suse.de" date="1383739200">- Fix breakage on GNU Emacs on openSUSE 13.1 (bnc#849211)
- Added patch: anthy-use-last-command-event.diff</changelog>
  <changelog author="jengelh@inai.de" date="1401451200">- Drop unused build-time requirements on libpng, libgif, libtiff,
  krb5, openldap2</changelog>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="2917d3dba501b555384a0e594f42deb852e0ea3d7b1bd4a33f4428a97d7bb1c6" name="anthy" arch="x86_64">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="9b0db9a67bf951d3525e4d731dd381d5921be91864d122d3b39c5b1a2069a6ab" name="anthy-devel" arch="aarch64">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="45a82ca69c55233fbe96347a94b158b96f9a9921c5d8fb859574b8ab54bab7e5" name="anthy-devel" arch="ppc64le">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="2bac17082870ec8d87b2859bc55d1807dc86caacfeca904b3921066992481221" name="anthy-devel" arch="s390x">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="6c92671e476261f45054307dfa48a7a913a1aaa46bf585b5ba11191160f986f4" name="anthy-devel" arch="x86_64">
  <version epoch="0" ver="9100h" rel="8.3.1"/>
  <changelog author="ftake@geeko.jp" date="1442923200">- Stop providing locale(ja)
  + Most of ja locale users do not need this anymore
- Change the upstream URL
- Clean up the spec file</changelog>
  <changelog author="msuchanek@suse.com" date="1518091200">- Drop build-time requirement on X11. It does not seem to be used for anything.</changelog>
  <changelog author="qzhao@suse.com" date="1535716800">- Update anthy.spec: Divide openSUSE build with emacs function and
  SLE doesn't need it.</changelog>
  <changelog author="idonmez@suse.com" date="1535803200">- Cleanup spec file with spec-cleaner
- Don't install INSTALL file
- Use %bcond_with{out}</changelog>
  <changelog author="jengelh@inai.de" date="1552824000">- Drop --with-pic that is useless in the face of --disable-static.
- Drop pre-openSUSE-12.3 parts from the build recipe.
- Implement the shared library packaging policy.
- Replace description because canna/freewnn seem comparatively
  active in OBS's M17N project.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560427200">- Fix baselibs.conf: the library was split out as libanthy0 with
  the last change.</changelog>
  <changelog author="werner@suse.de" date="1597752000">- Add patch bugzilla-1175274-emacs-27.1.patch
  There is no (process-kill-without-query) anymore, use
  (set-process-query-on-exit-flag) instead (boo#1175274).</changelog>
  <changelog author="qzhao@suse.com" date="1600171200">- Update anthy.spec: Drop the is_opensuse macro to eliminate the
  difference between SLE-15 and openSUSE-Leap (jsc#SLE-11658).</changelog>
  <changelog author="werner@suse.de" date="1601380800">- Do not use Xemacs on SLE products (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601380801">- Do not use Xemacs on SLE products (jsc#SLE-12100)</changelog>
  <changelog author="werner@suse.de" date="1601467200">- Use build condition to enable or disable Xemacs support (jsc#SLE-11658)</changelog>
  <changelog author="werner@suse.de" date="1601467201">- Use build condition to enable or disable Xemacs support (jsc#SLE-12100)</changelog>
</package>
<package pkgid="840b94f0ab3ee2467e1104627cc14c3d71659be1dc7e9a5baefb4bcda10a55c1" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="3.3.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
</package>
<package pkgid="7c8c5cbd3eb969c4586d0a4de66edf5455e42356abc595d00d455d997db1b91e" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="3.3.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
</package>
<package pkgid="be3a3fe48fbe8b6748ab6920111575609d007705d5934272e02ab0781d2828c4" name="aom-tools" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="3.3.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
</package>
<package pkgid="0c53b750637c780c7d7e14f2c955c420f6646655508e515209e77c423201dd61" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="3.3.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
</package>
<package pkgid="0f2ce8557b562398a1729f3a0b1f30ef11c4f56f41badb6651eb5ecee6ca05a4" name="aom-tools" arch="aarch64">
  <version epoch="0" ver="1.0.0" rel="3.6.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
</package>
<package pkgid="ac69d7aa3fe61655a5baf86a8f95a5b46fca2a129ba4d335c59340af3d1cd381" name="aom-tools" arch="ppc64le">
  <version epoch="0" ver="1.0.0" rel="3.6.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
</package>
<package pkgid="2e829ba5e2447ddf912666b38b4630e52daa60a67dd5cc34619aa180a4ab01b1" name="aom-tools" arch="s390x">
  <version epoch="0" ver="1.0.0" rel="3.6.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
</package>
<package pkgid="1819ab88a7df9bd21ffa01e426a52877b36f986aaca71f7f37de4c29b46c35cf" name="aom-tools" arch="x86_64">
  <version epoch="0" ver="1.0.0" rel="3.6.1"/>
  <changelog author="9+suse@cirno.systems" date="1532692800">- Init, v1.0.0</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1532952000">- Pass conditional AOM_TARGET_CPU to cmake, fix build for arm and
  ppc, as well as optimize target cpu for other arches.</changelog>
  <changelog author="9+suse@cirno.systems" date="1533038400">- Enable CONFIG_LOWBITDEPTH. Makes 8-bit decoding faster. The only
  reason this confusingly-named option is not enabled by default
  is that its behavior might not match the 16-bit reference code
  path, and that hardware vendors want to be able to validate
  their designs against it. No actual mismatches have been found.
  See https://bugs.chromium.org/p/aomedia/issues/detail?id=2062</changelog>
  <changelog author="pgajdos@suse.com" date="1629892800">- security update
- added patches
  fix CVE-2021-30475 [bsc#1189497], Buffer overflow in aom_dsp/noise_model.c
  + libaom-CVE-2021-30475.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631188800">- security update
- added patches
  fix CVE-2021-30474 [bsc#1186799], aom_dsp/grain_table.c in libaom in AOMedia before 2021-03-30 has a use-after-free.
  + libaom-CVE-2021-30474.patch</changelog>
</package>
<package pkgid="d07376d7cb439486002a8e513373837ba909f1c83929e2b9f933c3cc3b9469c1" name="apache-commons-compress" arch="noarch">
  <version epoch="0" ver="1.21" rel="3.3.1"/>
  <changelog author="mvyskocil@suse.cz" date="1242302400">- 'Initial SUSE packaging from jpackage.org 5.0'</changelog>
  <changelog author="mvyskocil@suse.com" date="1354190400">- use saxon and saxon-scripts only when using maven</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build under new javapackage-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Build also the javadoc package</changelog>
  <changelog author="fstrba@suse.com" date="1548417600">- Rename package to apache-commons-compress
  * Upgrade to version 1.18
  * Use build.xml file generated ba mvn ant:ant and simplified
    manually after
    + Allows building with ant and considerably shortens build
    cycle
- Added patches
  * 0001-Remove-Brotli-compressor.patch
    + do not build Brotli compressor, since we don't have its
    dependencies
  * 0002-Remove-ZSTD-compressor.patch
    + do not build ZSTD compressor, since we don't have its
    dependencies
  * fix_java_8_compatibility.patch
    + restore Java 8 compatibility in java.nio.ByteBuffer use</changelog>
  <changelog author="jengelh@inai.de" date="1548590400">- Add missing RPM group for %name-javadoc.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Updated to 1.19 [bsc#1148475, CVE-2019-12402]
  * ZipFile could get stuck in an infinite loop when parsing ZIP archives
    with certain strong encryption headers (CVE-2019-12402).
  * ZipArchiveInputStream and ZipFile will no longer throw an exception if
    an extra field generally understood by Commons Compress is malformed
    but rather turn them into UnrecognizedExtraField instances.  You can
    influence the way extra fields are parsed in more detail by using the
    new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now.
  * Some of the ZIP extra fields related to strong encryption will now
    throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
    certain cases when used directly. There is no practical difference
    when they are read via ZipArchiveInputStream or ZipFile.
  * ParallelScatterZipCreator now writes entries in the same order they have
    been added to the archive.
  * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra
    fields by default now.
  * TarArchiveInputStream has a new lenient mode that may allow it to read
    certain broken archives.
- Rebased patch fix_java_8_compatibility.patch</changelog>
  <changelog author="fstrba@suse.com" date="1626782400">- Updated to 1.21
  * When reading a specially crafted 7Z archive, the construction of
    the list of codecs that decompress an entry can result in an
    infinite loop. This could be used to mount a denial of service
    attack against services that use Compress' sevenz package.
    (CVE-2021-35515, bsc#1188463)
  * When reading a specially crafted 7Z archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464)
  * When reading a specially crafted TAR archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could be
    used to mount a denial of service attack against services that
    use Compress' tar package. (CVE-2021-35517, bsc#1188465)
  * When reading a specially crafted ZIP archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' zip package. (CVE-2021-36090, bsc#1188466)
- New dependency on asm3 for Pack200 compressor
- Rebased patch fix_java_8_compatibility.patch to a new context and
  added some new ocurrences</changelog>
</package>
<package pkgid="d283ad8ce415ac687f2a91472e4e994185032a977430efe469abe5597371fcf0" name="apache-commons-compress" arch="src">
  <version epoch="0" ver="1.21" rel="3.3.1"/>
  <changelog author="mvyskocil@suse.cz" date="1242302400">- 'Initial SUSE packaging from jpackage.org 5.0'</changelog>
  <changelog author="mvyskocil@suse.com" date="1354190400">- use saxon and saxon-scripts only when using maven</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build under new javapackage-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Build also the javadoc package</changelog>
  <changelog author="fstrba@suse.com" date="1548417600">- Rename package to apache-commons-compress
  * Upgrade to version 1.18
  * Use build.xml file generated ba mvn ant:ant and simplified
    manually after
    + Allows building with ant and considerably shortens build
    cycle
- Added patches
  * 0001-Remove-Brotli-compressor.patch
    + do not build Brotli compressor, since we don't have its
    dependencies
  * 0002-Remove-ZSTD-compressor.patch
    + do not build ZSTD compressor, since we don't have its
    dependencies
  * fix_java_8_compatibility.patch
    + restore Java 8 compatibility in java.nio.ByteBuffer use</changelog>
  <changelog author="jengelh@inai.de" date="1548590400">- Add missing RPM group for %name-javadoc.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Updated to 1.19 [bsc#1148475, CVE-2019-12402]
  * ZipFile could get stuck in an infinite loop when parsing ZIP archives
    with certain strong encryption headers (CVE-2019-12402).
  * ZipArchiveInputStream and ZipFile will no longer throw an exception if
    an extra field generally understood by Commons Compress is malformed
    but rather turn them into UnrecognizedExtraField instances.  You can
    influence the way extra fields are parsed in more detail by using the
    new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now.
  * Some of the ZIP extra fields related to strong encryption will now
    throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
    certain cases when used directly. There is no practical difference
    when they are read via ZipArchiveInputStream or ZipFile.
  * ParallelScatterZipCreator now writes entries in the same order they have
    been added to the archive.
  * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra
    fields by default now.
  * TarArchiveInputStream has a new lenient mode that may allow it to read
    certain broken archives.
- Rebased patch fix_java_8_compatibility.patch</changelog>
  <changelog author="fstrba@suse.com" date="1626782400">- Updated to 1.21
  * When reading a specially crafted 7Z archive, the construction of
    the list of codecs that decompress an entry can result in an
    infinite loop. This could be used to mount a denial of service
    attack against services that use Compress' sevenz package.
    (CVE-2021-35515, bsc#1188463)
  * When reading a specially crafted 7Z archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464)
  * When reading a specially crafted TAR archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could be
    used to mount a denial of service attack against services that
    use Compress' tar package. (CVE-2021-35517, bsc#1188465)
  * When reading a specially crafted ZIP archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' zip package. (CVE-2021-36090, bsc#1188466)
- New dependency on asm3 for Pack200 compressor
- Rebased patch fix_java_8_compatibility.patch to a new context and
  added some new ocurrences</changelog>
</package>
<package pkgid="92dfb78894abee00c77236e60e8675cc273337529ecedf0e0a83ff96eca69873" name="apache-commons-compress-javadoc" arch="noarch">
  <version epoch="0" ver="1.21" rel="3.3.1"/>
  <changelog author="mvyskocil@suse.cz" date="1242302400">- 'Initial SUSE packaging from jpackage.org 5.0'</changelog>
  <changelog author="mvyskocil@suse.com" date="1354190400">- use saxon and saxon-scripts only when using maven</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Fix build under new javapackage-tools</changelog>
  <changelog author="fstrba@suse.com" date="1505736000">- Fix build with jdk9: specify java source and target 1.6
- Build also the javadoc package</changelog>
  <changelog author="fstrba@suse.com" date="1548417600">- Rename package to apache-commons-compress
  * Upgrade to version 1.18
  * Use build.xml file generated ba mvn ant:ant and simplified
    manually after
    + Allows building with ant and considerably shortens build
    cycle
- Added patches
  * 0001-Remove-Brotli-compressor.patch
    + do not build Brotli compressor, since we don't have its
    dependencies
  * 0002-Remove-ZSTD-compressor.patch
    + do not build ZSTD compressor, since we don't have its
    dependencies
  * fix_java_8_compatibility.patch
    + restore Java 8 compatibility in java.nio.ByteBuffer use</changelog>
  <changelog author="jengelh@inai.de" date="1548590400">- Add missing RPM group for %name-javadoc.</changelog>
  <changelog author="fstrba@suse.com" date="1553515200">- Remove pom parent, since we don't use it when not building with
  maven</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1566993600">- Updated to 1.19 [bsc#1148475, CVE-2019-12402]
  * ZipFile could get stuck in an infinite loop when parsing ZIP archives
    with certain strong encryption headers (CVE-2019-12402).
  * ZipArchiveInputStream and ZipFile will no longer throw an exception if
    an extra field generally understood by Commons Compress is malformed
    but rather turn them into UnrecognizedExtraField instances.  You can
    influence the way extra fields are parsed in more detail by using the
    new getExtraFields(ExtraFieldParsingBehavior) method of ZipArchiveEntry now.
  * Some of the ZIP extra fields related to strong encryption will now
    throw ZipExceptions rather than ArrayIndexOutOfBoundsExceptions in
    certain cases when used directly. There is no practical difference
    when they are read via ZipArchiveInputStream or ZipFile.
  * ParallelScatterZipCreator now writes entries in the same order they have
    been added to the archive.
  * ZipArchiveInputStream and ZipFile are more forgiving when parsing extra
    fields by default now.
  * TarArchiveInputStream has a new lenient mode that may allow it to read
    certain broken archives.
- Rebased patch fix_java_8_compatibility.patch</changelog>
  <changelog author="fstrba@suse.com" date="1626782400">- Updated to 1.21
  * When reading a specially crafted 7Z archive, the construction of
    the list of codecs that decompress an entry can result in an
    infinite loop. This could be used to mount a denial of service
    attack against services that use Compress' sevenz package.
    (CVE-2021-35515, bsc#1188463)
  * When reading a specially crafted 7Z archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' sevenz package. (CVE-2021-35516, bsc#1188464)
  * When reading a specially crafted TAR archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could be
    used to mount a denial of service attack against services that
    use Compress' tar package. (CVE-2021-35517, bsc#1188465)
  * When reading a specially crafted ZIP archive, Compress can be
    made to allocate large amounts of memory that finally leads to
    an out of memory error even for very small inputs. This could
    be used to mount a denial of service attack against services
    that use Compress' zip package. (CVE-2021-36090, bsc#1188466)
- New dependency on asm3 for Pack200 compressor
- Rebased patch fix_java_8_compatibility.patch to a new context and
  added some new ocurrences</changelog>
</package>
<package pkgid="f90f06adbbb100e53a805410bdd3acdf049c913f62c9ac51f1b218497bfa2bdb" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="d630e3008ff7927173e8f6bf2a880efb83af69595371e4986f8d24766760f289" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="c54f33c78f108ab8f2c3d8fb640392b35a0308d0bb294b14d450675b8f2806f8" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="cdacda64f01b0927774a22bcbda73ebc56f94dc9fa5e208364431d8cf468b2c0" name="apache2" arch="src">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="ed655926b70e493b8b7540e294d48188b6239fc0d785b5be6d7ad6b30e79a548" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="350684d52026c9421730af3a3941764f27ddc1c1163506f2613de298b359f374" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="f1dd50a040bec4186cedcc1904872e3c98d6787b17453807a88c9c74db5d2aac" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="45758b1d0c5f949039b55114268b28dc7d8b1ec0b1cdcfe619fab089c0dbff4e" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="37240665f2600e02096fc4e338998de4051fbb5808c140f1722e005dc8e3055f" name="apache2" arch="src">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="a4eb7c18fe90ba6af5caaffab6239399419558ecdd2a44800e5e0b2571407634" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="b3137069b8af1569caf806ae8c98f1ebe359b99de973da0cd3ae952e66457933" name="apache2" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="1eadc8afd52b5af7e07a816da73bdc4ad6c08d0ec44518460a23c830fe20aff8" name="apache2" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="6a836a9d06374cad86435d38fa02de6316bfd4a93d1f590a8649b706a771fb49" name="apache2" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="03169866125399cc8c9ea853963c880c9b90a5c7b993c07b60d00e5f1838e56b" name="apache2" arch="src">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="7f142efa21eaad89b4b08aad7be92b7814ee514d4bc8e5ef95c0c66724a8c714" name="apache2" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="fa007a8bdbae35fd6353abe198b4d74fcd8e8d77b84057b7695b29a46094c890" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="9eebea863b1ca5ef5a4f0f1189a2d81bb300d208d3eec4081616ac537edb8425" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="0fc0bd358d0252e59d0908c51a213d7543d153f7adf1335e237c02966dbe7eb8" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="8222762b88125aa0911fa75de527cce4729bd004569f61cc3abaf27d83a5aadc" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="266b268b3ae32d26d51c905ee35608d537d11f61c2c406dccdc6acf652b69520" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="fdfe949230256552b3e25bf5e918b094ef4843cb64ed4e89e1368baf7a4185b9" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="6a7e2441a42ccde2af3f5ad09fa9756bb594cf04dbd7d0a524613b3c27a750b1" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="acfa12f48628b866d41b9c7ae606dde79e2876a269a4d53b8fb62bcedf7a1d7a" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="43f85a7577a4344c010328ccbe5882f8f552ef5c794ae761614b5775d3d0a3d1" name="apache2-devel" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="23f58a31d988c813115fda3d277c393a030e53086fb4f99e323a8fa4308c5291" name="apache2-devel" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="80396128752e9ae4a7d13b5d90bcbc7de4f0b98dacb877a82645355d674060ea" name="apache2-devel" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="1ee7e31cca3b20149cd19e8b85c60b5819dd8817e5dd35bb86463e62ab7e71f7" name="apache2-devel" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="dd5e58c9e128d5b1de6808774d42f75e1633fe405d52c9b1afc0e873fe62b777" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="aa142dcadb32c83a1c9e2542c0a3e24639d2255d248cd9219c88f3931b66f711" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="a0837f2e3a9047d4c41f2ae18525dc399aa5ee78b70c661474b27927202bef2e" name="apache2-doc" arch="noarch">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="cc68ae25ae00646960b70876d4d9201e1c91602c6c7c5280b786b544dadf1617" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="2513b9bd085689beb043483366ba7f867b9f303bc5ab82f9db2698e89fb57172" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="1b5f8ea5a0928bb474d3237302fcf90406286a58754d36370f496f7d8f0fbb99" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="362b95a6dabfc0584d8f539471b9107363a20cea32f43ba850daea2f362ad08c" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="23b3fe827877b7d3faa78b6e211d30abf97c4d6a0a1aa5a40afe4bb9a8c015ca" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="905703e6dded423308aba321e1d68d072144db13fe62336e3438a3265e5a66fb" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="b6edfc37b94e9faed4ecfa25c58b682b2971d8627e253eedbcf69ac43e64c006" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="b115d0a690df94f0d438a7bcc5af3891d36eb7d690e59cba5723ebd7a05fd612" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="ba95dafb3321c500d2ae8b00b701e73de1d9d16dbb8bd26875c3d86cc14bcd12" name="apache2-event" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="1c83493ca93d670b821eef964036a06142682a2f88d14d6ca545901e68714fe0" name="apache2-event" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="cc15e287b8112bd8e91bee649ab3ca2ebc69b9e43171f79156f103bb444d3ef5" name="apache2-event" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="9826fe805510e20390cfc6dcd59d2cd3d3f153f4a5857c5b3d50197dfcf09f23" name="apache2-event" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="095bb282a8ba45adfbe92aa3a11418a89952facaf14557ff8a331e604f66d929" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="46e6aac8baa1379b31e5704081a86fa368981fd2675ef18eab3f9f58481d3bd1" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="24645aaf0ced9924dc52ffcd99ac4f98c8b43fcf843bb712428f223910f756dd" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="e139688eddab7707f16213c9e41dc2d39c4b3bd2cedd40d79067090ac359fdce" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="831634fce424ffbb0fecab21afa32f99136006da6fa2b4fa8e26fff24e7146af" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="2cf38f681ddca8aa10f1b7bc390f416c7399e25eaab33b04dcdbde32d8c979c1" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="7dca5f7bd6e5aff2898f184cd3b9bb164da3f91f0174f173aaeb24363721bb53" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="3ae57eec25792b45b696e86a5fe047ae1a63e28915967876df7bff7e89326eef" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="b5bec053e8162b7a9116a950e5fffed53c09d0bed0449897d01906fb492ee352" name="apache2-example-pages" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="a38df8ed029c1e6d05e0e3345c4e0e3d1b7eea0bbe7b96b4e95adbc2ff532c98" name="apache2-example-pages" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="b6685bd18c83e7f0bdb809201aa271bd26700ca399fb0da4f33bf70b00a8df46" name="apache2-example-pages" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="397615f6bbb26c0e95404c474627533051fedaa9e78ac1e09c05a5c50c24973a" name="apache2-example-pages" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="5480d632af54e2c24f179c0e4e5920b2087876ed52b52008fbc7f942ffd34828" name="apache2-mod_apparmor" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="5f332869694ce2e37cdd925f38df900ce888f218142c3b102a61120d2d11d23c" name="apache2-mod_apparmor" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="884ea130cd20593923e1864c42da836b5a16a782d2347b9542c6558bd3c85a82" name="apache2-mod_apparmor" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="15ffbe6872222f8a162933e5b6e7afd10dc0f499783c7c762a3a42c37454e9d7" name="apache2-mod_apparmor" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="1c103d69a4e353690acf73a93f258ad1a008dd09cafb85e10ab13c7294762f3c" name="apache2-mod_auth_mellon" arch="aarch64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="cb67651eee59049c96a6406a455daed9725dff346a07a698b3837920dc172ac4" name="apache2-mod_auth_mellon" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="3703d7126bca6b434409dfba849396fc6c7cf14d874c1f8e3d41ba833e7f6d2d" name="apache2-mod_auth_mellon" arch="src">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="6fd7f83416c3170ed9f563edb38ef0db709e1ed55dc7428c701edbc7934f8b69" name="apache2-mod_auth_mellon" arch="x86_64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="47d0d22d5dfb25e8f8182180696c893a3626cfd643512421075d3d1841ec921c" name="apache2-mod_auth_mellon-diagnostics" arch="aarch64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="b88491366f336c2c32b8df5c6d0a239a0ec385a2e23f62476054644e618c7197" name="apache2-mod_auth_mellon-diagnostics" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="18b073856739c1a6ab8eb4c1e50b89e215f828f22ec7463e716983e8450274b5" name="apache2-mod_auth_mellon-diagnostics" arch="x86_64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="e7b19e8446049708296f9878d393edb666c6c43915ac037cad487af00e20fc19" name="apache2-mod_auth_mellon-doc" arch="aarch64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="47f44719e70e4b00541f6ed121c19fcea654b33fd7992dbaf0cfd6d49d966c4f" name="apache2-mod_auth_mellon-doc" arch="s390x">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="d55c9cbb05c5c2a48ed944c119f277fe83106250213cf1293d3c0939d9b2250b" name="apache2-mod_auth_mellon-doc" arch="x86_64">
  <version epoch="0" ver="0.17.0" rel="5.4.1"/>
  <changelog author="kstreitova@suse.com" date="1588075200">- initial packaging</changelog>
  <changelog author="kstreitova@suse.com" date="1589198400">- replace version_path with the fixed value</changelog>
  <changelog author="kstreitova@suse.com" date="1591272000">- update mod_auth_mellon-0.16.0-env-script-interpreter.patch
  use /bin/bash instead of /usr/bin/bash</changelog>
  <changelog author="kstreitova@suse.com" date="1599739200">- Update to 0.17.0
  * New option MellonSendExpectHeader (default On) which allows to
    disable sending the Expect header in the HTTP-Artifact binding to
    improve performance when the remote party does not support this
    header.
  * Set SameSite attribute to None on on the cookietest cookie.
  * Bump default generated keysize to 3072 bits in
    mellon_create_metadata
  * Validate if the assertion ID has not been used earlier before
    creating a new session.
  * Release session cache after calling invalidate endpoint.
  * In MellonCond directives, fix a bug that setting the NC option
    would also activate substring match and that REG would activate
    REF.
  * Fix MellonCond substring match to actually match the substring on
    the attribute value</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627905600">- Fix CVE-2021-3639 Open Redirect vulnerability in logout URLs
  (CVE-2021-3639, bsc#1188926)
  * fix-CVE-2021-3639.patch</changelog>
</package>
<package pkgid="66bf463df8eeaa8e9000bdf1e0a925020b2c09d0148c50403a48ea2f621b99cd" name="apache2-mod_auth_openidc" arch="aarch64">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="d113cfc8bb1704e8e82dc9ca4085faa4353a7acee5f20aa34c997f14b9d1c5fb" name="apache2-mod_auth_openidc" arch="ppc64le">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="c4b686c2a687f4ca83aa2fb59af2d55b0f63b3ed928a230fb38af62ab7c11c4f" name="apache2-mod_auth_openidc" arch="s390x">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="5534b9a93837148d60e081488f0faa3e96c78593c82374a0ef72988951dc6e1e" name="apache2-mod_auth_openidc" arch="src">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="79db50c41107b982c3fbed62973875945e1d12679b2d43bb35b2fe9ce53ce467" name="apache2-mod_auth_openidc" arch="x86_64">
  <version epoch="0" ver="2.3.8" rel="3.15.1"/>
  <changelog author="christof.hanke@mpcdf.mpg.de" date="1513166400">- initial packaging</changelog>
  <changelog author="vcizek@suse.com" date="1524830400">- update to 2.3.4
- requested in fate#323817</changelog>
  <changelog author="kstreitova@suse.com" date="1540900800">- update to 2.3.8
- changes in 2.3.8
  * fix return result FALSE when JWT payload parsing fails
  * add LGTM code quality badges
  * fix 3 LGTM alerts
  * improve auto-detection of XMLHttpRequests via Accept header
  * initialize test_proto_authorization_request properly
  * add sanity check on provider-&gt;auth_request_method
  * allow usage with LibreSSL
  * don't return content with 503 since it will turn the HTTP
    status code into a 200
  * add option to set an upper limit to the number of concurrent
    state cookies via OIDCStateMaxNumberOfCookies
  * make the default maximum number of parallel state cookies
    7 instead of unlimited
  * fix using access token as endpoint auth method in
    introspection calls
  * fix reading access_token form POST parameters when combined
    with `AuthType auth-openidc`
- changes in 2.3.7
  * abort when string length for remote user name substitution
    is larger than 255 characters
  * fix Redis concurrency issue when used with multiple vhosts
  * add support for authorization server metadata with
    OIDCOAuthServerMetadataURL as in RFC 8414
  * refactor session object creation
  * clear session cookie and contents if cache corruption is detected
  * use apr_pstrdup when setting r-&gt;user
  * reserve 255 characters in remote username substition instead of 50
- changes in 2.3.6
  * add check to detect session cache corruption for server-based
    caches and cached static metadata
  * avoid using pipelining for Redis
  * send Basic header in OAuth www-authenticate response if that's
    the only accepted method; thanks @puiterwijk
  * refactor Redis cache backend to solve issues on AUTH errors:
    a) memory leak and b) redisGetReply lagging behind
  * adjust copyright year/org
  * fix buffer overflow in shm cache key set strcpy
  * turn missing session_state from warning into a debug statement
  * fix missing "return" on error return from the OP
  * explicitly set encryption kid so we're compatible with
    cjose &gt;= 0.6.0
- changes in 2.3.5
  * fix encoding of preserved POST data
  * avoid buffer overflow in shm cache key construction
  * compile with with Libressl</changelog>
  <changelog author="kstreitova@suse.com" date="1541764800">- submission to SLE15SP1 because of fate#324447
- build with hiredis only for openSUSE where hiredis is available
- add a version for jansson BuildRequires</changelog>
  <changelog author="kstreitova@suse.com" date="1572436800">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-14857.patch to fix
  open redirect issue that exists in URLs with trailing slashes
  [bsc#1153666], [CVE-2019-14857]</changelog>
  <changelog author="kstreitova@suse.com" date="1583323200">- add apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch to fix
  open redirect issue that exists in URLs with a slash and
  backslash at the beginning [bsc#1164459], [CVE-2019-20479]</changelog>
  <changelog author="pgajdos@suse.com" date="1617278400">- require hiredis only for newer distros than SLE-15 [jsc#SLE-11726]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627041600">- Fix CVE-2021-32785 format string bug via hiredis
  (CVE-2021-32785, bsc#1188638)
  * fix-CVE-2021-32785.patch
- Fix CVE-2021-32786 open redirect in logout functionality
  (CVE-2021-32786, bsc#1188639)
  * fix-CVE-2021-32786.patch
- Refresh apache2-mod_auth_openidc-2.3.8-CVE-2019-20479.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1627473600">- Fix CVE-2021-32791 Hardcoded static IV and AAD with a reused key in AES GCM encryption
  (CVE-2021-32791, bsc#1188849)
  * fix-CVE-2021-32791.patch
- Fix CVE-2021-32792 XSS when using OIDCPreservePost On
  (CVE-2021-32792, bsc#1188848)
  * fix-CVE-2021-32792-1.patch
  * fix-CVE-2021-32792-2.patch</changelog>
</package>
<package pkgid="cc065dcf10caddc472ae080d6115998da29bbc6ce77bfc5065b8316370f97527" name="apache2-mod_php7" arch="aarch64">
  <version epoch="0" ver="7.4.6" rel="3.22.1"/>
  <changelog author="suse+build@de-korte.org" date="1582113600">- updated to 7.4.3: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.3</changelog>
  <changelog author="mliska@suse.cz" date="1584014400">- Enable LTO as it works now (boo#1133275).</changelog>
  <changelog author="suse+build@de-korte.org" date="1584446400">- updated to 7.4.4: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.4</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
</package>
<package pkgid="0e646258c16751afd6479e6194255bb49a75e3ba2d9d039dc9983fbb5d99587d" name="apache2-mod_php7" arch="ppc64le">
  <version epoch="0" ver="7.4.6" rel="3.22.1"/>
  <changelog author="suse+build@de-korte.org" date="1582113600">- updated to 7.4.3: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.3</changelog>
  <changelog author="mliska@suse.cz" date="1584014400">- Enable LTO as it works now (boo#1133275).</changelog>
  <changelog author="suse+build@de-korte.org" date="1584446400">- updated to 7.4.4: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.4</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
</package>
<package pkgid="164da94bb6bfc6b6f6e39112353e864317a9a992cfde574049b1a7d5deeec8cd" name="apache2-mod_php7" arch="s390x">
  <version epoch="0" ver="7.4.6" rel="3.22.1"/>
  <changelog author="suse+build@de-korte.org" date="1582113600">- updated to 7.4.3: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.3</changelog>
  <changelog author="mliska@suse.cz" date="1584014400">- Enable LTO as it works now (boo#1133275).</changelog>
  <changelog author="suse+build@de-korte.org" date="1584446400">- updated to 7.4.4: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.4</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
</package>
<package pkgid="7e4807802123f9f3217150d238c3e52b73cbc3671507ea7592a234875da86328" name="apache2-mod_php7" arch="x86_64">
  <version epoch="0" ver="7.4.6" rel="3.22.1"/>
  <changelog author="suse+build@de-korte.org" date="1582113600">- updated to 7.4.3: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.3</changelog>
  <changelog author="mliska@suse.cz" date="1584014400">- Enable LTO as it works now (boo#1133275).</changelog>
  <changelog author="suse+build@de-korte.org" date="1584446400">- updated to 7.4.4: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.4</changelog>
  <changelog author="pgajdos@suse.com" date="1584705600">- build firebird extension in any case</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- remove Berkeley DB Database support [jsc#SLE-12210]</changelog>
  <changelog author="suse+build@de-korte.org" date="1586865600">- updated to 7.4.5: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.5</changelog>
  <changelog author="pgajdos@suse.com" date="1589198400">- added to SLE-15-SP2 [jsc#SLE-12482], including fixes for:
  CVE-2020-7063 [bsc#1165289]
  CVE-2020-7062 [bsc#1165280]
  CVE-2019-11046, CVE-2019-11050, CVE-2019-11047, CVE-2019-11045</changelog>
  <changelog author="pgajdos@suse.com" date="1589284800">- spec file usable under SLE12 again and better prepared for
  phpM -&gt; phpMN transition</changelog>
  <changelog author="pgajdos@suse.com" date="1589284801">- added to SLE-12 [jsc#SLE-12474]</changelog>
  <changelog author="pgajdos@suse.com" date="1589371200">- added patches
  build fixes in SLE12
  + php7-arm-build-fixes.patch</changelog>
  <changelog author="suse+build@de-korte.org" date="1589457600">- updated to 7.4.6: This is a security release which also contains
  several bug fixes. See https://www.php.net/ChangeLog-7.php#7.4.6</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594036800">- added tmpfiles.d for php-fpm to provide a base base for a socket
  (boo#1173786)</changelog>
  <changelog author="pgajdos@suse.com" date="1594296000">- do not install %{_tmpfilesdir}, %{_tmpfilesdir}/php-fpm.conf in
  test favour</changelog>
  <changelog author="pgajdos@suse.com" date="1594296001">- Use /run/php-fpm instead of /run/php
- modified sources
  % php-fpm.tmpfiles.d</changelog>
  <changelog author="pgajdos@suse.com" date="1597320000">- security update
- added patches
  fix CVE-2020-7068 [bsc#1175223], Use of freed hash key in the phar_parse_zipfile function
  + php7-CVE-2020-7068.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- security update
- added patches
  fix CVE-2020-7069 [bsc#1177351], when AES-CCM mode is used with openssl_encrypt() function with 12 bytes IV, only first 7 bytes of the IV is used
  + php7-CVE-2020-7069.patch
  fix CVE-2020-7070 [bsc#1177352], Percent-encoded cookies can be used to overwrite existing prefixed cookie names
  + php7-CVE-2020-7070.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1610366400">- security update
- added patches
  fix CVE-2020-7071 [bsc#1180706], FILTER_VALIDATE_URL accepts URLs with invalid userinfo
  + php7-CVE-2020-7071.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1613044800">- security update
- added patches
  fix CVE-2021-21702 [bsc#1182049], NULL pointer dereference in SoapClient
  + php7-CVE-2021-21702.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625832000">- security update
- added patches
  fix CVE-2021-21705 [bsc#1188037], SSRF bypass in FILTER_VALIDATE_URL
  + php7-CVE-2021-21705.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- added patches
  fix CVE-2021-21704 [bsc#1188035], security issues in pdo_firebase module
  + php7-CVE-2021-21704.patch</changelog>
</package>
<package pkgid="5f1ee77aaefc9d73ecbe0f09de5a0d28b1b3a2007ffd803a44932efc537590a6" name="apache2-mod_wsgi" arch="aarch64">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="e9f65a9b8faba290d15877fe111e8a3dc436cd18d06f8b2eacf4afc4e7cec39d" name="apache2-mod_wsgi" arch="ppc64le">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="4cf67342591ea9d31627bd5eaf42742ddbcdcd55f366cc9598e299b66c7b5962" name="apache2-mod_wsgi" arch="s390x">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="257f4f74f125f7afa4df12ead6a6e322ecdb9779be2fab1c29ac8ba4009697d7" name="apache2-mod_wsgi" arch="src">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1359547200">- Update to version 3.4:
  + New support for Apache 2.4
  + Support for Python 3.2
  + Is now guaranteed that mod_ssl access handler is run before
    that for mod_wsgi so that any per request variables setup by
    mod_ssl are available in the mod_wsgi access handler as
    implemented by WSGIAccessScript directive.
  + Added 'python-home' option to WSGIDaemonProcess.
  + Added 'lang' and 'locale' options to WSGIDaemonProcess.
  + Split combined WWW-Authenticate header returned from daemon
    process back into separate headers.
- Introduce build compatibility with apache 2.4: apxs2 was moved
  from %{_sbindir} to %{_bindir}</changelog>
  <changelog author="agraf@suse.com" date="1385812800">- Add patch "mod_wsgi-3.4-connsbh.patch" to fix segmentation faults
  with apache 2.4 (https://bugzilla.redhat.com/show_bug.cgi?id=831701)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1398686400">- Fix module name sent to a2enmod/a2dismod and fix/cleanup
  post/postun scripts.</changelog>
  <changelog author="mc@suse.com" date="1400932800">- fix Local privilege escalation (bnc#878550)
  CVE-2014-0240</changelog>
  <changelog author="mc@suse.de" date="1404907200">- Update to version 4.2.5
  - remove mod_wsgi-3.4-connsbh.patch - included in upstream version
  - remove mod_wsgi-setuid-patch.diff - included in upstream version
  - No longer support the use of mod_python in conjunction with
    mod_wsgi
  - Adding a lot of new configuration option
  - fix off-by-one error in setgroups (bnc#883229)</changelog>
  <changelog author="mc@suse.de" date="1404907201">- provide short module name</changelog>
  <changelog author="mc@suse.de" date="1404993600">- change URL to new location</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="26592c1d26001c2d1786aebbfd427e4e9de7e0c2e190248b2719598248a0f8ae" name="apache2-mod_wsgi" arch="x86_64">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="2b7940dc8fc6cbf6444f1da414e5c2de68d156dcd9f12ceb2b8e88b42ab5b7a1" name="apache2-mod_wsgi-python3" arch="aarch64">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="fb1f3a091362300c74e45ee9a0819b0f0211bae8f941ff79cce9321b9d549996" name="apache2-mod_wsgi-python3" arch="ppc64le">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="261812754dbd8f7ee76a0710cf44f6b2949a8a7c6bde1ed0a7514410134e78d5" name="apache2-mod_wsgi-python3" arch="s390x">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="09d06567b1ce8cc42b7eb2da60686db00ca0f06ab76c4d98b2f787c9c67472e4" name="apache2-mod_wsgi-python3" arch="src">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1359547200">- Update to version 3.4:
  + New support for Apache 2.4
  + Support for Python 3.2
  + Is now guaranteed that mod_ssl access handler is run before
    that for mod_wsgi so that any per request variables setup by
    mod_ssl are available in the mod_wsgi access handler as
    implemented by WSGIAccessScript directive.
  + Added 'python-home' option to WSGIDaemonProcess.
  + Added 'lang' and 'locale' options to WSGIDaemonProcess.
  + Split combined WWW-Authenticate header returned from daemon
    process back into separate headers.
- Introduce build compatibility with apache 2.4: apxs2 was moved
  from %{_sbindir} to %{_bindir}</changelog>
  <changelog author="agraf@suse.com" date="1385812800">- Add patch "mod_wsgi-3.4-connsbh.patch" to fix segmentation faults
  with apache 2.4 (https://bugzilla.redhat.com/show_bug.cgi?id=831701)</changelog>
  <changelog author="adaugherity@tamu.edu" date="1398686400">- Fix module name sent to a2enmod/a2dismod and fix/cleanup
  post/postun scripts.</changelog>
  <changelog author="mc@suse.com" date="1400932800">- fix Local privilege escalation (bnc#878550)
  CVE-2014-0240</changelog>
  <changelog author="mc@suse.de" date="1404907200">- Update to version 4.2.5
  - remove mod_wsgi-3.4-connsbh.patch - included in upstream version
  - remove mod_wsgi-setuid-patch.diff - included in upstream version
  - No longer support the use of mod_python in conjunction with
    mod_wsgi
  - Adding a lot of new configuration option
  - fix off-by-one error in setgroups (bnc#883229)</changelog>
  <changelog author="mc@suse.de" date="1404907201">- provide short module name</changelog>
  <changelog author="mc@suse.de" date="1404993600">- change URL to new location</changelog>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="96ef0445f69688d1d53dfcc22b62974c4931f59dc3c11ea52e6c57c8c62748c0" name="apache2-mod_wsgi-python3" arch="x86_64">
  <version epoch="0" ver="4.5.18" rel="4.3.1"/>
  <changelog author="pgajdos@suse.com" date="1415016000">- call spec-cleaner
- use apache rpm macros</changelog>
  <changelog author="rjschwei@suse.com" date="1422532800">- Update to version 4.4.6
  - Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.6.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.5.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.4.html
    .....
  - As of version 4.2.7 mod_wsgi is effected by
    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=758035</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Fix build failure on SLE 12 (Apache 2.4.10)
  + add wsgi_fixVersionCheck.patch
  + build failed due to improper version check</changelog>
  <changelog author="pgajdos@suse.com" date="1437048000">- Requries: %{apache_suse_maintenance_mmn}
  This will pull this module to the update (in released distribution)
  when apache maintainer thinks it is good (due api/abi changes).</changelog>
  <changelog author="mc@suse.com" date="1438862400">- Build subpackage with mod_wsgi_python3 (bsc#939717)</changelog>
  <changelog author="mc@suse.de" date="1439640000">- update to 4.4.8
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.7.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.8.html
- seperate package for python3 to fix module loading errors
- conflict with mod_wsgi-python3</changelog>
  <changelog author="pgajdos@suse.com" date="1441108800">- test module with %apache_test_module_load</changelog>
  <changelog author="mc@suse.de" date="1443441600">- update to 4.4.13
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.13.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.12.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.11.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.10.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.9.html</changelog>
  <changelog author="bruno@ioda-net.ch" date="1455969600">- update to 4.4.22
  * Upstream release notes:
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.22.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.21.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.20.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.19.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.18.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.17.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.16.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.15.html
    + http://modwsgi.readthedocs.org/en/latest/release-notes/version-4.4.14.html</changelog>
  <changelog author="mrueckert@suse.de" date="1464955200">- update to 4.5.2
  * Upstream release notes:
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.2.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.1.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.5.0.html
    + http://modwsgi.readthedocs.io/en/latest/release-notes/version-4.4.23.html
- minimized delta between spec files
- use the #/ trick for the source url</changelog>
  <changelog author="bruno@ioda-net.ch" date="1505563200">- update to 4.5.18 see full changes bugfix and new features here:
  http://modwsgi.readthedocs.io/en/latest/release-notes
- specleanup</changelog>
  <changelog author="tbechtold@suse.com" date="1521460800">- Fix description (bsc#1084882)</changelog>
  <changelog author="egotthold@suse.com" date="1629115200">- Enable installation of Python sitelib wrapper
  This enabled Python Projects to require mod_wsgi in the install_requires
  without receiving a "DistributionNotFound" error on entrypoint script
  generated by setuptools
- Backport of https://build.opensuse.org/request/show/794038
- Fixes bsc#1189467</changelog>
</package>
<package pkgid="5dad1aa4af76c08dbfad0ccbb346b1fccca100d4f112180492f54d92e9c89739" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="e8d81ac6860e28708acba360d4ba47dad23c861aa2514c764ef86430a7b93217" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="5ef5e6173de6b1955965e77b9b468b37768773f0c777d85249626e81693f14f4" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="f929b98446098d49d884747b018f30fba087d3102d320e37701a940efa25512d" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="6aa31d83fd909e6aa4fd023469b358eb4897949ac47652e93141206926d5ea46" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="8a7597808dd8c20d25515ec00f7acda5b1dd05e1b30471ea75cf8d379596c142" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="5672f296e8d5cf500cb65d9ca873e8ba432f219f7b1443ce1d9283c94571b280" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="e6f551d3e5c9c7d899cd84e79b4d2c10c388537ffe7ed4f87db6bcbf9109babc" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="ae7d37a64e3cdaee517bf21a75ca10362c4c3bd6bccbbb27e9f1c8c08f37c3c1" name="apache2-prefork" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="ca1e3914c68f4607316a80db23b6070885556ca98b70a727d8e1143471781848" name="apache2-prefork" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="7295deba97e3b8fcb9adaa9bd45e8d0ea2d6eb46cf586cf51eb9c16e97f66219" name="apache2-prefork" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="d9aa4d2e85dff1e481569f0fe656cbcf8dc45dfae782b5efabfaf7ee45ebf35d" name="apache2-prefork" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="da4b67b409ff629366fc27c9998d603c3b64e6679dbdc960cdd23ce576b58124" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="42e725f139389230db0f0dd2863288b6bb62fa2736804509b41623dc61a8696f" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="5742bd3e5bb0fc629d79fd1ddc431d9e4100b5e3c6aa1232bdc1adb2b21937b9" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="66a67f133f3813bfbb762da1404856bedc36f13a3821c3ca386e0be01841a5a4" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="fff80f836c7869366b14c0175f3b8edb4f81d6ffb564b2570f191317e82a1eaa" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="63fe7b257c100f1c5547afa0ed45c504e0c7df3c34c33691065cac879a4f21bd" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="c29f8eff53e00a7450b2bf1f01e447f867b7dd310e64bf493b3c502637a649f9" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="57a467eb08865a1a6df903edb273efc7c798bc93bb2b9dde5a732d43e78c02a6" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="87dad0ea8a57e5ddf34cda536e1194e18dddc438418c846574af6ad7864bac34" name="apache2-utils" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="81a501f2d1e4b51c41c4b7b0431c2bd37b90a9e029198658a28100d5509cef3a" name="apache2-utils" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="3c13628920aa4232912f371b37b7f8cb11a9fbb51e2e0916cdb5b65b090be3ff" name="apache2-utils" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="5b041ac4d3d279dbe6dab084a4b5eeb89441d731fda5cbe71dc68127ce36c6de" name="apache2-utils" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="debce18dd58f747371cb36c335097cf15961563bddecf85ce89317b5f847818b" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="93f3fd81f066bd67bb320a68c2f64ebb2961bf1c51794d615297c7db8d0ed5f4" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="01e191c292afa45978ba04fa81d8f6036b86824c2d8f14d1ca4ce0aa5c8f6d2e" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="797ec49b212690406e40def8f0701d077502ef3b0ddf46f528a86b74cb21a164" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.22.1"/>
  <changelog author="pgajdos@suse.com" date="1571745600">- load private keys and certificates from pkcs11 token [SLE-7653]
- added patches
  load certificates from openssl engine
  + apache2-load-certificates-from-pkcs11.patch
  load private keys from openssl engine
  + apache2-load-private-keys-from-pkcs11.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
</package>
<package pkgid="735bacdf9e698bde359b82b923905a225fb181b467621cc4ff6952c3aca645d5" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="ad591f48d9b2014457ff882940cd91305562e4ed66c543ee3dec51b717ae375a" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="f35f1d75eef34b1649677e8d23272efb29dc9da4afa53f6d2c39a4cf601791ea" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="5adda4cf2ac2313b5b58048cd74dabbcdc78072ff0d18b23d26f4e2aec41628e" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.25.1"/>
  <changelog author="pgajdos@suse.com" date="1573214400">- use %license [bsc#1156171]</changelog>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
</package>
<package pkgid="47b8fbd6b5afe9557ec461e82909f606dc50a774951496b737792ee067605621" name="apache2-worker" arch="aarch64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="2a133c9943e8baf123e9410daafe29ae97ecb869a29ef73b7cd6d149cea8570c" name="apache2-worker" arch="ppc64le">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="b8f8c7036df8e43f19a5dda2472dbb12dca4f19b3cc8ffe8511065edc43d1756" name="apache2-worker" arch="s390x">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="8543b531ae96da6c5d7b245039ba0e07f87fcca0e85ccd4d67b7fba2471f2fcd" name="apache2-worker" arch="x86_64">
  <version epoch="0" ver="2.4.43" rel="3.32.1"/>
  <changelog author="pgajdos@suse.com" date="1576670400">- add openssl call to DEFAULT_SUSE comment [bsc#1159480]
- modified sources
  % apache2-ssl-global.conf</changelog>
  <changelog author="pgajdos@suse.com" date="1579521600">- apache2-devel now provides httpd-devel [bsc#1160100]</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1580472000">- define DEFAULT_LISTENBACKLOG=APR_INT32_MAX. We want apache
  to honour net.core.somaxconn sysctl as the mandatory limit.
  the old value of 511 was never used as until v5.4-rc6 it was
  clamped to 128, in current kernels the default limit is 4096.
  Cannot use the apr_socket_listen(.., -1) idiom because the function
  expects a positive integer argument.</changelog>
  <changelog author="pgajdos@suse.com" date="1581508800">- fix build for older distributions</changelog>
  <changelog author="pgajdos@suse.com" date="1581595200">- build mod_proxy_http2 extension</changelog>
  <changelog author="pgajdos@suse.com" date="1582027200">- require just libbrotli-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1582718400">- use r1874196 [SLE-7472] [bsc#1164820c#6]
- modified patches
  % apache2-load-private-keys-from-pkcs11.patch (upstream 2.4.x port)
- deleted patches
  - apache2-load-certificates-from-pkcs11.patch (merged to above)</changelog>
  <changelog author="pgajdos@suse.com" date="1585828800">- version update to 2.4.43
  * ) mod_ssl: Fix memory leak of OCSP stapling response. [Yann Ylavic]
  * ) mod_proxy_http: Fix the forwarding of requests with content body when a
    balancer member is unavailable; the retry on the next member was issued
    with an empty body (regression introduced in 2.4.41). PR63891.
    [Yann Ylavic]
  * ) mod_http2: Fixes issue where mod_unique_id would generate non-unique request
    identifier under load, see &lt;https://github.com/icing/mod_h2/issues/195&gt;.
    [Michael Kaufmann, Stefan Eissing]
  * ) mod_proxy_hcheck: Allow healthcheck expressions to use %{Content-Type}.
    PR64140. [Renier Velazco &lt;renier.velazco upr.edu&gt;]
  * ) mod_authz_groupfile: Drop AH01666 from loglevel "error" to "info".
    PR64172.
  * ) mod_usertrack: Add CookieSameSite, CookieHTTPOnly, and CookieSecure
    to allow customization of the usertrack cookie. PR64077.
    [Prashant Keshvani &lt;prashant2400 gmail.com&gt;, Eric Covener]
  * ) mod_proxy_ajp: Add "secret" parameter to proxy workers to implement legacy
    AJP13 authentication.  PR 53098. [Dmitry A. Bakshaev &lt;dab1818 gmail com&gt;]
  * ) mpm_event: avoid possible KeepAliveTimeout off by -100 ms.
    [Eric Covener, Yann Ylavic]
  * ) Add a config layout for OpenWRT. [Graham Leggett]
  * ) Add support for cross compiling to apxs. If apxs is being executed from
    somewhere other than its target location, add that prefix to includes and
    library directories. Without this, apxs would fail to find config_vars.mk
    and exit. [Graham Leggett]
  * ) mod_ssl: Disable client verification on ACME ALPN challenges. Fixes github
    issue mod_md#172 (https://github.com/icing/mod_md/issues/172).
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Stefan Eissing]
  * ) mod_ssl: use OPENSSL_init_ssl() to initialise OpenSSL on versions 1.1+.
    [Graham Leggett]
  * ) mod_ssl: Support use of private keys and certificates from an
    OpenSSL ENGINE via PKCS#11 URIs in SSLCertificateFile/KeyFile.
    [Anderson Sasaki &lt;ansasaki redhat.com&gt;, Joe Orton]
  * ) mod_md:
  - Prefer MDContactEmail directive to ServerAdmin for registration. New directive
    thanks to Timothe Litt (@tlhackque).
  - protocol check for pre-configured "tls-alpn-01" challenge has been improved. It will now
    check all matching virtual hosts for protocol support. Thanks to @mkauf.
  - Corrected a check when OCSP stapling was configured for hosts
    where the responsible MDomain is not clear, by Michal Karm Babacek (@Karm).
  - Softening the restrictions where mod_md configuration directives may appear. This should
    allow for use in &lt;If&gt; and &lt;Macro&gt; sections. If all possible variations lead to the configuration
    you wanted in the first place, is another matter.
    [Michael Kaufmann &lt;mail michael-kaufmann.ch&gt;, Timothe Litt (@tlhackque),
    Michal Karm Babacek (@Karm), Stefan Eissing (@icing)]
  * ) test: Added continuous testing with Travis CI.
    This tests various scenarios on Ubuntu with the full test suite.
    Architectures tested: amd64, s390x, ppc64le, arm64
    The tests pass successfully.
    [Luca Toscano, Joe Orton, Mike Rumph, and others]
  * ) core: Be stricter in parsing of Transfer-Encoding headers.
    [ZeddYu &lt;zeddyu.lu gmail.com&gt;, Eric Covener]
  * ) mod_ssl: negotiate the TLS protocol version per name based vhost
    configuration, when linked with OpenSSL-1.1.1 or later. The base vhost's
    SSLProtocol (from the first vhost declared on the IP:port) is now only
    relevant if no SSLProtocol is declared for the vhost or globally,
    otherwise the vhost or global value apply.  [Yann Ylavic]
  * ) mod_cgi, mod_cgid: Fix a memory leak in some error cases with large script
    output.  PR 64096.  [Joe Orton]
  * ) config: Speed up graceful restarts by using pre-hashed command table. PR 64066.
    [Giovanni Bechis &lt;giovanni paclan.it&gt;, Jim Jagielski]
  * ) mod_systemd: New module providing integration with systemd.  [Jan Kaluza]
  * ) mod_lua: Add r:headers_in_table, r:headers_out_table, r:err_headers_out_table,
    r:notes_table, r:subprocess_env_table as read-only native table alternatives
    that can be iterated over. [Eric Covener]
  * ) mod_http2: Fixed rare cases where a h2 worker could deadlock the main connection.
    [Yann Ylavic, Stefan Eissing]
  * ) mod_lua: Accept nil assignments to the exposed tables (r.subprocess_env,
    r.headers_out, etc) to remove the key from the table. PR63971.
    [Eric Covener]
  * ) mod_http2: Fixed interaction with mod_reqtimeout. A loaded mod_http2 was disabling the
    ssl handshake timeouts. Also, fixed a mistake of the last version that made `H2Direct`
    always `on`, regardless of configuration. Found and reported by
    &lt;Armin.Abfalterer@united-security-providers.ch&gt; and
    &lt;Marcial.Rion@united-security-providers.ch&gt;. [Stefan Eissing]
  * ) mod_http2: Multiple field length violations in the same request no longer cause
    several log entries to be written. [@mkauf]
  * ) mod_ssl: OCSP does not apply to proxy mode.  PR 63679.
    [Lubos Uhliarik &lt;luhliari redhat.com&gt;, Yann Ylavic]
  * ) mod_proxy_html, mod_xml2enc: Fix build issues with macOS due to r1864469
    [Jim Jagielski]
  * ) mod_authn_socache: Increase the maximum length of strings that can be cached by
    the module from 100 to 256.  PR 62149 [&lt;thorsten.meinl knime.com&gt;]
  * ) mod_proxy: Fix crash by resolving pool concurrency problems. PR 63503
    [Ruediger Pluem, Eric Covener]
  * ) core: On Windows, fix a start-up crash if &lt;IfFile ...&gt; is used with a path that is not
    valid (For example, testing for a file on a flash drive that is not mounted)
    [Christophe Jaillet]
  * ) mod_deflate, mod_brotli: honor "Accept-Encoding: foo;q=0" as per RFC 7231; which
    means 'foo' is "not acceptable".  PR 58158 [Chistophe Jaillet]
  * ) mod_md v2.2.3:
  - Configuring MDCAChallenges replaces any previous existing challenge configuration. It
    had been additive before which was not the intended behaviour. [@mkauf]
  - Fixing order of ACME challenges used when nothing else configured. Code now behaves as
    documented for `MDCAChallenges`. Fixes #156. Thanks again to @mkauf for finding this.
  - Fixing a potential, low memory null pointer dereference [thanks to @uhliarik].
  - Fixing an incompatibility with a change in libcurl v7.66.0 that added unwanted
    "transfer-encoding" to POST requests. This failed in directy communication with
    Let's Encrypt boulder server. Thanks to @mkauf for finding and fixing. [Stefan Eissing]
  * ) mod_md: Adding the several new features.
    The module offers an implementation of OCSP Stapling that can replace fully or
    for a limited set of domains the existing one from mod_ssl. OCSP handling
    is part of mod_md's monitoring and message notifications. If can be used
    for sites that do not have ACME certificates.
    The url for a CTLog Monitor can be configured. It is used in the server-status
    to link to the external status page of a certicate.
    The MDMessageCmd is called with argument "installed" when a new certificate
    has been activated on server restart/reload. This allows for processing of
    the new certificate, for example to applications that require it in different
    locations or formats.
    [Stefan Eissing]
  * ) mod_proxy_balancer: Fix case-sensitive referer check related to CSRF/XSS
    protection. PR 63688. [Armin Abfalterer &lt;a.abfalterer gmail.com&gt;]
- deleted patches
  - apache2-load-private-keys-from-pkcs11.patch (upstreamed)
  - httpd-2.4.3-mod_systemd.patch (upstreamed)</changelog>
  <changelog author="pgajdos@suse.com" date="1585915200">- declare ap_sock_disable_nagle to fix loading mod_proxy_http2
  (thanks to mliska@suse.com)
- modified patches
  % httpd-visibility.patch (refreshed)</changelog>
  <changelog author="pgajdos@suse.com" date="1594814400">- fix crash in mod_proxy_uwsgi for empty values of environment
  variables [bsc#1174052]
- added patches
  fix https://svn.apache.org/viewvc?view=revision
  + apache2-mod_proxy_uwsgi-fix-crash.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1597147200">- security update
- added patches
  fix CVE-2020-11984 [bsc#1175074], mod_proxy_uwsgi info disclosure and possible RCE
  + apache2-CVE-2020-11984.patch
  fix CVE-2020-11993 [bsc#1175070], CVE-2020-9490 [bsc#1175071]
  + apache2-mod_http2-1.15.14.patch</changelog>
  <changelog author="jtomasiak@suse.com" date="1598875200">- gensslcert: add -a argument to override default SAN value</changelog>
  <changelog author="fbui@suse.com" date="1602676800">- systemd-ask-password is located in /usr/bin</changelog>
  <changelog author="pgajdos@suse.com" date="1610452800">- gensslcert sets CA:TRUE in basic constrains of CA cert [bsc#1180530]
- modified sources
  % gensslcert</changelog>
  <changelog author="pgajdos@suse.com" date="1623153600">- security update
- added patches
  fix CVE-2020-35452 [bsc#1186922], Single zero byte stack overflow in mod_auth_digest
  + apache2-CVE-2020-35452.patch
  fix CVE-2021-26690 [bsc#1186923], mod_session NULL pointer dereference in parser
  + apache2-CVE-2021-26690.patch
  fix CVE-2021-26691 [bsc#1187017], Heap overflow in mod_session
  + apache2-CVE-2021-26691.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240000">- security update
- added patches
  fix CVE-2020-13950 [bsc#1187040], mod_proxy NULL pointer dereference
  + apache2-CVE-2020-13950.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623240001">- security update
- added patches
  fix CVE-2021-31618 [bsc#1186924], NULL pointer dereference on specially crafted HTTP/2 request
  + apache2-CVE-2021-31618.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1623412800">- security update
- added patches
  fix CVE-2021-30641 [bsc#1187174], MergeSlashes regression
  + apache2-CVE-2021-30641.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1628856000">- security update
- added patches
  fix CVE-2021-33193 [bsc#1189387], Request splitting via HTTP/2 method injection and mod_proxy
  + apache2-CVE-2021-33193.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1632312000">- security update
- added patches
  fix CVE-2021-40438 [bsc#1190703], SSRF via a crafted request uri-path
  + apache2-CVE-2021-40438.patch
  fix CVE-2021-36160 [bsc#1190702], out-of-bounds read via a crafted request uri-path
  + apache2-CVE-2021-36160.patch
  fix CVE-2021-39275 [bsc#1190666], out-of-bounds write in ap_escape_quotes() via malicious input
  + apache2-CVE-2021-39275.patch
  fix CVE-2021-34798 [bsc#1190669], NULL pointer dereference via malformed requests
  + apache2-CVE-2021-34798.patch</changelog>
</package>
<package pkgid="4f6d22b7ca932c597b562d3762e666d48e89e4c291f3de3ced3e0e9338f7fbdc" name="apparmor" arch="src">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="b8457769125ed17f4141007adba2f0d14774e428e2d6159f426f9a3195440319" name="apparmor-abstractions" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="d95c3233b7660eea26d30c4ae055a72b823fb21854651b7df20a721ebe58f82d" name="apparmor-docs" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="d73df644b715d5904df8eaf2e5826fae914c0426ed402c63e218b9a6601e4256" name="apparmor-parser" arch="aarch64">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="a5f0681eceef585ce974a3531bade29dd084f9096551512d09049692198eff0f" name="apparmor-parser" arch="ppc64le">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="af62dd0eadc4e761ce7fca4ed27aa2b1954b5a815d84c590010f04381aaf048a" name="apparmor-parser" arch="s390x">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="386f995c8f88b602cbabdd8b23c1006c54d4f43b6161e209bbcecde1098213dc" name="apparmor-parser" arch="x86_64">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="dedca84eddf75c1610aa138dc7787e56f0ba2888c9786da72ad3c802144be0be" name="apparmor-parser-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="1ae108ede9fba5ab1c008e105bd82a9e1f19f66799fa05be050ab38ce5c6c750" name="apparmor-profiles" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="70efd6120f2d6d02445421d939d8fe764a16537fb7fcd36103fad2cf76fec8d8" name="apparmor-utils" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="e63d991ed10608b077ae4961c91ca3a3920b317eb24fb3c36822018920935ca8" name="apparmor-utils-lang" arch="noarch">
  <version epoch="0" ver="2.13.6" rel="3.3.1"/>
  <changelog author="luizluca@tre-sc.jus.br" date="1569585600">- add apparmor-krb5-conf-d.diff for kerberos client</changelog>
  <changelog author="suse-beta@cboltz.de" date="1569672000">- add abstractions-ssl-certbot-paths.diff - add certbot paths to
  abstractions/ssl_certs and abstractions/ssl_keys</changelog>
  <changelog author="suse-beta@cboltz.de" date="1570449600">- add usr-etc-abstractions-authentification.diff to allow reading
  /usr/etc/pam.d/* and some other authentification-related files (boo#1153162)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1572696000">- add libapparmor-python3.8.diff to fix building the libapparmor python
  bindings (deb#943657)</changelog>
  <changelog author="tchvatal@suse.com" date="1574078400">- Properly pull in full python3 interpreter</changelog>
  <changelog author="suse-beta@cboltz.de" date="1579953600">- add usr-etc-abstractions-base-nameservice.diff to adjust
  abstractions/base and nameservice for /usr/etc/ (boo#1161756)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1584014400">- update to AppArmor 2.13.4
  - several abstraction updates (including boo#1153162)
  - disallow writing to fontconfig cache in abstractions/fonts
  - some bugfixes in the aa-* tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.4
    for the detailed upstream changelog
- drop upstreamed patches:
  - abstractions-ssl-certbot-paths.diff
  - apparmor-krb5-conf-d.diff
  - libapparmor-python3.8.diff
  - usr-etc-abstractions-authentification.diff
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1585396800">- fix build with make 4.3 by backporting some commits from upstream
  master (boo#1167953):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-network.diff
  - make-4.3-fix-utils-network-test.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1586433600">- Add abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
  (bsc#1168306)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1590062400">- add changes-since-2.13.4.diff with upstream changes and fixes
  since 2.13.4 up to 5f61bd4c:
  - add several abstractions related to xdg-open:
    dbus-network-manager-strict, exo-open, gio-open, gvfs-open,
    kde-open5, xdg-open
  - introduce @{run} variable
  - update dnsmasq and winbindd profile
  - update mdns, mesa and nameservice abstraction
  - some bugfixes in the aa-* tools, including a remote bugfix in the
    YaST AppArmor module (boo#1171315)
- drop upstream(ed) patches (now part of changes-since-2.13.4.diff):
  - make-4.3-capabilities.diff
  - make-4.3-capabilities-vim.diff
  - make-4.3-fix-utils-network-test.diff
  - make-4.3-network.diff
  - abstractions-add-etc-mdns.allow-to-etc-apparmor.d-abstractions-mdns.patch
- apply usr-etc-abstractions-base-nameservice.diff only for
  Tumbleweed, but not for Leap 15.x where it's not needed
- refresh usr-etc-abstractions-base-nameservice.diff</changelog>
  <changelog author="suse-beta@cboltz.de" date="1595246400">- add abstractions-X-xauth-mr582.diff to allow reading the xauth file
  from its new sddm location (boo#1174290, boo#1174293)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1596801600">- sevdb-caps-mr589.diff: add new capabilities CAP_BPF and CAP_PERFMON
  to severity.db (lp#1890547)</changelog>
  <changelog author="jfehlig@suse.com" date="1599134400">- libvirt-leaseshelper.patch: add /usr/libexec as a path to the
  libvirt leaseshelper script (jsc#SLE-14253)</changelog>
  <changelog author="fbui@suse.com" date="1599825600">- Make use of %service_del_postun_without_restart
  And stop using DISABLE_RESTART_ON_UPDATE as this interface is
  obsolete.</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602158400">- %service_del_postun_without_restart only works for Tumbleweed,
  keep using DISABLE_RESTART_ON_UPDATE for Leap 15.x</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602676800">- add CAP_CHECKPOINT_RESTORE to severity.db (MR 656,
  cap_checkpoint_restore.diff)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1602936000">- update to AppArmor 2.13.5
  - add missing permissions to several profiles and abstractions
  - bugfixes in parser and tools
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.5
    for the detailed upstream changelog
- remove upstream(ed) patches
  - changes-since-2.13.4.diff
  - abstractions-X-xauth-mr582.diff
  - sevdb-caps-mr589.diff
  - libvirt-leaseshelper.patch
  - cap_checkpoint_restore.diff
- add libapparmor-so-number.diff to fix libapparmor so version (!658)</changelog>
  <changelog author="suse-beta@cboltz.de" date="1607515200">- update to AppArmor 2.13.6
  - fix utils hotkey conflicts in some languages
  - aa-autodep: load abstractions on start (boo#1178527)
  - add usr.lib.dovecot.script-login profile
  - minor additions in abstractions/X and the dovecot profile
  - see https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_2.13.6
    for the detailed upstream changelog
- drop upstreamed patch libapparmor-so-number.diff</changelog>
  <changelog author="mcepl@suse.com" date="1634040000">- Be explicit about using python2 macros, when needed.</changelog>
  <changelog author="mcepl@suse.com" date="1634299200">- Don't provide python2 symbol for python3 package (bsc#1191690).</changelog>
</package>
<package pkgid="b3faf7848b4830522d71df5092fb303127afdb370834995baea9c6bc163a2cdd" name="arpwatch" arch="aarch64">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="8acd2954a946e4cca7e4a5ce00cfee555f9be79fcf6e6772637d404de4b43cbe" name="arpwatch" arch="ppc64le">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="895c3c9f5f5bc9b9b0c36e759c7ea8354735aa2fe67aa43c615a0c2d86009dd1" name="arpwatch" arch="s390x">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="8be6b12d08320d3c0ff7f2bb521dcf997f97fc234e46e2b1be42846e3cdc2bcd" name="arpwatch" arch="src">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="meissner@suse.de" date="1113825600">- Use RPM_OPT_FLAGS.</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="lrupp@suse.de" date="1179144000">- update to 2.1a15
  + let the database files belong to the package
  + build parallel
  + use rpm macros for configure and make</changelog>
  <changelog author="prusnak@suse.cz" date="1185451200">- changed libpcap to libpcap-devel in BuildRequires</changelog>
  <changelog author="draht@suse.de" date="1226491200">- start script tuned for multiple interface support and independent
  databases. #149003</changelog>
  <changelog author="draht@suse.de" date="1226491201">- arpwatch-2.1a11-emailaddr.dif for flexibility in sender and
  recipient addresses on commandline.
- arpwatch-2.1a11-drop-privs.dif to run arpwatch as different user
- arpwatch-2.1a11-drop-privs-manpage.dif for the manpage</changelog>
  <changelog author="mseben@novell.com" date="1259323200">- added ARPDIR to build section in spec file, to fix error message
  in logs</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="draht@suse.de" date="1342612800">- arpwatch-2.1a11-drop-privs.dif: call initgroups() with pw-&gt;pw_gid,
  not NULL, to not have groupid 0 initialized. [bnc#764521]</changelog>
  <changelog author="p.drouand@gmail.com" date="1363262400">- Drop sysvinit support and add systemd support for opensuse &gt; 11.4</changelog>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="b345c507fd6b53a2a1b803a9c6f19c1064f349295395cc82c02da3c9a51ef41c" name="arpwatch" arch="x86_64">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="a533b3094d32dd321f7dd02211db1622c8f1dcef2a50e3fb7136b23dca2327b0" name="arpwatch-ethercodes-build" arch="aarch64">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="591d821e429b3f65759ca652ab99846944edacdc9d2504ea0cc30d919df71ce7" name="arpwatch-ethercodes-build" arch="ppc64le">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="8cda9df16e693c7d98c252eebbd9de4ff4d9154bf657587537d314c298f91514" name="arpwatch-ethercodes-build" arch="s390x">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="345a168e80fbb2b7d832725268d22dba8294665a8b2fd10458a1da0d35ef8212" name="arpwatch-ethercodes-build" arch="x86_64">
  <version epoch="0" ver="2.1a15" rel="5.12.1"/>
  <changelog author="rmilasan@suse.com" date="1389096000">- Rework arpwatch.service file to properly support multiple network
  interfaces and arpwatch sysconfig file. (bnc#853384).</changelog>
  <changelog author="meissner@suse.com" date="1400068800">- added missing %pre/%service_add_pre section</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from arpwatch@.service file.</changelog>
  <changelog author="lmuelle@suse.com" date="1434715200">- Deal with added two whitespaces in more recent oui.txt versions.
  + arpwatch-2.1a15-massagevendor.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1502539200">- Remove initscript support. Fix the service initialization to\
  either allow single full client or user has to symlink the instance
  and make sure he can run only one of them. bsc#737527
- Make sure rcarpwatch is working
- Use install commands for installation of files
- Format with spec-cleaner
- Generate temp files using systemd</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="jsegitz@suse.com" date="1549368000">- added getnameinfo.patch to prevent memory leak in gethname
  (bsc#1119851)</changelog>
  <changelog author="jsegitz@suse.com" date="1611835200">- Include arp2ethers script (jsc#SLE-17224)</changelog>
  <changelog author="jsegitz@suse.com" date="1612872000">- Fix arp2ethers script (bsc#1181936). Added arp2ethers.patch to
  inline the awk fragments.</changelog>
  <changelog author="jsegitz@suse.com" date="1623672000">- Fixed local privilege escalation from runtime user to root
  (bsc#1186240, CVE-2021-25321)</changelog>
</package>
<package pkgid="24987b0b73219aabd742c6daa620c8c64c25c3a85c0dce8f9683877a1e1c4708" name="aspell" arch="aarch64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="e12989037a55dedf7c4ae9d199d32640f485d287eae968a4a77748438401b33b" name="aspell" arch="ppc64le">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="27965ad0d0cf7b0cbaad177236bfd53b89da5b4c7daf70c0e95e5e5683b2b7e0" name="aspell" arch="s390x">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="7af3bc840843ac153efc6e98b98165554e8f3aa066cb393003e3aa26ccdc41ec" name="aspell" arch="src">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="pgajdos@suse.cz" date="1248091200">- fixed invalid iterator [bnc#523345]</changelog>
  <changelog author="jengelh@medozas.de" date="1261137600">- add baselibs.conf as a source</changelog>
  <changelog author="coolo@suse.com" date="1317384000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="asterios.dramis@gmail.com" date="1317556800">- update to version 0.60.6.1
  * Update to Automake 1.10.3.
  * Fix a bug which caused a race condition (leading to a likely crash)
    when two threads try to update the dictionary cache at the same
    time.
  * Make it very clear that compiling Aspell with NDEBUG is a bad idea
    (see `http://aspell.net/ndebug.html') by outputting a warning when
    building with NDEBUG defined.
  * Numerous other minor updates and bug fixes.
- Spec file updates:
  * Changes based on spec-cleaner run.
  * Changed License: to LGPL-2.1+.
  * Splitted the package according to the shared library packaging policy
    (added libaspell15 and libpspell15 sub-packages).
  * Added descriptions for the patches based on openSUSE guidelines.
  * Suggest also aspell-spell sub-package.
  * Added versioned Provides:/Obsoletes: for pspell and pspell-devel (rpmlint
    warning fix).
  * Removed libstdc++-devel from Requires: of aspell-devel (not needed).
  * Improved summaries and descriptions.
  * Clean up in %build, %install and %files sections.
  * Install the "spell" script provided by the package for compatibility
    reasons (added a aspell-spell sub-package containing this script and moved
    the Provides: entry for "spell" into this package).
  * Use %fdupes macro to fix rpmlint warning about duplicate files.
  * Use %install_info_delete in %preun instead of %postun section.
  * Add pspell-config.1 man page to the aspell-devel sub-package instead of
    aspell.
- Removed the following patches (fixed upstream):
  * aspell-iterator-after-erase.patch
  * aspell-make-static-filters.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1321963200">- add -ltinfo</changelog>
  <changelog author="jengelh@medozas.de" date="1327752000">- Remove redundant tags/sections per specfile guideline suggestions</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1330084800">- Build C++ code with -fvisibility-inlines-hidden
- Fix ncurses linkage.</changelog>
  <changelog author="pgajdos@suse.com" date="1349784000">- license FDL-1.1+ and LGPL-2.1 and HPND and BSD-Mark-Modifications</changelog>
  <changelog author="pgajdos@suse.com" date="1362052800">- fix build with new automake
  * automake-1.13.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1362398400">- license GFDL-1.1+ and LGPL-2.1 and HPND and BSD-Mark-Modifications</changelog>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="460a84ca1b59be5a143ee10d771b73841fe1191b42ec1a0e77c02502e730b9c9" name="aspell" arch="x86_64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="ee5008fed95de2d39a6aa5798c8fb791eb708d6a33c83b1a4c2821141c8acb8f" name="aspell-devel" arch="aarch64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="4b22fac26e2c77790d4c30cea6324a44dcafb31fd1774465ef922216479acbe4" name="aspell-devel" arch="ppc64le">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="f5044f0b00bc68bf47c1133b6c8201e49ed56d23e12233bd44455e9c88bcbe60" name="aspell-devel" arch="s390x">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="60b4239e283ee37ded36856522e4f50401f54b0bac796790fad0d964a1bcb447" name="aspell-devel" arch="x86_64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="23ab80e0044bb1d65912848b0c1eeacd5ccb03688efaf44a249145aa564b390f" name="aspell-ispell" arch="aarch64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="7a56520b7f65c42a4cf3576c3c1de7cbc5d992679de7f340062be1cf47e41630" name="aspell-ispell" arch="ppc64le">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="167de1aba92e45ec2345eb4ab0491e6f4f7211f47a8024ec32d70b4bd476b67f" name="aspell-ispell" arch="s390x">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="350238c2dfc49559ba2ab4915b3c1e4d9afe5e9431c4ce7e0f88aba27d3a1db5" name="aspell-ispell" arch="x86_64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="af17c4cade47588297cd05605e645ff6b2aa971d85380b4ec001ff8b6a7506a4" name="aspell-spell" arch="aarch64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="f0e14b94c6af53e4b7c9bb0e1f4190975d6a5441202e4db50956d9b372431df1" name="aspell-spell" arch="ppc64le">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="92e96c42bd1f19889dba39d724e6822cb2e7ef973d9e038c52e43a2732c6d5e9" name="aspell-spell" arch="s390x">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="e0abc79ec65bb8e35d03b0f64301fee5e8a9ff584179a47a5a1138b0e5aa6ece" name="aspell-spell" arch="x86_64">
  <version epoch="0" ver="0.60.8" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1362571200">- license update: GFDL-1.1+ and LGPL-2.1 and HPND and BSD-3-Clause
  SDPX</changelog>
  <changelog author="pgajdos@suse.com" date="1362571201">- license GFDL-1.1+ and LGPL-2.1 and HPND and SUSE-BSD-Mark-Modifications
  [bnc#777131]</changelog>
  <changelog author="pgajdos@suse.com" date="1397476800">- baselibs.conf: libaspell15
  obsoletes "aspell-&lt;targettype&gt; &lt;= &lt;version&gt;"
  provides "aspell-&lt;targettype&gt; = &lt;version&gt;"</changelog>
  <changelog author="mpluskal@suse.com" date="1449057600">- Add gpg signature
- Remove old ppc provides/obsoletes
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix-warnings.patch - Fix warnings reported by GCC7.</changelog>
  <changelog author="jengelh@inai.de" date="1486814400">- Compact descriptions</changelog>
  <changelog author="pgajdos@suse.com" date="1571140800">- version update to 0.60.8
  * Prevent a potentially unbounded buffer over-read by no longer
  supporting null-terminated UCS-2 and UCS-4 encoded strings with the
  original C API. @xref{Upgrading from Aspell 0.60.7}.
  * Ensure that possible typos are listed before other suggestions when
  typo analysis is used.  Also fix a bug so that suggestions that split
  a word using a space or hyphen are not always first.
  * Add Markdown filter.
  * Add new @option{wordlists} option, which is a list of UTF-8 files that
  contain additional words to accept.
  * Add new @option{camel-case} option, which enables support for checking
  camelCase words.
  * Sort personal and replacement dictionaries.
  * Change @code{ultra} suggestion mode to only find words that are within
  one-edit distance or have the same soundslike.
  * Implement the @code{aspell filter} command.
  * Fix a bug in @code{AspellDocumentChecker} that prevented it from
  working with UCS-2 and UCS-4 encoded strings.
  * Remove unused @option{sug-edit-dist} option.
  * @code{AspellDocumentChecker} now expects the document a line at a time
  in order to work with the new Markdown filter.  If the document is
  split on white space characters instead, nothing will break, but new
  filters such as the Markdown filter may give incorrect results.
  * The @option{clean} option and command will no longer split a word.
  * Various documentation improvements.
  * Removal of several outdated appendices that don't really belong in the
  main manual.  Parts that are still relevent may eventually be moved
  elsewhere, but for now they are available online at
  @uref{http://aspell.net/0.60.7/man-html/}.
  * Fix various crashes and other problems found by Google's OSS-Fuzz.
  * Add partial support for recognizing the Unicode apostrophe (') in
  words.  In particular Aspell will accept the Unicode apostrophe when
  the language uses an ISO Latin charset that doesn't already have a
  Unicode apostrophe.  For now, Aspell will still use the ASCII version
  in suggestions.
  * Detect when a dictionary compiled on a 32-bit machine is used on a
  64-bit one (and vise versa), as due to an oversight, compiled
  dictionaries depend on more than the endianness.  Also added a compile
  time option to remove this dependency, but at the cost of breaking
  compatibility with already compiled dictionaries on 64-bit systems.
  * Fix a bug which caused Aspell to crash when passing in a null string
  to almost any of the C API functions.  This should not happen if the
  size is also zero as the pointer should never be derefrenced.
  * Fix a bug that caused Aspell to crash with a SEGFAULT when built with
  mingw-w64.
  * In addition to outputting a warning when building with NDEBUG defined,
  also include NDEBUG in the version string.
  * Various compile fixes for newer version of Gcc and Clang.
  * Fix VPATH builds.
  * Use utf-8 encoding for manual instead of iso-8859-1.
  * Other minor updates and bug fixes.
- deleted patches
  - aspell-automake-1.13.patch (upstreamed)
  - aspell-epmty_file.patch (upstreamed, bsc#266130 does not exhibit)
  - gcc7-fix-warnings.patch (upstreamed)</changelog>
  <changelog author="jengelh@inai.de" date="1602158400">- Remove/replace old specfile constructs.</changelog>
  <changelog author="pgajdos@suse.com" date="1602244800">- recommend aspell-en also from the library [bsc#1177523]</changelog>
  <changelog author="pgajdos@suse.com" date="1627905600">- security update
- modified patches
  % aspell-quotes.patch (p1)
  % aspell-strict-aliasing.patch (p1)
- added patches
  fix CVE-2019-25051 [bsc#1188576], heap-buffer-overflow in acommon:ObjStack:dup_top
  + aspell-CVE-2019-25051.patch</changelog>
</package>
<package pkgid="5fb08c16d8b6a1153367a10fa5137cfe613d5664a3c112556243dc5648ede62c" name="augeas" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="b6f7e83c95c477c6d4a787ebeafeb1727d600799ffb5ef7b1a4eb46ca41c3bea" name="augeas" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="ca22058becae0ec862ec8b773340ceac9e385c4e65af4d26bb0414c74d164b34" name="augeas" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="d66105deb6f63f91f0abb9ff2f70547ac03ba459855aa101b0b6a3a057a82811" name="augeas" arch="src">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="cfarrell@suse.com" date="1349870400">- license update: GPL-3.0+ and LGPL-2.1+
  semicolon is ambiguous</changelog>
  <changelog author="poelzleithner@b1-systems.de" date="1365336000">- update to 1.0.0
  - drop bnc-729491-recognize-suse-sysconfig-files.patch:
    upstream ShellVars lense now uses /etc/sysconfig/* include filter
  - drop patches, now upstream: augeas-pkgdeps.diff, augeas-stdio.h.patch</changelog>
  <changelog author="p.drouand@gmail.com" date="1386676800">- Update to version 1.1.0
  - Handle files with special characters in their name, bug #343
  - Fix type error in composition ('f; g') of functions, bug #328
  - Improve detection of version script; make build work on Illumos with
    GBU ld (Igor Pashev)
  - augparse: add --trace option to print filenames of all modules being
    loaded
  - Various lens documentation improvements (Jasper Lievisse Adriaanse)
  - Lens changes/additions
  - ActiveMQ_*: new lens for ActiveMQ/JBoss A-MQ (Brian Harrington)
  - AptCacherNGSecurity: new lens for /etc/apt-cacher-ng/security.conf
    (Erik Anderson)
  - Automaster: accept spaces between options
  - BBHosts: support more flags and downtime feature (Mathieu Alorent)
  - Bootconf: new lens for OpenBSD's /etc/boot.conf (Jasper Adriaanse)
  - Desktop: Support dos eol
  - Dhclient: read /etc/dhclient.conf used in OpenBSD (Jasper Adriaanse)
  - Dovecot: New lens for dovecot configurations (Serge Smetana)
  - Fai_Diskconfig: Optimize some regexps
  - Fonts: exclude all README files (Jasper Adriaanse)
  - Inetd: support IPv6 addresses, bug #320
  - IniFile: Add lns_loose and lns_loose_multiline definitions
    Support smart quotes
    Warning: Smart quotes support means users should not add
    escaped double quotes themselves. Tests need to be fixed
    also.
    Use standard Util.comment_generic and Util.empty_generic
    Warning: Existing lens tests must be adapted to use standard
    comments and empty lines
    Allow spaces in entry_multiline* values
    Add entry_generic and entry_multiline_generic
    Add empty_generic and empty_noindent
    Let multiline values begin with a single newline
    Support dos eol
    Warning: Support for dos eol means existing lenses usually
    need to be adapted to exclude \r as well as \n.
  - IPRoute2: Support for iproute2 files (Davide Guerri)
  - JaaS: lens for the Java Authentication and Authorization Service
    (Simon Vocella)
  - JettyRealm: new lens for jetty-realm.properties (Brian Harrington)
  - JMXAccess, JMXPassword: new lenses for ActiveMQ's JMX files
    (Brian Harrington)
  - Krb5: Use standard comments and empty lines
    Support dos eol
    Improve performance
    Accept pkinit_anchors (Andrew Anderson)
  - Lightdm: Use standard comments and empty lines
  - LVM: New lens for LVM metadata (Gabriel)
  - Mdadm_conf: optimize some regexps
  - MongoDBServer: new lens (Brian Harrington)
  - Monit: also load /etc/monitrc (Jasper Adriaanse)
  - MySQL: Use standard comments and empty lines
    Support dos eol
  - NagiosCfg: handle Icinga and resources.cfg (Jasper Adriaanse)
  - Nrpe: accept any config option rather than predefined list (Gonzalo
    Servat); optimize some regexps
  - Ntpd: new lense for OpenNTPD config (Jasper Adriaanse)
  - Odbc: Use standard comments and empty lines
  - Openshift_*: new lenses for Openshift support (Brian Harrington)
  - Quote: allow multiple spaces in quote_spaces; improve docs
  - Passwd: allow period in user names in spec, bug #337; allow overrides
    in nisentry
  - PHP: Support smart quotes
    Use standard comments and empty lines
    Load /etc/php*/fpm/pool.d/*.conf (Enrico Stahn)
  - Postfix_master: allow [] in words, bug #345
  - Resolv: support 'lookup' and 'family' key words, bug #320
    (Jasper Adriaanse))
  - Rsyslog: support :omusrmsg: list of users in actions
  - RX: add CR to RX.space_in
  - Samba: Use standard comments and empty lines
    Support dos eol
  - Schroot: Support smart quotes
  - Services: support port ranges (Branan Purvine-Riley)
  - Shellvars: optimize some regexps; reinstate /etc/sysconfig/network,
    fixes bug #330, RHBZ#904222, RHBZ#920609; parse /etc/rc.conf.local
    from OpenBSD
  - Sip_Conf: New lens for sip.conf configurations (Rob Tucker)
  - Splunk: new lens (Tim Brigham)
  - Subversion: Support smart quotes
    Use standard comments and empty lines
    Use IniFile.entry_multiline_generic
    Use IniFile.empty_noindent
    Support dos eol
  - Sudoers: allow user aliases in specs
  - Sysctl: exclude README file
  - Systemd: Support smart quotes; allow backslashes in values
  - Xinetd: handle missing values in list, bug #307
  - Xorg: allow 'Screen' in Device section, bug #344
  - Yum: Support dos eol, optimize some regexps</changelog>
  <changelog author="meissner@suse.com" date="1386936000">- download url changed, also added keyring and .sig ring</changelog>
  <changelog author="mlatimer@suse.com" date="1399291200">- device_map lense: Find device.map in any dir beneath /boot (bnc#875086)
  augeas-device_map-grub2.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1399377600">- Add check phase, comment out as 2 test fails now.
- Clean up with spec-cleaner
- Version bump to 1.2.0:
  - API changes
  * Add aug_cp and the cp and copy commands
  * aug_to_xml now includes span information in the XML dump
  - General changes/additions
  * Fix documentation link in c_api NaturalDocs menu
  * Fix NaturalDocs documentation for various lenses
  * src/transform.c (filter_matches): wrap fnmatch to ensure that an incl
    pattern containing "//" matches file paths, RHBZ#1031084
  * Correct locations table for transform_save() (Tomas Hoger)
  * Corrections for CVE-2012-0786 tests (Tomas Hoger)
  * Fix umask handling when creating new files, RHBZ#1034261
  - Lens changes/additions
  * Access: support DOMAIN\user syntax for users and groups, bug #353
  * Authorized_Keys: Allow 'ssh-ed25519' as a valid authorized_key
    type (Jasper Lievisse Adriaanse)
  * Automounter: Handle hostnames with dashes in them, GH issue #27
  * Build: Add combinatorics group
  * Cyrus_Imapd: Create new entries without space before separator,
    RHBZ#1014974 (Dietmar Kling)
  * Desktop: Support square brackets in keys
  * Dhclient: Add dhclient.conf path for Debian/Ubuntu (Esteve Fernandez)
  * Dhcpd: Support conditionals, GH issue #34
    Support a wider variety of allow/deny statement, including
    booting and bootp (Yanis Guenane)
    Support a wider variety of DHCP allow/deny/ignore statements
    (Yanis Guenane)
  * Dovecot: Various enhancements and bug fixes (Michael Haslgrübler):
    add mailbox to block_names, fix for block_args in quotes,
    fix for block's brackets upon write,
    fixes broken tests for mailbox,
    fixes indention,
    test case for block_args with ",
    fixes broken indention
    Use Quote module
  * Exports: Permit colons for IPv6 client addresses, bug #366
  * Grub: Support the 'setkey' and 'lock' directives
    NFC fix whitespace errors
    Handle makeactive menu command, bug #340
    Add 'verbose' option, GH issue #73
  * Interfaces: Add in support for the source stanza in
    /etc/network/interfaces files
    Map bond-slaves and bridge-ports to arrays (incompatible
    change) (Kaarle Ritvanen)
    Add /etc/network/interfaces.d/* support
    Allow numeric characters in stanza options (Pascal Lalonde)
  * Koji: New lens to parse Koji configs (Pat Riehecky)
  * MongoDBServer: Accept quoted values (Tomas Klouda)
  * NagiosCfg: Do not try to parse /etc/nagios/nrpe.cfg anymore, GH issue #43
    /etc/nagios/nrpe.cfg is parsed by Nrpe (Yanis Guenane)
  * Nagiosobjects: Add support for optional spaces and indents
    and whole-line comments (Sean Millichamp)
  * OpenVPN: Support daemon, client-config-dir, route, and management
    directives (Freakin https://github.com/Freakin)
  * PHP: allow php-fpm syntax in keys, GH issue #35
  * Postfix_Main: Handle stray whitespace at end of multiline lines, bug #348
  * Postfix_virtual: allow '+' and '=' in email addresses (Tom Hendrikx)
  * Properties: support multiline starting with an empty string, GH issue #19
  * Samba: Permit asterisk in key name, bug #354
  * Shellvars: Read /etc/firewalld/firewalld.conf, bug #363
    Support all types of quoted strings in arrays, bug #357
    Exclude /etc/sysconfig/ip*tables.save files
  * Shellvars, Sysconfig: map "bare" export and unset lines to seq numbered
    nodes to handle multiple variables (incompatible change), RHBZ#1033795
  * Shellvars_list: Handle backtick variable assignments, bug #368
    Allow end-of-line comments, bug #342
  * Simplevars: Add /etc/selinux/semanage.conf
  * Slapd: use smart quotes for database entries; rename by/what to by/access;
    allow access to be absent as per official docs (incompatible change)
  * Sshd: Indent Match entries by 2 spaces by default
    Support Ciphers and KexAlgorithms groups, GH issue #69
    Let all special keys be case-insensitive
  * Sudoers: Permit underscores in group names, bug #370 (Matteo Cerutti)
    Allow uppercase characters in user names, bug #376
  * Sysconfig: Permit empty comments after comment lines, RHBZ#1043636
  * Sysconfig_Route: New lens for RedHat's route configs
  * Syslog: Accept UDP(@) and TCP(@@) protocol, bug #364 (Yanis Guenane)
  * Xymon_Alerting: New lens for Xymon alerting files (François Maillard)
  * Yum: Add yum-cron*.conf files (Pat Riehecky)
    Include only *.repo files from yum.repos.d (Andrew N Golovkov)
    Permit spaces after equals sign in list options, GH issue #45
    Split excludes as lists, bug #275</changelog>
  <changelog author="tchvatal@suse.com" date="1404216000">- Enable tests but "pass" them even with 2 failures.</changelog>
  <changelog author="tchvatal@suse.com" date="1404302400">- Change desc to describe the "tools" not just the library
  bnc#885495.</changelog>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="6491fd1a85c334042a1cfcc1c538c0392ca5694498e6e4f1c4068eb5f1a4f7c0" name="augeas" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="bcd337f8aafb6bd28f3891e8202757c14beda291486556a47468b3a0da0fc209" name="augeas-devel" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="48a58dfb8e56645d02ccbd202b084a9f07d31b5bf9c20c1fcfc99b51622caca7" name="augeas-devel" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="8403a095c4ae1ea10d9168b6a2b300c296be7cced1eb5088a6c420d449800645" name="augeas-devel" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="e571d06422b1b33661dae895206c7e513b8c4d71dc0428cdf8903c63128fb7c9" name="augeas-devel" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="fbff77a07fa4f739eb83f4dfa4b84bc6e0476686370c26f0fc000ead225f84e1" name="augeas-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="37c10ff76b87814f93c035ce60bc7c03a4ec4be3d31192be407677f6d4d2c4d2" name="augeas-lense-tests" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="8e0d0b7b55ac5de4bb3d2d425254feffa10725c0431f54e43762cf052556be60" name="augeas-lense-tests" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="66dc34e7b114cd2295461cfd4a101f16f76484ecc002bdf2846e96b17d7ea949" name="augeas-lense-tests" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="b82f1e14d5ba1c134e428c19096551fabb3f87366555b67490e8094fb1f09f6b" name="augeas-lense-tests" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="195bbc53dc10e268946026def1b772aa7ad58d04463335b66036e5afeef645fa" name="augeas-lenses" arch="aarch64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="2406be8720e08dc83ce615fbf21824e532b5fcb39e12b673e867c30af2105958" name="augeas-lenses" arch="ppc64le">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="42e9211bfc255ef3e6d2536df5fca8ba5758644ee8b8d83aeba2f9cb96dabd9d" name="augeas-lenses" arch="s390x">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="a694332dcab968e85f3744501699fd6f653018af820da0a265e8121b5ea2d26e" name="augeas-lenses" arch="x86_64">
  <version epoch="0" ver="1.10.1" rel="3.3.1"/>
  <changelog author="p.drouand@gmail.com" date="1418904000">- Update  to version 1.3.0
  + General changes/additions
  * Add missing cp entry in manpage (GH issue #78)
  * Add seq to vim syntax highlight (Robert Drake)
  * Update augtool.1 man page with new commands and --span, RHBZ#1100077
  * augtool autocomplete includes command aliases, RHBZ#1100184
  * Remove unused "filename" argument from dump-xml command, RHBZ#1100106
  * aug_save returns non-zero result when unable to delete files,
    RHBZ#1091143
  + Lens changes/additions
  * Aliases: permit missing whitespace between colon and recipients
  * AptPreferences: Support spaces in origin fields
  * Cgconfig: handle additional valid controllers (Andy Grimm)
  * Chrony: New lens to parse /etc/chrony.conf (Pat Riehecky)
  * CPanel: New lens to parse cpanel.config files
  * Desktop: Allow @ in keys (GH issue #92)
  * Device_map: Parse all device.map files under /boot (Mike Latimer)
  * Dhclient: Add support for option modifiers (Robert Drake,
    GH issue #95)
    Parse hash statements with dhcp-eval strings
  * Dhcpd: stmt_string quoted blocks no longer store quote marks
    (incompatible change),
    many changes to support more record types (Robert Drake)
  * Group: NIS support (KaMichael)
  * Grub: handle "foreground" option, RHBZ#1059383 (Miguel Armas)
  * Gshadow: New lens (Lorenzo Catucci)
  * Httpd: Allow eol comments after section tags
    Allow continued lines inside quoted value (GH issue #104)
    Allow comparison operators in tags (GH issue #154)
  * IPRoute2: handle "/" in protocol name, swap ID and name fields
    (incompatible change), RHBZ#1063968,
    handle hex IDs and hyphens, as present in
    rt_dsfield, RHBZ#1063961
  * Iptables: parse /etc/sysconfig/iptables.save, RHBZ#1144651
  * Kdump: parse new options, permit EOL comments, refactor, RHBZ#1139298
  * Keepalived: Add more virtual/real server settings and checks, RHBZ#1064388
  * Known_Hosts: New lens for SSH known hosts files
  * Krb5: permit braces in values when not in sub-section, RHBZ#1066419
  * Ldso: handle "hwcap" lines (GH issue #100)
  * Lvm: support negative numbers, parse /etc/lvm/lvm.conf (Pino Toscano)
  * Multipath: add support for rr_min_io_rq (Joel Loudermilk)
  * NagiosConfig and NagiosObjects: Fix documentation (Simon Sehier)
  * NetworkManager: Use the Quote module, support # in values (no eol comments)
  * OpenVPN: Add support for fragment, mssfix, and script-security
    (Frank Grötzner)
  * Pagekite: New lens (Michael Pimmer)
  * Pam: Add partial support for arguments enclosed in [] (Vincent Brillault)
  * Passwd: Refactor lens (Lorenzo Catucci)
  * Redis: Allow empty quoted values (GH issue #115)
  * Rmt: New lens to parse /etc/default/rmt, RHBZ#1100549
  * Rsyslog: support complex $template lines, property filters and file
    actions with templates, RHBZ#1083016
  * Services: permit colons in service name, RHBZ#1121263
  * Shadow: New lens (Lorenzo Catucci)
  * Shellvars: Handle case statements with same-line ';;', RHBZ#1033799
    Allow any kind of quoted values in block
    conditions (GH issue #118)
    Support $(( .. )) arithmetic expansion in variable
    assignment, RHBZ#1100550
  * Simplevars: Support flags and empty values
  * Sshd: Allow all types of entries in Match groups (GH issue #75)
  * Sssd: Allow ; for comments
  * Squid: Support configuration files for squid 3 (Mykola Nikishov)
  * Sudoers: Allow wuoted string in default str/bool params (Nick Piacentine)
  * Syslog: Support "# !" style comments (Robert Drake, GH issue #65)
    Permit IPv6 loghost addresses, RHBZ#1129388
  * Systemd: Allow quoted Environment key=value pairs, RHBZ#1100547
    Parse /etc/sysconfig/*.systemd, RHBZ#1083022
    Parse semicolons inside entry values, RHBZ#1139498
  * Tuned: New lens for /etc/tuned/tuned-main.conf (Pat Riehecky)
  * UpdateDB: New lens to parse /etc/updatedb.conf
    (incompatible change as this file used to be processed with
    Simplevars)
  * Xml: Allow backslash in #attribute values (GH issue #145)
    Parse CDATA elements (GH issue #80)
  * Xymon_Alerting: refactor lens (GH issue #89)
- Remove the sig and the keyring file as there is no gpg verification
  anyway
- Remove augeas-device_map-grub2.patch, fixed on upstream release</changelog>
  <changelog author="meissner@suse.com" date="1418904001">- restore keyring and .sig file, as this is checked by the OBS
  source service</changelog>
  <changelog author="tchvatal@suse.com" date="1426248000">- Whitespace</changelog>
  <changelog author="tchvatal@suse.com" date="1437048000">- Version bump to 1.4.0:
  * Loads of bugfixes all around the package
  * Read up NEWS file for the detailed changes</changelog>
  <changelog author="cbosdonnat@suse.com" date="1459857600">- Fix errors showing up in guestfs tools.
  Add upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="mlatimer@suse.com" date="1463054400">- Update to version 1.5.0:
  - General changes/additions
  * augtool: new --timing option that prints after each operation how long
    it took
  * augtool: print brief help message when incorrect options are given rather
    than dumping all help text
  * Path expressions: optimize performance of evaluating certain
    expressions
  * lots of safety improvements in libfa to avoid using uninitialized
    values and the like (Daniel Trebbien)
  * tolerate building against OSX' libedit (Issue #256)
  - API changes
  * aug_match: fix a bug where expressions like /foo/*[2] would match a
    hidden node and pretend there was no match at all. We now make sure
    we never match a hidden node. Thanks to Xavier Mol for reporting the
    problem.
  * aug_get: make sure we set *value to NULL, even if the provided path is
    invalid (Issue #372)
  * aug_rm: fix segfault when deleting a tree and one of its ancestors
    (Issue #319)
  * aug_save: fix segfault when trying to save an invalid subtree. A
    routine that was generating details for the error message overflowed
    a buffer it had created (Issue #349)
  - Lens changes/additions
  * AptConf: support hash comments
  * AptSources: support options (Issue #295),
    support brackets with spaces in URI (GH #296)
    rename test file to test_aptsources.aug
  * Chrony: allow signed numbers and indentation, fix stray EOL entry,
    disallow comment on EOL, add many missing directives and
    options (Miroslav Lichvar, RHBZ#1213281)
    add new directives and options that were added in
    chrony-2.2 and chrony-2.3 and improve parsing of
    access configuration (Miroslav Lichvar, Issue #348)
    add new options for chrony-2.4 (Miroslav Lichvar)
  * Dhclient: avoid put ambiguity for node without value (Issue #294)
  * Group: support NIS map, support an overridden and disabled password,
    i.e. `+:*::` (Matt Dainty) (Issue #258)
  * Host_Conf: support spaces between list items (Cedric Bosdonnat, Issue #358)
  * Httpd: add paths to SLES vhosts
    (Jan Doleschal) (Issue #268)
    parse backslashes in directive arguments (Issue #307)
    parse mismatching case of opening/closing tags
    parse multiple ending section tags on one line
    parse wordlists in braces in SSLRequire directives
    parse directive args starting with double quote (Issue #330)
    parse directive args containing quotes
    support perl directives (Issue #327)
    parse line breaks/continuations in section arguments
    parse escaped spaces in directive/section arguments
    parse backslashes at the start of directive args (Issue #324)
  * Inputrc: support $else (Cedric Bosdonnat, Issue #359)
  * Interfaces: add support for source-directory (Issue #306)
  * Json: add comments support, refactor,
    allow escaped quotes and blackslashes
  * Keepalived: fix space/tag alignments and hanging spaces,
    add vrrp_mcast_group4 and vrrp_mcast_group6,
    add more vrrp_instance flags,
    add mcast/unicast_src_ip and unicast_peer,
    add missing garp options,
    add vrrp_script options,
    expand vrrp_sync_group block,
    allow notify option
    (Joe Topjian) (Issue #266)
  * Known_Hosts: refactoring and description fixed
  * Logrotate: support dateyesterday option (Chris Reeves) (GH #367, #368)
  * MasterPasswd: new lens to parse /etc/master.passwd
    (Matt Dainty) (Issue #258)
  * Multipath: add various missing keywoards (Olivier Mangold) (Issue #289)
  * MySQL: include /etc/my.cnf.d/*.cnf (Issue #353)
  * Nginx: improve typechecking of lens,
    allow masks in IP keys and IPv6 (Issue #260)
    add @server simple nodes (Issue #335)
  * Ntp: add support for basic interface syntax
  * OpenShift_Quickstarts: Use Json.lns
  * OpenVPN: add all options available in OpenVPN 2.3o
    (Justin Akers) (Issue #278)
  * Puppetfile: name separator is not mandatory
    add support for moduledir (Christoph Maser)
  * Rabbitmq: remove space in option name,
    add support for cluster_partitioning_handling,
    add missing simple options (Joe Topjian) (Issue #264)
  * Reprepro_Uploaders: add support for distribution field
    (Mathieu Alorent) (Issue #277),
    add support for groups (Issue #283)
  * Rhsm: new lens to parse subscription-manager's /etc/rhsm/rhsm.conf
  * Rsyslog: improve property filter parsing,
    treat whitespace after commas as optional.
    recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282),
    add support for redirecting output to named pipes
    (Gerlof Fokkema) (Issue #366)
  * Shellvars: allow partial quoting, mixing multiple styles
    (Kaarle Ritvanen) (Issue #183);
    allow wrapping builtin argument to multiple lines
    (Kaarle Ritvanen) (Issue #184);
    support ;; on same line with multiple commands
    (Kaarle Ritvanen) (Issue #185);
    allow line wrapping and improve quoting support
    (Kaarle Ritvanen) (Issue #187);
    accept [] and [[]] builtins (Issue #188);
    allow &amp;&amp; and || constructs after condition
    (Kaarle Ritvanen) (Issue #265);
    add pattern nodes in case entries
    (BREAKING CHANGE: case entry values are now in a
    @pattern subnode) (Kaarle Ritvanen) (Issue #265)
    add eval builtin support;
    add alias builtin support;
    allow (almost) any command;
    allow &amp;&amp; and || after commands (Issue #215);
    allow wrapping command sequences
    (Kaarle Ritvanen) (Issue #333);
    allow command-specific environment variable
    (Kaarle Ritvanen) (Issue #332);
    support subshells (Issue #339)
    newlines in start of functions
    allow newlines after actions
    support comments after function name (Issue #339)
    exclude SuSEfirewall2 (Cedric Bosdonnat, Issue #357)
  * Simplelines: parse OpenBSD's hostname.if(5)
    files (Jasper Lievisse Adriaanse) (Issue #252)
  * Smbusers: add support for ; comments
  * Spacevars: support flags (Issue #279)
  * Ssh: add support for HostKeyAlgorithms, KexAlgorithms
    and PubkeyAcceptedKeyTypes (Oliver Mangold) (Issue #290),
    add support for GlobalKnownHostsFile (Issue #316)
  * Star: New lens to parse /etc/default/star
  * Sudoers: support for negated command alias
    (Geoff Williams) (Issue #262)
  * Syslog: recognize '~' as a valid syslog action (discard)
    (Gregory Smith) (Issue #282)
  * Tmpfiles: new lens to parse systemd's tempfiles.d configuration
    files (Julien Pivotto) (Issue #269)
  * Trapperkeeper: new lens for Puppet server configuration files
  * Util: add comment_c_style_or_hash lens
    add empty_any lens
  * Vsftpd: add isolate and isolate_network options
    (Florian Chazal) (Issue #334)
  * Xml: allow empty document (Issue #255)
  * YAML: new lens (subset) (Dimitar Dimitrov) (Issue #338)
- Drop upstreamed patches:
    27d8457-inputrc-lens-support-mapping-like.patch
    2d12670-inputrc-lens-support-else.patch
    49bcfbe-Exclude-network-if-up.d-SuSEfirewall2-in-shellvars-l.patch
    7558c12-host_conf-lens-spaces-between-list-items-support.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1477656000">- Version update to 1.6.0:
  * See the NEWS file for the details</changelog>
  <changelog author="tchvatal@suse.com" date="1496145600">- Version update to 1.8.0:
  * See the News file for all the details
- Verified it contains fixes for bsc#933210 bsc#975729 bsc#925225
  bsc#1023204 CVE-2014-8119</changelog>
  <changelog author="vcizek@suse.com" date="1509019200">- Version update to 1.9.0:
  - General changes/additions
  * Fix error in handling escaped whitespace at the end of path expressions
    (addresses CVE-2017-7555)
  * several improvements to the error messages when transforming a tree
    back to text fails. They now make it clearer what part of the tree
    was problematic, and what the tree should have looked like.
  * Fixed the pkg-config file, which should now be usable
  * Fix handling of backslash-escaping in strings and regular expressions
    in the lens language. We used to handle constructs like "\\" and
    /\\\\/ incorrectly. (Issue #495)
  * do not unescape the default value of a del on create; otherwise we are
    double unescaping these strings (Issue #507)
  * remove tempfile when saving files because destination is not writable
    (Issue #479)
  * span information is now updated on save (Issue #467)
  * fix lots of warnings generated by gcc 7.1
  * Various changes to reduce bashisms in tests and make them run on
    FreeBSD (Romain Tartière)
  - API changes
  * add function aug_ns_attr to allow iterating through a nodeset
    quickly. See examples/dump.c for an example of how to use them
    instead of aug_get, aug_label etc. and for a way to measure
    performance gains.
  - Lens changes/additions
  * Ceph: new lens for /etc/ceph/ceph.conf
  * Cgconfig: accept fperm &amp; dperm in admin &amp; task (Pino Toscano)
  * Dovecot: also load files from /usr/local/etc (Roy Hubbard)
  * Exports: relax the rules for the path at the beginning of a line so
    that double-quoted paths are legal, too
  * Getcap: new lens to parse generic termcap-style capability databases
  * Grub: accept toplevel 'boot' entry (Pino Toscano)
  * Httpd: handle empty comments with a continuation line (Issue #423);
    handle '&gt;""' in a directive properly (Issue #429); make space between
    quoted arguments optional (Issue #435); accept quoted strings as part
    of bare arguments (Issue #470)
  * Nginx: load files from sites-available directory (Omer Katz) (Issue #471)
  * Nslcd: new lens for nss-pam-ldapd config (Jose Plana)
  * Oz: New lense for /etc/oz/oz.cnf
  * postfix lenses: also load files from /usr/local/etc (Roy Hubbard)
  * Properties: accept DOS line endings (Issue #468)
  * Rtadvd: new lens to parse the rtadvd configuration file (Matt Dainty)
  * Rsyslog: load files from /etc/rsyslog.d (Doug Wilson) (Issue #475);
    allow spaces before the # starting a comment; allow comments inside
    config statements like 'module'
  * Ssh: accept '=' to separate keyword from arguments
  * Sshd: split HostKeyAlgorithms into list of values; recognize quoted
    group names with spaces in them (Issue #477)
  * Sudoers: recognize "match_group_by_gid" (Luigi Toscano) (Issue #482)
  * Syslog: allow spaces before the # starting a comment
  * Termcap: new lens to parse termcap capability databases (Matt Dainty)
  * Vsftpd: accept seccomp_sandbox (Denys Stroebel)
  * Xymon: accept 'group-sorted' directive (Issue #462)</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="vcizek@suse.com" date="1521547200">- update to 1.10.1:
  General changes/additions
    New CLI utility 'augmatch' to print the tree for a file and select
    some of its contents
    New command 'count' in augtool
    New function 'not(bool) -&gt; bool' for path expressions
    The path expression 'label[. = "value"]' can now be written more
    concisely as 'label["value"]'
  API changes
    libfa has now a function fa_json to export an FA as a JSON file, and
    fa_state_* functions that make it possible to iterate over the FA's
    states and transitions. (Pedro Valero Mejia)
    Add functions aug_ns_label, aug_ns_value, aug_ns_count, and
    aug_ns_path to get the label (with index), the value, the number of
    nodes, and the fully qualified path for nodes stored in a nodeset in
    a variable efficiently
  Lens changes/additions
    Grubenv: new lens to process /boot/grub/grubenv (omgold)
    Httpd: also read files from /etc/httpd/conf.modules.d/*.conf
    (Tomas Meszaros) (Issue #537)
    Nsswitch: allow comments at the end of a line (Philip Hahn) (Issue #517)
    Ntp: accept 'ntpsigndsocket' statement (Philip Hahn) (Issue #516)
    Properties: accept empty comments with DOS line endings (Issue #161)
    Rancid: new lens for RANCiD router databases (Matt Dainty)
    Resolv: accept empty comments with DOS line endings (Issue #161)
    Systemd: also process /etc/systemd/logind.conf (Pat Riehecky)
    YAML: process a document that is just a sequence (John Vandenberg)
- drop chrpath dependency, the offending dump binary is no longer shipped</changelog>
  <changelog author="jsikes@suse.com" date="1633435200">- Allow all printable ASCII characters in WPA-PSK definition
  * augeas-allow_printable_ASCII.patch
  * bsc#1187512
  * Sourced from https://github.com/hercules-team/augeas/pull/723/commits
  * Credit to Michal Filka &lt;mfilka@suse.com</changelog>
</package>
<package pkgid="3e39e886a75cc8f4b31ad3dd21c661d70b2c2d5d898d97a5b01b808933e09d4e" name="autogen" arch="aarch64">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="21f5c9907f7fabda5adee8102a534fe7862655a612523c3d2b7e9db9742a6b10" name="autogen" arch="ppc64le">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="8ab9015af21c86adc8730083b20e8dbc85bf70754cfccfd467dfd939e48e3d57" name="autogen" arch="s390x">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="68972e88a0307f72f1c92a833a4b474b153b789310dc472ca9010b3e5abb5724" name="autogen" arch="src">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="coolo@suse.com" date="1317384000">- add libtool as buildrequire to make the spec file more reliable</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1337688000">- Update to version 5.16
  * Changes, many see http://autogen.sourceforge.net/announce.html.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1342267200">- Fix source URL, this update must reach 12.2 because
  autogen was generating broken C code that segfaults
  with fortify source.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1362225600">- fix build with automake-1.13.1
- add explicit makeinfo buildrequires, it is required to build</changelog>
  <changelog author="pth@suse.de" date="1366113600">- Update to 5.16.2:
  * Coverity cleanups
  * evade Guile issue on BSD platform.
  * avoid emitting non-error messages to stderr
- Adapt autogen-build_ldpath.patch to the changed sources.</changelog>
  <changelog author="schwab@suse.de" date="1404388800">- Update to 5.18.3
  * ATTRIBUTE_FORMAT_ARG is a configured attribute that wraps
    __attribute__((__format_arg__(n))) procedure declaration attributes.
    To configure it, the ag_macros.m4 has a new macroo,
    AG_COMPILE_FORMAT_ARG (which is a compile only test probe).
  * Auto-edit Guile headers that depend upon configure values
    most especially:  noreturn
    but check for "ptrdiff_t" in our configure too, so that Guile does
    not create its own duplicate definition.
  * Abort from the failing function so that stack traces are useful
  * The libopts m4 configure code must configure the libopts/Makefile
  * Happy 2014 New Year
  * make sure library option handling code does nothing when the
    library is just trying to get information about an option.
  * Only apply texi2mdoc when it is needed.
  * The aoGetsText() emitted i18n helper function needs its argument
    to have the "format_arg" attribute.
  * documentation clarifications
  * properly create generated main procedures from user supplied code.
  * ChangeLog files have been removed from GIT sources
    (though still obtainable with tagged checkouts).
  * LIBGUILE_PATH is not needed and its derivation is wrong on
    where binaries and libraries have different prefixes.
  * fixed char casting issue that shows in UTF-8 files
  * fixed installation error for str2init
  * fixed failure handling in the usage template
  * fix broken flag values for auto-supported options
  * various tweaks to make Coverity happy.
  * allow the fatal error message functions to be tagged "noreturn"
    and incorporate sysnoreturn.h technology into AutoGen.
  * --save-opts documentation cleanup
  * optionMemberList() will return an allocated string containing
    the names of the bits set in the option.
  * tab stripped "here strings" include stripping the backslash
    escape character when it precedes any whitespace character.
- autoopts-remove-stupid-set-e.patch: remove stupid use of set -e
- autogen-setfilename.patch: remove
- autogen-build_ldpath.patch: regenerate
- run testsuite</changelog>
  <changelog author="schwab@suse.de" date="1404475200">- agen5-testsuite.patch: fix spurious testsuite failure</changelog>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="12a4adfed808c4fe2a1280253c42b61e56a68c8350ef8cdc3db002925d692f95" name="autogen" arch="x86_64">
  <version epoch="0" ver="5.18.12" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1425297600">- Remove upsteamed patch:
  * autoopts-remove-stupid-set-e.patch
  * agen5-testsuite.patch
- Cleanup spec file with spec-cleaner
- Use url for source
- Add gpg signature
- Update to 5.18.4
  * Do Not Edit (dne) warning:  the default of printing a date in
    the warning has now changed to not doing so.  The "-d" option
    to suppress the date is now deprecated (ignored).  A new
    option, "-D" will cause the date to be included.  The
    environment variable, "AUTOGEN_DNE_DATE" overrides everything.
  * The RETURN function was not completely implemented and only
    partially worked.  It is working now.
  * optionPrintVersionAndReturn() is a new function for applications
    that wish to extend the behavior of the "--version" option.
  * mdoc and man pages have been greatly improved.
  * libopts tear-off library used stdnoreturn.h and now includes
    infrastructure for systems deficient in that area
  * new function: insert-file  It will simply insert the contents
    of a file (or list of files) into the output stream.</changelog>
  <changelog author="mpluskal@suse.com" date="1432209600">- Update info files dependencies
- Refresh partially upstreamed autogen-build_ldpath.patch
- Update to 5.18.5
  * Guile 1.6 is now obsolete.  1.7/8 or newer from now on.
    Fixed issues with Guile managed locale string processing.
    (It keeps getting better and better all the time and I
    must keep adjusting over and over all the time.)
  * more Guile-config somersaults
    config/misc.def: sometimes, "pkg-config --cflags-only-I" yields
    multiple directories for Guile and that incantation is the only
    way to find libguile/version.h and that header is the only way
    to determine the micro version and the micro version is the best
    way to check for certain types of breakage.  (Testing is too
    convoluted.)
  * for-each handler functions may now be able to free (or not)
    the file text via the "handler-frees" attribute.</changelog>
  <changelog author="schwab@suse.de" date="1432209601">- No longer call autoreconf</changelog>
  <changelog author="mpluskal@suse.com" date="1442404800">- Update to 5.18.6
  * {AG,CL,GD}exe environment variables may be set to force
    bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
    override the current date default.
  * project may now be bootstrapped and built in the source
    directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
    time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1449489600">- Update to 5.18.7
  * {AG,CL,GD}exe environment variables may be set to force
  bootstrapping with a particular release.
  * MAN_PAGE_DATE can be used with various man page docs to
  override the current date default.
  * project may now be bootstrapped and built in the source
  directory with no ill effect.
  * AutoGen as a daemon will never happen.  Last vestiges gone.
  * templates may now obtain the most recent source modification
  time with "(max-file-time)"</changelog>
  <changelog author="mpluskal@suse.com" date="1461067200">- Split shared libraries (boo#976068)
- Move info handling to preun section
- Do not ship .la file</changelog>
  <changelog author="mpluskal@suse.com" date="1462276800">- Fix typo in preun script</changelog>
  <changelog author="mpluskal@suse.com" date="1462449600">- Rename devel package to libopts-devel
- Add corresponding obsoletion</changelog>
  <changelog author="astieger@suse.com" date="1467028800">- GNU autogen 5.18.10:
  * NUL terminate CGI definitions text
- GNU autogen 5.18.9:
  * When parsing CGI, do not allow spaces to be lost
  * In producing usage text, check more rigorously that
    option "values" are really not flag characters.
- GNU autogen 5.18.8:
  * Ensure testing vars start as unset for testing
  * happy new year &amp; de-uglifications
- update download URL and usptream signing key</changelog>
  <changelog author="mpluskal@suse.com" date="1483876800">- Update to version 5.8.12:
  * several configury fixes to enable cross platform building.
  * fompletion of a change in "char-mapper" to enable bootstrapping</changelog>
  <changelog author="bwiedemann@suse.com" date="1487764800">- Add autogen-catch-race-error.patch (boo#1021353)</changelog>
  <changelog author="tchvatal@suse.com" date="1499169600">- Add patch to build with guile 2.2:
  * autogen-guile-2.2.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1624622400">- Add reproducible.patch to normalize tar
- Normalize date in man-pages (boo#1047218)</changelog>
</package>
<package pkgid="7a12d698df3c894db7bcff93ef107696f3a11d48c194653c6d89b62134486aa5" name="automake" arch="noarch">
  <version epoch="0" ver="1.15.1" rel="4.10.2"/>
  <changelog author="pth@suse.de" date="1423569600">- Update to 1.15:
  New in 1.15:
  * Improvements and refactorings in the install-sh script:
  - It has been modernized, and now makes the following assumptions
  * unconditionally*:
    (1) a working 'dirname' program is available;
    (2) the ${var:-value} shell parameters substitution works;
    (3) the "set -f" and "set +f" shell commands work, and, respectively,
    disable and enable shell globbing.
  - The script implements stricter error checking, and now it complains
    and bails out if any of the following expectations is not met:
    (1) the options -d and -t are never used together;
    (2) the argument passed to option -t is a directory;
    (3) if there are two or more SOURCEFILE arguments, the
    DESTINATION argument must be a directory.
  * Automake-generated testsuites:
  - The default test-driver used by the Automake-generates testsuites
    now appends the result and exit status of each "plain" test to the
    associated log file (automake bug#11814).
  - The perl implementation of the TAP testsuite driver is no longer
    installed in the Automake's scripts directory, and is instead just
    distributed as a "contrib" addition.  There should be no reason to
    use this implementation anyway in real packages, since the awk+shell
    implementation of the TAP driver (which is documented in the manual)
    is more portable and has feature parity with the perl implementation.
  - The rule generating 'test-suite.log' no longer risk incurring in an
    extra useless "make all" recursive invocation in some corner cases
    (automake bug#16302).
  * Distribution:
  - Automake bug#18286: "make distcheck" could sometimes fail to detect
    files missing from the distribution tarball, especially in those cases
    where both the generated files and their dependencies are explicitly
    in $(srcdir).  An important example of this are *generated* makefile
    fragments included at Automake time in Makefile.am; e.g.:
    ...
    $(srcdir)/fragment.am: $(srcdir)/data.txt $(srcdir)/preproc.sh
    cd $(srcdir) &amp;&amp; $(SHELL) preproc.sh &lt;data.txt &gt;fragment.am
    include $(srcdir)/fragment.am
    ...
    If the use forgot to add data.txt and/or preproc.sh in the distribution
    tarball, "make distcheck" would have erroneously succeeded!  This issue
    is now fixed.
  - As a consequence of the previous change, "make distcheck" will run
    using '$(distdir)/_build/sub' as the build directory, rather than
    simply '$(distdir)/_build' (as it was the case for Automake 1.14 and
    earlier).  Consequently, the './configure' and 'make' invocations
    issued by the distcheck recipe now have $(srcdir) equal to '../..',
    rather than to just '..'.  Dependent and similar variables (e.g.,
    '$(top_srcdir)') are also changed accordingly.
    Thus, Makefiles that made assumptions about the exact values of the
    build and source directories used by "make distcheck" will have to
    be adjusted.  Notice that making such assumptions was a bad and
    unsupported practice anyway, since the exact locations of those
    directories should be considered implementation details, and we
    reserve the right to change them at any time.
  * Miscellaneous bugs fixed:
  - The expansion of AM_INIT_AUTOMAKE ends once again with a trailing
    newline (bug#16841).  Regression introduced in Automake 1.14.
  - We no longer risk to use '$ac_aux_dir' before it's defined (see
    automake bug#15981). Bug introduced in Automake 1.14.
  - The code used to detect whether the currently used make is GNU make
    or not (relying on the private macro 'am__is_gnu_make') no longer
    risks causing "Arg list too long" for projects using automatic
    dependency tracking and having a ton of source files (bug#18744).
  - Automake tries to offer a more deterministic output for generated
    Makefiles, in the face of the newly-introduced randomization for
    hash keys order in Perl 5.18.
  - In older Automake versions, if a user defined one single Makefile
    fragment (say 'foo.am') to be included via Automake includes in
    his main Makefile.am, and defined a custom make rule to generate that
    file from other data, Automake used to spuriously complain with some
    message like "... overrides Automake target '$(srcdir)/foo.am".
    This bug is now fixed.
  - The user can now extend the special .PRECIOUS target, the same way
    he could already do with the .MAKE .and .PHONY targets.
  - Some confusing typos have been fixed in the manual and in few warning
    messages (automake bug#16827 and bug#16997).
- Remove automake-fix-ac_aux_dir-used-before-initialized.patch as the
  change is incorporated now.
- Refresh automake-SuSE.patch and automake-require_file.patch so that
  they apply cleanly.</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- move delete of info file to preun section</changelog>
  <changelog author="dimstar@opensuse.org" date="1441108800">- Add automake-perl-5.22.patch: Fix test suite with perl 5.22 by
  silencing some warnings.</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1465905600">- add 0001-correct-parameter-parsing-in-test-driver-script.patch
  make parameter parsing of test driver script matching the help
  text</changelog>
  <changelog author="mpluskal@suse.com" date="1466942400">- Fix tests with gzip-1.7 and later:
  * automake-fix-tests-gzip.patch</changelog>
  <changelog author="bg@suse.com" date="1486728000">- use vendor suse instead of IBM on s390x</changelog>
  <changelog author="mpluskal@suse.com" date="1497960000">- Update to version 1.15.1:
  * The code has been adapted to remove a warning present since
    Perl 5.22 stating that "Unescaped left brace in regex is
    deprecated". This warning has become an hard error in Perl 5.26
  * The generated Makefiles do not rely on the obsolescent GZIP
    environment variable which was used for passing arguments to
    'gzip'.  Compatibility with old versions has been preserved.
  * Miscellaneous changes:
- Drop no longer needed patches:
  * automake-perl-5.22.patch
  * automake-fix-tests-gzip.patch
- Add keyring
- Small spec file cleanup</changelog>
  <changelog author="jayvdb@gmail.com" date="1508500800">- Add missing BuildRequires perl(Thread::Queue)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619956800">- update 0001-correct-parameter-parsing-in-test-driver-script.patch
  * avoid bashisms in test-driver script (bsc#1185540)</changelog>
  <changelog author="josef.moellers@suse.com" date="1624363200">- make generated autoconf makefiles reproducible.
  [bsc#1182604, automake-reproducible.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1624449600">- Add automake-update-help2man.patch to avoid date variations in docs
  [boo#1047218, jsc#SLE-17848, automake-update-help2man.patch]</changelog>
</package>
<package pkgid="b327555c22086e0cc7ef7b57095b5f7391f506f7477188a34f99c5891c5b2be9" name="automake" arch="src">
  <version epoch="0" ver="1.15.1" rel="4.10.2"/>
  <changelog author="pth@suse.de" date="1369656000">- Update to 1.13.2 (for the full change log please see the file NEWS
  in the package documentation):
  * Obsolescent features:
  - Use of suffix-less info files (that can be specified through the
    '@setfilename' macro in Texinfo input files) is discouraged, and
    its use will raise warnings in the 'obsolete' category.
  - Use of Texinfo input files with '.txi' or '.texinfo' extensions
    is discouraged, and its use will raise warnings in the 'obsolete'
    category.  You are advised to simply use the '.texi' extension
    instead.
  * Documentation fixes:
  - The long-deprecated but still supported two-arguments invocation form
    of AM_INIT_AUTOMAKE is documented once again.
  * Bugs fixed:
  - When the 'ustar' option is used, the generated configure script no
    longer risks hanging during the tests for the availability of the
    'pax' utility, even if the user running configure has a UID or GID
    that requires more than 21 bits to be represented.
  - The obsolete macros AM_CONFIG_HEADER or AM_PROG_CC_STDC work once
    again, as they did in Automake 1.12.x (albeit printing runtime
    warnings in the 'obsolete' category).
  - aclocal will no longer error out if the first local m4 directory
    (as specified by the '-I' option or the 'AC_CONFIG_MACRO_DIRS' or
    'AC_CONFIG_MACRO_DIR' macros) doesn't exist; it will merely report
    a warning in the 'unsupported' category.
  - aclocal will no longer consider directories for extra m4 files more
    than once, even if they are specified multiple times.
  - Analysis of make flags in Automake-generated rules has been made more
    robust, and more future-proof.
- Adapt automake-SUSE.patch to the changed sources.</changelog>
  <changelog author="pth@suse.de" date="1369742400">- Remove aclocal-am_ac.patch and aclocal-am_ac.sh as they aren't
  needed anymore and instead cause havok.</changelog>
  <changelog author="pth@suse.de" date="1371038400">- Update to 1.13.3:
  * Documentation fixes:
  - The documentation no longer mistakenly reports that the
    obsolete 'AM_MKDIR_PROG_P' macro and '$(mkdir_p)' make variable
    are going to be removed in Automake 2.0.
  * Bugs fixed:
  - Byte-compilation of Emacs lisp files could fail spuriously on
    Solaris, when /bin/ksh or /usr/xpg4/bin/sh were used as shell.
  - If the same user-defined suffixes were transformed into
    different Automake-known suffixes in different Makefile.am
    files in the same project, automake could get confused and
    generate inconsistent Makefiles (automake bug#14441).
    For example, if 'Makefile.am' contained a ".ext.cc:" suffix
    rule, and 'sub/Makefile.am' contained a ".ext.c:" suffix rule,
    automake would have mistakenly placed into 'Makefile.in' rules
    to compile "*.c" files into object files, and into
    'sub/Makefile.in' rules to compile "*.cc" files into object
    files --- rather than the other way around.  This is now fixed.
  - Several spurious failures have been fixed (they hit especially
    MinGW/MSYS builds).  See automake bugs #14493, #14494, #14495,
    [#14498], #14499, #14500, #14501, #14517 and #14528.
  - Some other minor miscellaneous changes and fixlets.
  - Patches updated to they apply cleanly and with no offset.</changelog>
  <changelog author="pth@suse.de" date="1371470400">- Update to 1.13.4:
  - Fix a minor regression introduced in Automake 1.13.3: when two or more
    user-defined suffix rules were present in a single Makefile.am,
    automake would needlessly include definition of some make variables
    related to C compilation in the generated Makefile.in (bug#14560).
- Adapt automake-SuSE.patch to changed config.guess.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1376654400">- fix tests on factory
  automake-1.13.4-fix-primary-prefix-invalid-couples-test.patch</changelog>
  <changelog author="fcrozat@suse.com" date="1383048000">- Add expect as BuildRequires/Requires for automake-testsuite.</changelog>
  <changelog author="jengelh@inai.de" date="1391601600">- Update to new upstream release 1.14.1
  * The 'compile' script is now unconditionally required for all
  packages that perform C compilation
  * The AM_PROG_CC_C_O macro can still be called, albeit that
  should no longer be necessary.
  * The special Automake-time substitutions '%reldir%' and
  '%canon_reldir%' (and their short versions, '%D%' and '%C%'
  respectively) can now be used in an included Makefile fragment.
  The former is substituted with the relative directory of the
  included fragment (compared to the top-level including
  Makefile), and the latter with the canonicalized version of the
  same relative directory.
  * The 'shar' and 'compress' distribution formats are deprecated</changelog>
  <changelog author="pth@suse.de" date="1408968000">- Explicitely pass the directory name to setup so that the testsuite
  can run.</changelog>
  <changelog author="gber@opensuse.org" date="1412596800">- Add automake-fix-ac_aux_dir-used-before-initialized.patch in
  to fix the use of $ac_aux_dir before being initialized</changelog>
  <changelog author="pth@suse.de" date="1423569600">- Update to 1.15:
  New in 1.15:
  * Improvements and refactorings in the install-sh script:
  - It has been modernized, and now makes the following assumptions
  * unconditionally*:
    (1) a working 'dirname' program is available;
    (2) the ${var:-value} shell parameters substitution works;
    (3) the "set -f" and "set +f" shell commands work, and, respectively,
    disable and enable shell globbing.
  - The script implements stricter error checking, and now it complains
    and bails out if any of the following expectations is not met:
    (1) the options -d and -t are never used together;
    (2) the argument passed to option -t is a directory;
    (3) if there are two or more SOURCEFILE arguments, the
    DESTINATION argument must be a directory.
  * Automake-generated testsuites:
  - The default test-driver used by the Automake-generates testsuites
    now appends the result and exit status of each "plain" test to the
    associated log file (automake bug#11814).
  - The perl implementation of the TAP testsuite driver is no longer
    installed in the Automake's scripts directory, and is instead just
    distributed as a "contrib" addition.  There should be no reason to
    use this implementation anyway in real packages, since the awk+shell
    implementation of the TAP driver (which is documented in the manual)
    is more portable and has feature parity with the perl implementation.
  - The rule generating 'test-suite.log' no longer risk incurring in an
    extra useless "make all" recursive invocation in some corner cases
    (automake bug#16302).
  * Distribution:
  - Automake bug#18286: "make distcheck" could sometimes fail to detect
    files missing from the distribution tarball, especially in those cases
    where both the generated files and their dependencies are explicitly
    in $(srcdir).  An important example of this are *generated* makefile
    fragments included at Automake time in Makefile.am; e.g.:
    ...
    $(srcdir)/fragment.am: $(srcdir)/data.txt $(srcdir)/preproc.sh
    cd $(srcdir) &amp;&amp; $(SHELL) preproc.sh &lt;data.txt &gt;fragment.am
    include $(srcdir)/fragment.am
    ...
    If the use forgot to add data.txt and/or preproc.sh in the distribution
    tarball, "make distcheck" would have erroneously succeeded!  This issue
    is now fixed.
  - As a consequence of the previous change, "make distcheck" will run
    using '$(distdir)/_build/sub' as the build directory, rather than
    simply '$(distdir)/_build' (as it was the case for Automake 1.14 and
    earlier).  Consequently, the './configure' and 'make' invocations
    issued by the distcheck recipe now have $(srcdir) equal to '../..',
    rather than to just '..'.  Dependent and similar variables (e.g.,
    '$(top_srcdir)') are also changed accordingly.
    Thus, Makefiles that made assumptions about the exact values of the
    build and source directories used by "make distcheck" will have to
    be adjusted.  Notice that making such assumptions was a bad and
    unsupported practice anyway, since the exact locations of those
    directories should be considered implementation details, and we
    reserve the right to change them at any time.
  * Miscellaneous bugs fixed:
  - The expansion of AM_INIT_AUTOMAKE ends once again with a trailing
    newline (bug#16841).  Regression introduced in Automake 1.14.
  - We no longer risk to use '$ac_aux_dir' before it's defined (see
    automake bug#15981). Bug introduced in Automake 1.14.
  - The code used to detect whether the currently used make is GNU make
    or not (relying on the private macro 'am__is_gnu_make') no longer
    risks causing "Arg list too long" for projects using automatic
    dependency tracking and having a ton of source files (bug#18744).
  - Automake tries to offer a more deterministic output for generated
    Makefiles, in the face of the newly-introduced randomization for
    hash keys order in Perl 5.18.
  - In older Automake versions, if a user defined one single Makefile
    fragment (say 'foo.am') to be included via Automake includes in
    his main Makefile.am, and defined a custom make rule to generate that
    file from other data, Automake used to spuriously complain with some
    message like "... overrides Automake target '$(srcdir)/foo.am".
    This bug is now fixed.
  - The user can now extend the special .PRECIOUS target, the same way
    he could already do with the .MAKE .and .PHONY targets.
  - Some confusing typos have been fixed in the manual and in few warning
    messages (automake bug#16827 and bug#16997).
- Remove automake-fix-ac_aux_dir-used-before-initialized.patch as the
  change is incorporated now.
- Refresh automake-SuSE.patch and automake-require_file.patch so that
  they apply cleanly.</changelog>
  <changelog author="meissner@suse.com" date="1431864000">- move delete of info file to preun section</changelog>
  <changelog author="dimstar@opensuse.org" date="1441108800">- Add automake-perl-5.22.patch: Fix test suite with perl 5.22 by
  silencing some warnings.</changelog>
  <changelog author="Thomas.Blume@suse.com" date="1465905600">- add 0001-correct-parameter-parsing-in-test-driver-script.patch
  make parameter parsing of test driver script matching the help
  text</changelog>
  <changelog author="mpluskal@suse.com" date="1466942400">- Fix tests with gzip-1.7 and later:
  * automake-fix-tests-gzip.patch</changelog>
  <changelog author="bg@suse.com" date="1486728000">- use vendor suse instead of IBM on s390x</changelog>
  <changelog author="mpluskal@suse.com" date="1497960000">- Update to version 1.15.1:
  * The code has been adapted to remove a warning present since
    Perl 5.22 stating that "Unescaped left brace in regex is
    deprecated". This warning has become an hard error in Perl 5.26
  * The generated Makefiles do not rely on the obsolescent GZIP
    environment variable which was used for passing arguments to
    'gzip'.  Compatibility with old versions has been preserved.
  * Miscellaneous changes:
- Drop no longer needed patches:
  * automake-perl-5.22.patch
  * automake-fix-tests-gzip.patch
- Add keyring
- Small spec file cleanup</changelog>
  <changelog author="jayvdb@gmail.com" date="1508500800">- Add missing BuildRequires perl(Thread::Queue)</changelog>
  <changelog author="mkubecek@suse.cz" date="1619956800">- update 0001-correct-parameter-parsing-in-test-driver-script.patch
  * avoid bashisms in test-driver script (bsc#1185540)</changelog>
  <changelog author="josef.moellers@suse.com" date="1624363200">- make generated autoconf makefiles reproducible.
  [bsc#1182604, automake-reproducible.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1624449600">- Add automake-update-help2man.patch to avoid date variations in docs
  [boo#1047218, jsc#SLE-17848, automake-update-help2man.patch]</changelog>
</package>
<package pkgid="dd0ca50d4d5ff319d1ed84dbd72b9460fc4d59f0763d37e4949818f0ebeacc7f" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.86" rel="3.17.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1614859200">- Import the security settings after importing the bootloader
  configuration (bsc#1183042).
- 4.3.70</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1615464000">- Remove the 'haspcmica' element from the schema (related to
  bsc#1183352).
- 4.3.71</changelog>
  <changelog author="jreidinger@suse.com" date="1615809600">- Autoyast schema: allow semi-automatic_entry alias for module in
  semi-automatic entry as it was already documented in autoyast
  documentation (bsc#1183512)
- 4.3.72</changelog>
  <changelog author="kanderssen@suse.com" date="1615809601">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
</package>
<package pkgid="ae294d1705fcc10d970fcc22edff36fd54a4d12fcf1dad1d4fd98516c37ce0ac" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.86" rel="3.17.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1614859200">- Import the security settings after importing the bootloader
  configuration (bsc#1183042).
- 4.3.70</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1615464000">- Remove the 'haspcmica' element from the schema (related to
  bsc#1183352).
- 4.3.71</changelog>
  <changelog author="jreidinger@suse.com" date="1615809600">- Autoyast schema: allow semi-automatic_entry alias for module in
  semi-automatic entry as it was already documented in autoyast
  documentation (bsc#1183512)
- 4.3.72</changelog>
  <changelog author="kanderssen@suse.com" date="1615809601">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
</package>
<package pkgid="f58139b18fb1967fc6f0c2392f657833736eb01abbaeb5cf019e5a214b3148d6" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.89" rel="3.22.1"/>
  <changelog author="kanderssen@suse.com" date="1615809600">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
</package>
<package pkgid="8f89995f1ed68e7504f3aa837bd1f1fe132982711fcd6ebe7b0a734f711409c6" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.89" rel="3.22.1"/>
  <changelog author="kanderssen@suse.com" date="1615809600">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
</package>
<package pkgid="6eb474f0d3a12390f67a82871997c10959588502bda7f77052a905a33cfe808d" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.90" rel="3.25.1"/>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
</package>
<package pkgid="3c43b3c3bdee50d8fe85c668fa86319e96ba95478f9fc29966067f72e42fccb0" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.90" rel="3.25.1"/>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
</package>
<package pkgid="e7d1e35e1941b0c722b0b456df453f55ce498665b3d0405df4941d83b3aa7031" name="autoyast2" arch="noarch">
  <version epoch="0" ver="4.3.91" rel="3.28.1"/>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
</package>
<package pkgid="54f3e3d79c28724541122e809c33f15cf2f1e7ad58859c9befcc61b9a5e24597" name="autoyast2" arch="src">
  <version epoch="0" ver="4.3.91" rel="3.28.1"/>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
</package>
<package pkgid="2508fe04c41d03a36c9bd5dc145abf94982ed8889e5646a3a385fe08e7ee3215" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.86" rel="3.17.1"/>
  <changelog author="igonzalezsosa@suse.com" date="1614859200">- Import the security settings after importing the bootloader
  configuration (bsc#1183042).
- 4.3.70</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1615464000">- Remove the 'haspcmica' element from the schema (related to
  bsc#1183352).
- 4.3.71</changelog>
  <changelog author="jreidinger@suse.com" date="1615809600">- Autoyast schema: allow semi-automatic_entry alias for module in
  semi-automatic entry as it was already documented in autoyast
  documentation (bsc#1183512)
- 4.3.72</changelog>
  <changelog author="kanderssen@suse.com" date="1615809601">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
</package>
<package pkgid="ba9680c8154f63e177b056126b65e7228137ccb6614e56ef393f52869c1e3d7a" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.89" rel="3.22.1"/>
  <changelog author="kanderssen@suse.com" date="1615809600">- Move default networking section values to the network repository
  in order to reduce the redundancy and to avoid an unexpected
  behavior (bsc#1180535).
- 4.3.73</changelog>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
</package>
<package pkgid="156e8bfc035662ce2748e3eb24dcf05586b31191666f96289e94dfd72c29ef47" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.90" rel="3.25.1"/>
  <changelog author="jreidinger@suse.com" date="1615982400">- Export properly "ask" section "selection"  (bsc#1183624)
- 4.3.74</changelog>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
</package>
<package pkgid="b6e2a64196c4f0dc357d32eb49b35ccb0fb79f62c85c002a03cde53590573365" name="autoyast2-installation" arch="noarch">
  <version epoch="0" ver="4.3.91" rel="3.28.1"/>
  <changelog author="snwint@suse.com" date="1616068800">- fix handling of empty signature-handling element in autoyast
  profile (bsc#1180968)
- 4.3.75</changelog>
  <changelog author="jreidinger@suse.com" date="1617278400">- Fix crash during using autoyast UI (bsc#1184216)
- 4.3.76</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617624000">- Add the 'mkfs_options' element to the schema (bsc#1184268).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710400">- Show the &lt;ask-list&gt; only once during autoinstallation
  (bsc#1184317).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617710401">- Use 'module' instead of 'listentry' when exporting pre-modules
  and post-modules lists (bsc#1184342).</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1617796800">- Do not crash while sorting the list of modules to be processed
  during the 2nd stage (bsc#1184316).
- Prevent AutoYaST UI from crashing when trying to apply a module
  changes (bsc#1184429).
- 4.3.77</changelog>
  <changelog author="kanderssen@suse.com" date="1620388800">- During autoupgrade do not try to register the system if it is
  explicitly disabled in the profile (bsc#1176965)
- 4.3.78</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620734400">- Consider 'static_text' as a valid value for 'ask/type' elements
  (bsc#1185909).
- 4.3.79</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1620907200">- Install packages in the PackagesProposal during autoupgrade
  (see bsc#1184488).
- 4.3.80</changelog>
  <changelog author="kanderssen@suse.com" date="1620907201">- Recommend icewm if graphical installation (bsc#1185095)
- 4.3.81</changelog>
  <changelog author="kanderssen@suse.com" date="1623153600">- Import proxy settings during the 1st stage of the installation
  (bsc#1185016)
- 4.3.82</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1623412800">- Do not crash when the general/storage section is empty
  (bsc#1187180).
- 4.3.83</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625227200">- Properly register the script to reboot after applying online
  updates (bsc#1187962).
- 4.3.84</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1625832000">- Add missing elements to rules.xml schema:
  - installed_product and installed_product_version (boo#1176089)
  - dialog section (bsc#1188153)
- Do not export the general/storage section when it is empty
  (related to bsc#1171356 and bsc#1187916).
- 4.3.85</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436800">- Copy the files to the right location when a &lt;file_location&gt;
  is given (bsc#1188357).
- 4.3.86</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1626436801">- Copy the init-scripts to the right location during 1st stage
  (bsc#1188360).
- 4.3.87</changelog>
  <changelog author="lslezak@suse.cz" date="1626782400">- Fixed handling of the "final_reboot" and "final_halt" options,
  add the custom scripts only once and avoid displaying
  a warning popup during installation (bsc#1188356)
- 4.3.88</changelog>
  <changelog author="shundhammer@suse.com" date="1630929600">- Ensure closing notification pop-ups even if a user script
  was not executed to prevent "No widget with ID ..." error pop-up
  (bsc#1188930, bsc#1188716)
- 4.3.89</changelog>
  <changelog author="igonzalezsosa@suse.com" date="1632225600">- Add the "hostname" element to the rules schema (bsc#1190696).
- 4.3.90</changelog>
  <changelog author="kanderssen@suse.com" date="1635163200">- Add the "keep_unknown_lv" element to the partitioning schema
  (bsc#1191968).
- 4.3.91</changelog>
</package>
<package pkgid="7d7c57930c7877ca61c4f93be43230e9b774cf55f0e6d88e8d2c2b86a37c9e66" name="avahi" arch="src">
  <version epoch="0" ver="0.6.32" rel="5.13.1"/>
  <changelog author="dmueller@suse.com" date="1398513600">- Do not depend on gnome-icon-theme:
  + the network-wired icon is meanwhile available in faenza, gnome,
    mate, nimbus oxygen and tango icon theme.
  + the dependency causes avahi depending on gtk3, which causes a
    build loop with gtk2.
  + the avahi-desktop.patch causes these desktop files to be only
    shown in GTK based desktops, which have any of those icon
    themes available.</changelog>
  <changelog author="dimstar@opensuse.org" date="1421928000">- Add avahi-outdated-URL.patch: Do not redirect users to
  &lt;http://0pointer.de/avahi-compat?s=libdns_sd&amp;e=ntpd&gt;, which no
  longer exists, but bring them to the more generic blog entry
  http://0pointer.de/blog/projects/avahi-compat.html (boo#914298).</changelog>
  <changelog author="dimstar@opensuse.org" date="1439985600">- Sync up the multiple .spec files.</changelog>
  <changelog author="mgorse@suse.com" date="1444305600">- Add avahi-0.6.31-invalid-packet.patch: do not spam logs for
  invalid packets (boo#947140 bsc#948277).</changelog>
  <changelog author="zaitor@opensuse.org" date="1445256000">- Temp disable 2 old Conflicts that are breaking staging. These can
  back in once there is a new release of avahi.</changelog>
  <changelog author="dimstar@opensuse.org" date="1453723200">- No longer install sysv services: the systemd services have been
  installed for a long time already and are masking the sysv
  scripts; those scripts existance only add confusion (boo#959908).</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="alarrosa@suse.com" date="1463745600">- Update to GNOME 3.20.2 (Fate#318572)
- Added License field in spec file.</changelog>
  <changelog author="mgorse@suse.com" date="1466683200">- Add avahi-0.6.31-systemd-order.patch: start after NM/wicked, to
  ensure resolv.conf is present (bsc#982317, gh#lathiat/avahi#59).</changelog>
  <changelog author="dimstar@opensuse.org" date="1466683201">- Update to version 0.6.32:
  + Don't log warnings about invalid packets, commonly triggered by
    Windows 10 systems.
  + Fix issue with bad packet size estimation, causing probes to
    continuously be sent when hosting large numbers of services.
  + Fix build on Solaris/SmartOS (filio.h issue).
  + Fix build on FreeBSD (PCAP_D_IN issue).
  + Fix debug output with libdaemon &gt;= 0.14.
  + avahi_server_set_browse_domains now correctly uses the provided
    list, instead of re-using the list from the configuration file.
  + Set nl_pid to 0, this will automatically assign the value and
    prevent conflicts per netlink(7). (Bug #334).
  + Check for netlink pid=0 (kernel) instead of uid=0, which works
    correctly with network &amp; user namespaces.
  + Fix reversed IFA_LOCAL and IFA_ADDRESS checks (Avahi#355).
  + Don't fail the build on deprecated GTK/GLIB usage.
  + Gracefully fail if SO_REUSEPORT is not available.
  + Minor Python 3 update for the python ServiceTypeDatabase test
    usage of print, should be backwards compatible.
  + avahi-autoipd: Fix incorrect usage of IFLA_RTA instead of
    IFA_RTA which could crash on ARM (Closes: gh#lathiat/avahi#42).
- Drop upstream fixed patches:
  + avahi-unicastdomains.patch
  + avahi-gtk_box_new.patch
  + avahi-fix-mkdir.diff
  + avahi-enable-ipv6.patch
  + avahi-reserve-space-for-record-data-when-size-e.patch
- Rebase avahi-0.6.31-invalid-packet.patch.</changelog>
  <changelog author="mgorse@suse.com" date="1468238400">- Replace avahi-0.6.31-systemd-order.patch with
  avahi-0.6.32-suppress-resolv-conf-warning.patch: only warn
  on missing resolv.conf if the options that use it are enabled.
  https://github.com/lathiat/avahi/pull/63</changelog>
  <changelog author="dimstar@opensuse.org" date="1487160000">- Drop %insserv_cleanup scriptlets: it's been a while that avahi
  did not install any sysV init scripts anymore.
- Simplify avahi_spec-prepare.sh: OBS is well able to handle macros
  in package names by now.
- Drop conditions to only handle systemd services on openSUSE &gt;
  12.1; it's been long that we did not ship the sysv scripts
  anymore and openSUSE 12.1 is long EOL.</changelog>
  <changelog author="dimstar@opensuse.org" date="1496145600">- Modify user generation (boo#1010384):
  + Use getent to check for existing users/groups, only creating
    them if not found.
  + Do not hide output of groupadd/useradd.
  + Do not mask failures: if a user can't be added, we have a
    problem.</changelog>
  <changelog author="jengelh@inai.de" date="1496318400">- Do not suppress errors from avahi-autoipd user creation, but do
  suppress getent output.
- Replace $RPM_* shell vars by macros.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="yfjiang@suse.com" date="1525262400">- Add avahi-daemon-increase-rlimit.patch: increase rlimit as a
  conservative way to handle certain crashes referring to upstream
  commit 71ace71 (bsc#1085255).</changelog>
  <changelog author="mgorse@suse.com" date="1547467200">- Add CVE-2018-1000845.patch: drop legacy unicast queries from
  address not on local link (boo#1120281 CVE-2018-1000845).</changelog>
  <changelog author="mgorse@suse.com" date="1595332800">- When changing ownership of /var/lib/autoipd, only change
  ownership of files owned by avahi, to mitigate against
  possible exploits (bsc#1154063).</changelog>
  <changelog author="mgorse@suse.com" date="1612785600">- Update avahi-daemon-check-dns.sh from Debian. Our previous
  version relied on ifconfig, route, and init.d.
- Rebase avahi-daemon-check-dns-suse.patch, and drop privileges
  when invoking avahi-daemon-check-dns.sh (boo#1180827
  CVE-2021-26720).
- Add sudo to requires: used to drop privileges.</changelog>
  <changelog author="mgorse@suse.com" date="1618920000">- Add avahi-CVE-2021-3468.patch: avoid infinite loop by handling
  HUP event in client_work (boo#1184521 CVE-2021-3468).
  https://github.com/lathiat/avahi/pull/330</changelog>
</package>
<package pkgid="067cf9d76cc9b129bb56cceb183e74816517c9ff97386c1a0589ac5cc9a6d465" name="avahi-glib2" arch="src">
  <version epoch="0" ver="0.6.32" rel="5.13.1"/>
  <changelog author="sbrabec@suse.cz" date="1216382400">- Build glib2, gobject and python stuff separately to break build
  loop cups -&gt; gtk2 -&gt; avahi -&gt; cups.
- Split avahi-python-gtk from avahi-python.
- Updated to version 0.6.23:
  * A lot of translation updates
  * Beef up bnvc quite a bit, including passing a domain to browse
    in
  * Increase numer of open files resource limit to 300 so that we
    can deal with more clients simultaneously.
  * Rework 'poof' algorithm a bit to reduce traffic load on noisy
    links.
  * Build fixes
  * Minor other updates
  * Backwards compatible with Avahi 0.6.x with x &lt; 23.</changelog>
  <changelog author="aj@suse.de" date="1217073600">- Fix requires to require avahi base package.</changelog>
  <changelog author="ro@suse.de" date="1217592000">- fix requires for debuginfo package</changelog>
  <changelog author="ro@suse.de" date="1217764800">- move fix further up in specfile</changelog>
  <changelog author="meissner@suse.de" date="1220270400">- Added GCC attribute alloc_size markup for allocator functions</changelog>
  <changelog author="sbrabec@suse.cz" date="1229342400">- avahi-discover.glade is required by avahi-utils-gtk and
  python-avahi-gtk =&gt; move to avahi (bnc#456418).
- Upgrade protection for avahi-utils-gtk built as
  avahi-glib2-utils-gtk (bnc#456418).</changelog>
  <changelog author="olh@suse.de" date="1231848000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="sbrabec@suse.cz" date="1231934400">- avahi-glib2-utils-gtk renamed back to its correct name
  avahi-utils-gtk (bnc#456418).</changelog>
  <changelog author="coolo@novell.com" date="1249819200">- use new python macros</changelog>
  <changelog author="sbrabec@suse.cz" date="1268654400">- Added support for translation-update-upstream (FATE#301344).</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Use %_smp_mflags for parallel build
- Add libavahi-devel to baselibs</changelog>
  <changelog author="sbrabec@suse.cz" date="1359979200">- Remove no more needed gnome-nettool2.png.
- Fix paths in man pages (sed script).
- Update avahi-discover.desktop to fit Desktop Menu Specification
  better (avahi#365, fdo#49699).</changelog>
  <changelog author="dimstar@opensuse.org" date="1375704000">- Remove -DGTK_DISABLE_DEPRECATED=1 from avahi-ui/Makefile.am in
  order to allow building against GTK+ 3.9.10, which has GtkStock
  deprecated.</changelog>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
</package>
<package pkgid="baf692b9729f1bac6a24b688e8e3e6f7980ba862ef3a09b8efcb5597cbd9a2f9" name="aws-cli" arch="noarch">
  <version epoch="0" ver="1.19.9" rel="26.1"/>
  <changelog author="rjschwei@suse.com" date="1569585600">- Add groff as a dependency (boo# 1152258)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571054400">- Update to version 1.16.258
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.258/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1573732800">- Update to version 1.16.281
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.281/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1575547200">- Update to version 1.16.297
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.297/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1580385600">- Update to version 1.17.9
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.17.9/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="rjschwei@suse.com" date="1581336000">- Add bash command completion capability (boo#1117074)</changelog>
  <changelog author="dmueller@suse.com" date="1581681600">- make it possible to find the package under the name "awscli"</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1581940800">- Update to version 1.18.0
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.0/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Install aws bash completetion script into system path
  + Install aws zsh completion script into /etc/zsh_completion.d
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585051200">- Update to version 1.18.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.27/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585915200">- Update to version 1.18.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.35/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586260800">- Fix build on SLE-12
  + Add bash-completion to BuildRequires for suse_version &lt;= 1315</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586347200">- Update to version 1.18.38 (bsc#1166924, bsc#1168943)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.38/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592222400">- Update to version 1.18.79
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1594900800">- Update to version 1.18.98
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597233600">- Update to version 1.18.117 (bsc#1175147, bsc#1175148, jsc#ECO-2362, jsc#PM-2069)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.117/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py
- Rename README.rst to README.md in %docs section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599480000">- Update to version 1.18.133
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.133/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602244800">- Update to version 1.18.156
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.156/CHANGELOG.rst
- Drop patches no longer required
  + hide_py_pckgmgmt.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1606737600">- Update to version 1.18.185
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.185/CHANGELOG.rst
- Rename README.md to README.rst in %doc section
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="3364a4d4e9bd89cb763819eaef74db3943cec6b8f8c7204dc6c88becb370d1bb" name="aws-cli" arch="src">
  <version epoch="0" ver="1.19.9" rel="26.1"/>
  <changelog author="rjschwei@suse.com" date="1569585600">- Add groff as a dependency (boo# 1152258)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1571054400">- Update to version 1.16.258
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.258/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1573732800">- Update to version 1.16.281
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.281/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1575547200">- Update to version 1.16.297
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.16.297/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1580385600">- Update to version 1.17.9
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.17.9/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="rjschwei@suse.com" date="1581336000">- Add bash command completion capability (boo#1117074)</changelog>
  <changelog author="dmueller@suse.com" date="1581681600">- make it possible to find the package under the name "awscli"</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1581940800">- Update to version 1.18.0
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.0/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Install aws bash completetion script into system path
  + Install aws zsh completion script into /etc/zsh_completion.d
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585051200">- Update to version 1.18.27
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.27/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585915200">- Update to version 1.18.35
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.35/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586260800">- Fix build on SLE-12
  + Add bash-completion to BuildRequires for suse_version &lt;= 1315</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1586347200">- Update to version 1.18.38 (bsc#1166924, bsc#1168943)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.38/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592222400">- Update to version 1.18.79
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1594900800">- Update to version 1.18.98
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.79/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597233600">- Update to version 1.18.117 (bsc#1175147, bsc#1175148, jsc#ECO-2362, jsc#PM-2069)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.117/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py
- Rename README.rst to README.md in %docs section</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1599480000">- Update to version 1.18.133
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.133/CHANGELOG.rst
  + Forward port hide_py_pckgmgmt.patch
  + Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602244800">- Update to version 1.18.156
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.156/CHANGELOG.rst
- Drop patches no longer required
  + hide_py_pckgmgmt.patch
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1606737600">- Update to version 1.18.185
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.185/CHANGELOG.rst
- Rename README.md to README.rst in %doc section
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1610452800">- Update to version 1.18.212
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.18.212/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1613649600">- Update to version 1.19.9 (bsc#1182421, bsc#1182422, jsc#ECO-3352, jsc#PM-2485)
  + For detailed changes see
    https://github.com/aws/aws-cli/blob/1.19.9/CHANGELOG.rst
- Update Requires in spec file from setup.py</changelog>
</package>
<package pkgid="1aaea925d4a65753d69c0edb75175926d6340a35bc73e2e988b4ad598d9cc002" name="azure-cli" arch="noarch">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="409454b28e2088db219499f0377a51d17ae36e1b20af2e982413812ffc13a323" name="azure-cli" arch="src">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="a9f904a235efbc1cf20ccac005fa1e9297411f3919e01013cd871cdb3cc665df" name="azure-cli-core" arch="noarch">
  <version epoch="0" ver="2.16.0" rel="6.10.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1579176000">- New upstream release
  + Version 2.0.80
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="meissner@suse.com" date="1580299200">- unrestrict python-PyYAML</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1582545600">- New upstream release
  + Version 2.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Relax version dependency for python-humanfriendly in Requires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to disable automatic check for updates (boo#1175289)
  + acc_disable-update-check.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Override upstream version in Requires for python-azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605614400">- Lower version dependency for python-azure-mgmt-resource to &gt;= 10.0.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Refresh patches for new version
  + acc_disable-update-check.patch
- Update Requires from setup.py
  + Temporarily use a vendored copy of azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="ae01faf2d64677efc22615de84b3b0f2e46ea3da6d45ec05d53187382bc2c662" name="azure-cli-core" arch="src">
  <version epoch="0" ver="2.16.0" rel="6.10.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1579176000">- New upstream release
  + Version 2.0.80
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="meissner@suse.com" date="1580299200">- unrestrict python-PyYAML</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1582545600">- New upstream release
  + Version 2.1.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Relax version dependency for python-humanfriendly in Requires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Add patch to disable automatic check for updates (boo#1175289)
  + acc_disable-update-check.patch</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Override upstream version in Requires for python-azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605614400">- Lower version dependency for python-azure-mgmt-resource to &gt;= 10.0.0</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Refresh patches for new version
  + acc_disable-update-check.patch
- Update Requires from setup.py
  + Temporarily use a vendored copy of azure-mgmt-resource</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="b534cf45bc956cba5ed6475f3cfbf355aa05a85619afa9cc60e7846f4fc78799" name="azure-cli-test" arch="aarch64">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="2bd4ecde047a7d2613ed2f2ad021568157e6cf80fd1c60ac666d399e00fa3edb" name="azure-cli-test" arch="ppc64le">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="cd0331102ac64b3bd36f379081e97d168f1bf9c2efe23d474ae9ea9aef03f215" name="azure-cli-test" arch="s390x">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="8e28fcc104f5757f2bbdfc09730d69b029b2687731207481f4390c82a92e9180" name="azure-cli-test" arch="src">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="9f03dcfe02aded346aec62af6c5d4fe29c13242a44de2c7ee98f64c842a64192" name="azure-cli-test" arch="x86_64">
  <version epoch="0" ver="2.16.0" rel="6.7.1"/>
  <changelog author="adrian.glaubitz@suse.com" date="1583841600">- New upstream release
  + Version 2.2.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584446400">- Remove unsupported component package from Requires
  + azure-cli-taskhelp</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1584964800">- Update in SLE-15 (bsc#1140565, jsc#ECO-1257, jsc#PM-1598)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1585828800">- New upstream release
  + Version 2.3.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1588852800">- New upstream release
  + Version 2.5.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1592395200">- New upstream release
  + Version 2.7.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1595246400">- New upstream release
  + Version 2.9.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1597752000">- New upstream release (boo#1175289)
  + Version 2.10.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1598875200">- New upstream release
  + Version 2.11.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Set version dependency for azure-cli-core to %{version}
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1600776000">- New upstream release (bsc#1176784, bsc#1176785)
  + Version 2.12.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1601467200">- New upstream release
  + Version 2.12.1
  + For detailed information about changes see the
    HISTORY.rst file provided with this package</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1602590400">- New upstream release
  + Version 2.13.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update BuildRequires and Requires from setup.py</changelog>
  <changelog author="olaf@aepfle.de" date="1604318400">- Remove trailing .sh suffix from bash-completion to make sure
  az is actually recognized as a command with completions
  Drop also the string 'completion' from resulting filename</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605528000">- New upstream release
  + Version 2.14.2
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Remove bogus dependencies from BuildRequires
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1605700800">- New upstream release
  + Version 2.15.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1607947200">- Remove bogus python-mock dependency from Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608033600">- Update in SLE-15 (bsc#1176785, jsc#ECO-3105, jsc#PM-2352)</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1608120000">- New upstream release
  + Version 2.16.0
  + For detailed information about changes see the
    HISTORY.rst file provided with this package
- Update Requires from setup.py</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626177600">- Add missing python3-azure-mgmt-resource dependency to Requires</changelog>
  <changelog author="adrian.glaubitz@suse.com" date="1626264000">- Update in SLE-15 (bsc#1187880, bsc#1188178)</changelog>
</package>
<package pkgid="015ca479d8ba100641b1569534cbefba1316e128f18617aecde60a7440fc148a" name="bash" arch="aarch64">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="9fb97fd71b407d21d10854f336fb3e7ec3b7d7915a9309ce862c9c80b645bdfa" name="bash" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="e8d77dfac449aa91e462a4860fd73b5ef9e0711f9a69a98cf97f2756d90e56c9" name="bash" arch="s390x">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="528beb859b071a41a159e4f598df625ab3e16b4c77f51d1e1180e222e381c0d8" name="bash" arch="src">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="a73af5591830c8f75dd02477714ee709e697570e40de22a73c9be802404cfe15" name="bash" arch="x86_64">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="aa284b083d5f8b4450edc214288f91be2bbc93f0eaf551c520978de4bd629c23" name="bash" arch="aarch64">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="5e9783eb2e7a0815e6d31c8ddd1bf2cb6949fa7aebde0ebe970405a5e21460c3" name="bash" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="1e63480def722ed7b61630aebf8bc5ada161166e779c04eb46e232269c3567e7" name="bash" arch="s390x">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="f17c3cae10202b64b46b5afd40e70134116aa5c98879437e3b61ff5961f22ac7" name="bash" arch="src">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="fd402df3f69da269a086bd511b8979066998bdcdc201fa08d0a6d1f0eecd6c97" name="bash" arch="x86_64">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="d2e45b70bd4b2f44b69bf0217f3501a76f79aa3931c4c29bd42535a550cbd3f5" name="bash-completion" arch="noarch">
  <version epoch="0" ver="2.7" rel="4.6.1"/>
  <changelog author="werner@suse.de" date="1439380800">- Correct typo in patch ls-completion-boo889319.patch</changelog>
  <changelog author="werner@suse.de" date="1439467200">- Add patch backtick-completion-boo940835.patch to allow correct
  backtick completion (boo#940835)</changelog>
  <changelog author="werner@suse.de" date="1443009600">- Add patch LVM-completion-bsc946875.patch to make LVM comands
  work even without any scan happen (bsc#946875)</changelog>
  <changelog author="werner@suse.de" date="1450440000">- Add patch respect-variables-boo940837.patch to avoid completions
  which results in e.g. ls \$HO
- Add patch rm-completion-smart-boo958462.patch to allow completions
  list e.g. rm prefix*.jpg&lt;TAB&gt;&lt;TAB&gt;
- Modify patch LVM-completion-bsc946875.patch that is add the
  new patch from Liuhua Wang</changelog>
  <changelog author="werner@suse.de" date="1453896000">- Add patch backticks-bsc963140.patch to handle sub commands
  which will be expanded by backticks (bsc#963140)</changelog>
  <changelog author="werner@suse.de" date="1461758400">- Add documentation for this packages below to get the reference
  of the e.g. the variable COMP_FILEDIR_FALLBACK (boo#977336)</changelog>
  <changelog author="werner@suse.de" date="1461758401">- Add patch sh-script-completion-boo977336.patch to make _filedir
  work with COMP_FILEDIR_FALLBACK even if local directries exists
  this is for bug boo##977336</changelog>
  <changelog author="sbrabec@suse.com" date="1461758402">- Remove completions conflicting with util-linux (boo#977259#c3).</changelog>
  <changelog author="werner@suse.de" date="1463572800">- Split off sub packages devel and doc to avoid dependency cycles</changelog>
  <changelog author="sbrabec@suse.com" date="1463572801">- Split doc build into a separate spec file. It makes possible to
  build package in two stages and prevent build loop.</changelog>
  <changelog author="tchvatal@suse.com" date="1472040000">- Mark the documentation as noarch</changelog>
  <changelog author="werner@suse.de" date="1481716800">- Change upstream home to https://github.com/scop/bash-completion
- Update to version 2.4
  * xetex, xelatex, luatex, lualatex: Associate with tex files
  * Support pod document files for perldoc (#39)
  * tipc: add tipc completions
  * rpm: Offer --filetriggers with -q
  * javadoc: Add bunch of option arg (non)completions
  * lrzip: Add -m arg noncompletion
  * pypy*: Add basic --jit arg completion
  * pypy3: Alias to python
  * hcitool,svcadm,tar: Spelling fixes
  * tipc: Invoke ls with "command"
  * tipc: Indentation fix
  * abook: Parse long options from command including full path
  * pyvenv: New completion
  * chroot: New (generic long options) completion, see #38
  * aptitude: List packages using _apt_cache_packages, fixes #33
  * vncviewer: Cleanup shopt use, drop an eval
  * make: Avoid a grep
  * rpm: Fix --whatenhances arg completion
  * aspell, minicom, mysql: Replace use of ls with printf
  * The BitKeeper completion used the wrong set of commands
  * Completion for python zip archives
  * lvm: pvcreate should be able to use all block devcices
  * lvm: fix all commands that should get all PVs
  * tar: Detect GNU/other from --version only once per session
  * tar: Remove unused variable
  * tar: Fix GNU tar help output parsing regex, fixes #15
  * tar: Don't write to /tmp/jetel
  * python: Simplify code
  * python: Complete all files also after -m
  * python: Don't offer options after -c
  * python: Complete all files only if -c is before current word
  * unzip, zipinfo: Complete on *.pyz
  * _lvm: using a single-pattern case and invoking function according
    to words[1]
  * lvm: _lvm_count_args parameter must be quoted in order to failglob
    not to complain
  * gendiff: Quoting suffix pattern to avoid triggering failglob
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (Alioth:
    [#314709])
  * Refactor bts and uscan, since they use common functions
  * uscan: New completion, thanks to Federico Ceratto
  * bts: New completion, thanks to Federico Ceratto.
  * nmcli completion was integrated upstream
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (take 2)
    (Alioth: #314709)
  * umount: Fix mount points escaping/unescaping with Bash-4.3
  * slapt-src: Handle --config=FILE option properly
  * sbopkg, slapt-{get,src}: expand tilde in config file name
  * slapt-{get,src}: Fix issue with sed not being able to handle some
    characters
  * slapt-src: split options from their arguments
  * psql: Tell psql to not load .psqlrc as it may change output format
    (Alioth: #314636)
  * mplayer: -dvd-devices takes dvd devices, dirs and .iso files as
    argument
  * 7z: Improve completion
  * f77, f95: Use the same completion as for g77, g95 if they are
    links to gfortran
  * make: Use only posix basic regexps with sed (Alioth: #314345)
  * perl: -d/-dt option argument is optional (Alioth: #314242)
  * Add config for cmake to bash-completion.
  * kcov: Add new sort types, complete --replace-src-path arguments
  * feh: Add new sort type
  * man: Use -w instead of --path
  * chronyc: Update help text parsing
  * chronyc: Add missing subcommands
  * chronyc: Add -6 option
  * minicom: Recognize user ~/.minirc.* as config files
  * rpmbuild: Complete *.spec on --clean (RedHat: #1132959)
  * tar: rework the completion completely
  * portsnap: New completion.
  * modprobe: fix params with multi-line descriptions
  * gdb: support --args style completion (Alioth: #314664)
  * make: Fix basic regex for portability (Alioth: #314345)
  * gnokii: New completion
  * xmllint, xmlwf, xsltproc: Complete on Mallard *.page files
  * pypy: New completion identical to python (Alioth: #314501)
  * make: Don't pick up variables when makefile is reloaded
  * make: Offer hidden targets when it is clear that the user is
    trying to complete one of them
  * make: Fix detection of intermediate targets where make has changed
    its database whitespace
  * make: completion shouldn't be confused by the output of $(info
    confuse: make)
  * zopflipng: New completion
  * ssh: Extract duplicate code to _ssh_configfile
  * gnokii, minicom: Use grep through "command"
  * Update URLs and various instructions to GitHub
  * ssh: Avoid completing commands before hostname
  * chronyc: Parse command args from help output
  * chronyc: Wrap long lines
  * Load completions also from $XDG_DATA_DIRS (RedHat: #1264094)
  * (testsuite) Ignore files generated by complete-ant-cmd.pl
  * scp, sftp: Complete -S on commands
  * scp, sftp: Fix querying ssh options
  * sftp: Add -l arg non-completion
  * ssh-copy-id: Offer only *.pub to -i
  * mpv: Remove mplayer-aliased completion
  * modplug*: Associate *.oct and *.okt
  * rpm: Add --whatenhances/recommends/suggests/supplements and
  - -recommends/supplements completions
  * pgrep, pidof, pkill, pwdx, vmstat: Add support for procps-ng
  * pdftotext: New completion
  * checksec: New completion
  * ssh: Complete HostbasedKeyTypes,HostKeyAlgorithms,KexAlgorithms
    values
  * ssh: Query ciphers and macs from ssh before hardcoded fallback
  * ssh: Add -Q argument completion
  * sysctl: Return early on --help, --version
  * sysctl: Try parsing options from help before usage
  * eog: Complete on *.ppm (RedHat: #1090481)
  * tar: Plug $line var leak
  * tar: Style tweaks
  * bsdtar, tar: Remove symlinks from git, have make create them
  * jshint: New completion
  * gnokii: Include and install it
  * gnokii: Fix completions of options that are prefixes for others
  * gnokii: Drop dead code
  * (testsuite): Add basic gnokii test case
  * gnokii: Various minor and cosmetic fixes
  * Load user completions from $BASH_COMPLETION_USER_DIR/completions
  * synclient: New completion
  * tune2fs: Add missing return in -M arg completion
  * reptyr: Rename file to _reptyr to avoid conflict with upstreamed
    completion
  * dropuser: New completion
  * createuser: New completion
  * createdb, dropdb: Drop -o default, it does not appear to do
    anything good here
  * tshark: Simplify cut usage
  * mcrypt: Simplify -m arg completion
  * strings: Fix -T/--target arg completion with non-English locale
  * chrome, firefox etc: Complete on *.pdf
  * ccache: Add -o/--set-config arg name completion
  * gphoto2: Replace tail with awk
  * gphoto2: Fix split argument handing, and colon treatment in --port
    args
  * Actually install the lz4 completion
  * _pnames: Add -s for producing (possibly) truncated names (RedHat:
    [#744406])
  * (testsuite) Add cd in dir without subdirs or CDPATH test case
  * Protect various compgen invocations from -* leakage (Debian:
    [#766163])
  * pigz, unpigz: Handle *.zz
  * rpmbuild: Complete *.spec on --nobuild
  * mplayer, *xine: Complete on *.mts (Debian: #759219)
  * ant: Support buildfile set in $ANT_ARGS (Alioth: #314735)
  * ant: Don't offer more completions after options that exit
  * 7z, adb: Trivial cleanups
  * python(3): Add -X argument non-completion
  * xsltproc. TODO fix for previous commit
  * xmllint, xmlwf, xsltproc: Complete on *.dbk and *.docbook (Alioth:
    [#314770])
  * xz: Complete -T/--threads argument
  * adb: New completion
  * modprobe: Try parsing help before using hardcoding option list
  * mpv: New completion alias + adjustments for mplayer (Debian:
    [#749115])
  * hostname: New completion
  * nslookup: complete on hosts (Alioth: #314673)
  * eog: Complete on *.pgm (RedHat: #1090481)
  * pngfix: New completion
  * qemu: Fix -balloon arg completion
  * qemu: Apply completion to qemu-kvm/-system-i386/-system-x86_64 too
  * xrandr: Use the invoked command internally, not hardcoded "xrandr"
  * xrandr: Add (some) --setprovider* arg completion support
  * ri: Fix class completion with ri &gt;= 3.
  * ri: Fix colon handling in class completion.
  * flake8: New completion
  * pyflakes: New completion
  * cal,chfn,chsh,dmesg,eject,hexdump,look,newgrp,renice,runuser,su,wr
    ite: Deprecate on Linux in favor of util-linux ones (Debian:
    [#737672])
  * hwclock,ionice,rtcwake: Deprecate in favor of util-linux ones
    (Debian: #737672)
  * ssh-keygen: New completion
  * jpegoptim: New completion
  * ip: Add some addr, addrlabel, and route arg completions
  * aptitude, dpkg: Replace some grep+cuts with awk
  * gcc, lintian, make, pkgadd, slackpkg: grep -&gt; "command grep"
    (Debian: #734095)
  * lintian: Replace some grep+cuts with awk
  * lz4: New completion.
  * optipng: New completion.
  * cppcheck: Include - in --file-list completions.
  * wtf: Look for acronym db from /usr/share/games/bsdgames/acronyms
    too.
  * wtf: Don't offer -f if it was already specified.
  * wtf: Hush stderr when db file doesn't exist.
  * appdata-validate: New completion.
  * timeout: New completion.
  * abook, kldunload: Pre-expand \t instead of relying on sed
    supporting it.
  * dict: Trivial regex cleanup.
  * zopfli: New completion.
  * bzip2, gzip, lzma: Cleanups.
  * 2to3: New completion.
  * file-roller: Reuse unzip's xspec.
  * 7z: New completion.
  * hcitool, rfcomm, ciptool, hciconfig: Don't leak $args.
  * perl: Fix -dt: completion.
  * perl*: Fix handling of relative paths in @INC.
  * wget: Add --accept-regex/--reject-regex/--regex-type arg
    (non)completions.
  * wget: Drop incorrect -nv arg completion.
  * wget: Stop completing after --help/--version.
  * Clean up/compact various globs.
  * cvs: Fix checkout -j non-completion.
  * sh: Complete script arguments with all filenames (Alioth:
    [#314226]).
  * nmcli: Deprecate our completion, upstream has one in 0.9.8.0.
  * cvs rm: Don't filter existing files with -f (RedHat: #949479).
- Drop patches now upstream
  init-completion-boo922758.patch
  pushd-completion-bnc818365.patch
- Rename patches
  bash-completion-2.1.patch becomes bash-completion-2.4.patch
- Port the patches to newer version 2.4
  FOO-dir-completion-boo905348.patch
  LVM-completion-bsc946875.patch
  PS1-completion-boo903362.patch
  backtick-completion-boo940835.patch
  backticks-bsc963140.patch
  ls-completion-boo889319.patch
  respect-variables-boo940837.patch
  rm-completion-smart-boo958462.patch
  sh-script-completion-boo977336.patch
- Only remove completion for umount/mount for older SUSE versions (boo#995045)</changelog>
  <changelog author="werner@suse.de" date="1481716801">- Add patch tar-completion.patch to allow mixed options with long
  and short options (boo#1012212)</changelog>
  <changelog author="werner@suse.de" date="1481803200">- Fix cut&amp;paste error in final ls completion</changelog>
  <changelog author="werner@suse.de" date="1481803201">- Detect if the completions for mount/umount have to be removed
  for modern util-linux package but without using suse_version</changelog>
  <changelog author="nico.kruber@gmail.com" date="1496145600">- Update to version 2.5
  * Support for python gui source files (#91)
  * mr: New completion
  * ssh-keygen: support ed25519 keys (#79)
  * Add sidedoor to _ssh() completion (#106)
  * .ipa is just a zip file and we should let unzip handle it (#71)
  * ant: parse targets in imported buildfiles (#84)
  * Add more tests for ccache
  * ccache: fix completing compiler's flags
  * test suite: Add java/javac non-completion fixture
  * javac: Complete -cp like -classpath
  * travis: Skip bluez and nis for now due to post-install script
    issues
  * test/config/*: Delete trailing whitespace
  * (test suite): Avoid loading user's ~/.bash_completion, fixes #87
  * ip: Recognize a as alias for address and l for link
  * ip: Recognize address in addition to addr
  * mr: Disable "clean" test case, command N/A before mr 1.20141023
  * ssh-keygen: Parse switches with _parse_usage, not _parse_help
  * mplayer: Associate with *.mjpg, *.mjpeg (Debian: #837779)
  * dd: Sync completions with coreutils 8.24
  * travis: Add mr
  * perl: Remove full path to cat in PERLDOC_PAGER call
  * deja-dup: New completion
  * CONTRIBUTING: Reorder sections
  * *: Move indentation settings to .editorconfig
  * make: Declare _make_target_extract_script like other functions
  * Travis: zopfli is AWOL?
  * *: Whitespace fixes
  * Minor edits to README.md (mostly formatting) (#110)
  * Fix bug in 'make' completion when using BSD sed (#108)
  * Add support for Include in ssh config (#70) (#80)
- adapt LVM-completion-bsc946875.patch</changelog>
  <changelog author="werner@suse.de" date="1499169600">- Update to version 2.7
  * Makefile: update default compatdir (#132)
  * Make user completion file configurable, disable in tests
  * test suite: Generalize xspec completion install check
  * pyflakes: Remove redundant xspec completion
  * test suite: Fix __expand_tilde_by_ref test expectation output
  * pdfunite: New *.pdf completion
  + bash-completion (2.6)
  * Add missing sidedoor to .gitignore (#114)
  * test suite: Mark expected centos6 CI _filedir failures as such
  * Expose version in BASH_COMPLETION_VERSINFO, use it in profile.d
    script
  * test suite: Skip an expected make test case failure in centos6 CI
  * test suite: Fix ifdown and ifup CI test skipping
  * test suite: Ignore env var pulled in by use of scp in tests
  * test suite: If colon trim doesn't do anything, trim as usual
  * tar: Comment spelling fixes
  * test suite: Mark dpkg -L test case untested if no packages
    installed
  * test suite: Cosmetic tweaks
  * dpkg: Fix dpkg -i home dir completion
  * test suite: Improve ls home dir test descriptions
  * python: Split module completion to separate helper
  * micropython: New completion, aliased from python
  * test suite: Add Python module completion test case
  * python: Fix traceback avoidance on module completion error
  * openssl: Parse available digests from dgst -h
  * openssl: Add sha2 commands
  * gm: New completion, commands only for now
  * (test suite): Test screen -T completions
  * (test suite): Set TERM to dumb, not dummy
  * Revert "(test suite): Fix alias and cd cursor position tests"
  * mplayer: Remove duplicate *.m4a and *.m4v associations
  * mplayer, xine, etc: Associate *.mp4a and *.mp4v
  * xine etc: Fix *.m4a association
  * bind: Add option and argument (non-)completions
  * _user_at_host: Set nospace only when completing username part
  * _user_at_host: Append @ suffix to username part completions
  * man: Don't check OSTYPE or GNU userland, just enable on all
    systems
  * (test suite): Set dcop result to untested if dcop server is not
    running
  * (test suite): Don't insist on loading all completions dynamically
  * _configured_interfaces: Parse from /etc/network/interfaces.d/* on
    Debian
  * py.test: New completion
  * oowriter: Associate with *.pdf
  * Don't define BASH_COMPLETION_COMPAT_DIR
  * ri: Add option and arg completions
  * (test suite): Add our own dummy ri test fixture
  * (test suite): Info test needs docs, don't exclude from CentOS
  * (test suite): Fix CentOS 6 tcllib setup
  * (test suite): Simplify renice test, fix with only one completion
  * (test suite): Don't assume configured interfaces in CI setups
  * Don't offer * as configured interface when there are none
  * (test suite): Add basic CentOS 6 container for bash 4.1 coverage
  * (test suite): Ignore runtime loaded env function changes
  * (test suite): Add mailman bin dir to PATH for arch test
  * arch: Parse options from --help
  * (test suite): Load tested completions dynamically
  * (test suite): Accept non-whitespace single word in
    assert_complete_any
  * (test suite): Avoid interference from user and system dirs (#87)
  * (test suite): Install some things N/A in ubuntu14 to fedoradev
  * (test suite): Add unrar to ubuntu14 container
  * (test suite): Fix alias and cd cursor position tests
  * (test suite): Add basic alpine test case
  * alpine: Parse opts from -h output, add some opt arg completions
  * (test suite): Install jshint globally in ubuntu14
  * (test suite): Add mailman bin dir to PATH for some mailman tools
  * (test suite): Install jshint to ubuntu14 container with npm
  * unshunt: Parse options from --help
  * (test suite): Test lsof on ubuntu14
  * (test suite): Add basic hping3 test case
  * (test suite): Add our ./configure to PATH to test it, test opts
  * (test suite): Add bunch of packages to ubuntu14 container
  * (test suite): Ensure /usr/(local/)games is in $PATH
  * (test suite): Fix perl -d* test cases with no Devel::* installed
  * (test suite): curl has lots of options, add more test prefix
  * (test suite): Fix tar test case for ones having --owner-map
  * (test suite): Unsupport various kill, renice cases if ps is N/A
  * (test suite): Make chkconfig test behave better in container
  * (test suite): Don't assume mounted filesystems in quota* tests
  * newlist: Parse options from --help, add some arg non-completions
  * (test suite): Delete trailing whitespace
  * (test suite): Don't assume lists set up in newlist test cases
  * (docker): Pull in missing fedoradev xvfb-run which dependency
  * mr: Avoid stderr trash and test suite failure if man is N/A
  * (test suite): Fix mmsitepass completion test
  * tshark -G: Avoid stderr noise when running as superuser
  * (docker): Run completion tests with xvfb-run, e.g. for gkrellm
  * ssh-keygen: Make option parsing work with OpenSSH &lt; 7
  * synclient, udevadm: Avoid use of posix char classes for awk
  * test suite: Add WIP Fedora dev config
  * Travis: Switch tests to docker, update to Ubuntu 14
  * xv: Associate with *.j2c, *.j2k, *.jp2, *.jpf, and *.jpg2 (Debian:
    [#859774])
  * eog: Associate with *.j2c and *.jpg2
  * Bump copyright years
  * xine etc: Associate uppercase *.WM[AV]
  * mplayer: Associate *.weba (#112)
  * xine etc: Associate *.webm and *.weba (#112)
- Modify patches
  * FOO-dir-completion-boo905348.patch
  * PS1-completion-boo903362.patch
  * backtick-completion-boo940835.patch
  * backticks-bsc963140.patch
  * bash-completion-2.4.patch
  * bash-completion.changes
  * bash-completion.spec
  * ls-completion-boo889319.patch
  * respect-variables-boo940837.patch
  * rm-completion-smart-boo958462.patch
  * sh-script-completion-boo977336.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1513598400">- Remove rfkill conflicting with util-linux-2.31.</changelog>
  <changelog author="werner@suse.de" date="1540209600">- Modify patch PS1-completion-boo903362.patch to make it work with
  mksh as well (boo#1104531)</changelog>
  <changelog author="werner@suse.de" date="1633348800">- Add patch boo1190929-9af4afd0.patch for boo#1190929
  modinfo completion fails to recognize .ko.xz</changelog>
</package>
<package pkgid="0cde2c0e9005b36a1f198c3f03ce6ec82e8b7935367bb89204605c39e02e404c" name="bash-completion" arch="src">
  <version epoch="0" ver="2.7" rel="4.6.1"/>
  <changelog author="werner@suse.de" date="1439380800">- Correct typo in patch ls-completion-boo889319.patch</changelog>
  <changelog author="werner@suse.de" date="1439467200">- Add patch backtick-completion-boo940835.patch to allow correct
  backtick completion (boo#940835)</changelog>
  <changelog author="werner@suse.de" date="1443009600">- Add patch LVM-completion-bsc946875.patch to make LVM comands
  work even without any scan happen (bsc#946875)</changelog>
  <changelog author="werner@suse.de" date="1450440000">- Add patch respect-variables-boo940837.patch to avoid completions
  which results in e.g. ls \$HO
- Add patch rm-completion-smart-boo958462.patch to allow completions
  list e.g. rm prefix*.jpg&lt;TAB&gt;&lt;TAB&gt;
- Modify patch LVM-completion-bsc946875.patch that is add the
  new patch from Liuhua Wang</changelog>
  <changelog author="werner@suse.de" date="1453896000">- Add patch backticks-bsc963140.patch to handle sub commands
  which will be expanded by backticks (bsc#963140)</changelog>
  <changelog author="werner@suse.de" date="1461758400">- Add documentation for this packages below to get the reference
  of the e.g. the variable COMP_FILEDIR_FALLBACK (boo#977336)</changelog>
  <changelog author="werner@suse.de" date="1461758401">- Add patch sh-script-completion-boo977336.patch to make _filedir
  work with COMP_FILEDIR_FALLBACK even if local directries exists
  this is for bug boo##977336</changelog>
  <changelog author="sbrabec@suse.com" date="1461758402">- Remove completions conflicting with util-linux (boo#977259#c3).</changelog>
  <changelog author="werner@suse.de" date="1463572800">- Split off sub packages devel and doc to avoid dependency cycles</changelog>
  <changelog author="sbrabec@suse.com" date="1463572801">- Split doc build into a separate spec file. It makes possible to
  build package in two stages and prevent build loop.</changelog>
  <changelog author="tchvatal@suse.com" date="1472040000">- Mark the documentation as noarch</changelog>
  <changelog author="werner@suse.de" date="1481716800">- Change upstream home to https://github.com/scop/bash-completion
- Update to version 2.4
  * xetex, xelatex, luatex, lualatex: Associate with tex files
  * Support pod document files for perldoc (#39)
  * tipc: add tipc completions
  * rpm: Offer --filetriggers with -q
  * javadoc: Add bunch of option arg (non)completions
  * lrzip: Add -m arg noncompletion
  * pypy*: Add basic --jit arg completion
  * pypy3: Alias to python
  * hcitool,svcadm,tar: Spelling fixes
  * tipc: Invoke ls with "command"
  * tipc: Indentation fix
  * abook: Parse long options from command including full path
  * pyvenv: New completion
  * chroot: New (generic long options) completion, see #38
  * aptitude: List packages using _apt_cache_packages, fixes #33
  * vncviewer: Cleanup shopt use, drop an eval
  * make: Avoid a grep
  * rpm: Fix --whatenhances arg completion
  * aspell, minicom, mysql: Replace use of ls with printf
  * The BitKeeper completion used the wrong set of commands
  * Completion for python zip archives
  * lvm: pvcreate should be able to use all block devcices
  * lvm: fix all commands that should get all PVs
  * tar: Detect GNU/other from --version only once per session
  * tar: Remove unused variable
  * tar: Fix GNU tar help output parsing regex, fixes #15
  * tar: Don't write to /tmp/jetel
  * python: Simplify code
  * python: Complete all files also after -m
  * python: Don't offer options after -c
  * python: Complete all files only if -c is before current word
  * unzip, zipinfo: Complete on *.pyz
  * _lvm: using a single-pattern case and invoking function according
    to words[1]
  * lvm: _lvm_count_args parameter must be quoted in order to failglob
    not to complain
  * gendiff: Quoting suffix pattern to avoid triggering failglob
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (Alioth:
    [#314709])
  * Refactor bts and uscan, since they use common functions
  * uscan: New completion, thanks to Federico Ceratto
  * bts: New completion, thanks to Federico Ceratto.
  * nmcli completion was integrated upstream
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (take 2)
    (Alioth: #314709)
  * umount: Fix mount points escaping/unescaping with Bash-4.3
  * slapt-src: Handle --config=FILE option properly
  * sbopkg, slapt-{get,src}: expand tilde in config file name
  * slapt-{get,src}: Fix issue with sed not being able to handle some
    characters
  * slapt-src: split options from their arguments
  * psql: Tell psql to not load .psqlrc as it may change output format
    (Alioth: #314636)
  * mplayer: -dvd-devices takes dvd devices, dirs and .iso files as
    argument
  * 7z: Improve completion
  * f77, f95: Use the same completion as for g77, g95 if they are
    links to gfortran
  * make: Use only posix basic regexps with sed (Alioth: #314345)
  * perl: -d/-dt option argument is optional (Alioth: #314242)
  * Add config for cmake to bash-completion.
  * kcov: Add new sort types, complete --replace-src-path arguments
  * feh: Add new sort type
  * man: Use -w instead of --path
  * chronyc: Update help text parsing
  * chronyc: Add missing subcommands
  * chronyc: Add -6 option
  * minicom: Recognize user ~/.minirc.* as config files
  * rpmbuild: Complete *.spec on --clean (RedHat: #1132959)
  * tar: rework the completion completely
  * portsnap: New completion.
  * modprobe: fix params with multi-line descriptions
  * gdb: support --args style completion (Alioth: #314664)
  * make: Fix basic regex for portability (Alioth: #314345)
  * gnokii: New completion
  * xmllint, xmlwf, xsltproc: Complete on Mallard *.page files
  * pypy: New completion identical to python (Alioth: #314501)
  * make: Don't pick up variables when makefile is reloaded
  * make: Offer hidden targets when it is clear that the user is
    trying to complete one of them
  * make: Fix detection of intermediate targets where make has changed
    its database whitespace
  * make: completion shouldn't be confused by the output of $(info
    confuse: make)
  * zopflipng: New completion
  * ssh: Extract duplicate code to _ssh_configfile
  * gnokii, minicom: Use grep through "command"
  * Update URLs and various instructions to GitHub
  * ssh: Avoid completing commands before hostname
  * chronyc: Parse command args from help output
  * chronyc: Wrap long lines
  * Load completions also from $XDG_DATA_DIRS (RedHat: #1264094)
  * (testsuite) Ignore files generated by complete-ant-cmd.pl
  * scp, sftp: Complete -S on commands
  * scp, sftp: Fix querying ssh options
  * sftp: Add -l arg non-completion
  * ssh-copy-id: Offer only *.pub to -i
  * mpv: Remove mplayer-aliased completion
  * modplug*: Associate *.oct and *.okt
  * rpm: Add --whatenhances/recommends/suggests/supplements and
  - -recommends/supplements completions
  * pgrep, pidof, pkill, pwdx, vmstat: Add support for procps-ng
  * pdftotext: New completion
  * checksec: New completion
  * ssh: Complete HostbasedKeyTypes,HostKeyAlgorithms,KexAlgorithms
    values
  * ssh: Query ciphers and macs from ssh before hardcoded fallback
  * ssh: Add -Q argument completion
  * sysctl: Return early on --help, --version
  * sysctl: Try parsing options from help before usage
  * eog: Complete on *.ppm (RedHat: #1090481)
  * tar: Plug $line var leak
  * tar: Style tweaks
  * bsdtar, tar: Remove symlinks from git, have make create them
  * jshint: New completion
  * gnokii: Include and install it
  * gnokii: Fix completions of options that are prefixes for others
  * gnokii: Drop dead code
  * (testsuite): Add basic gnokii test case
  * gnokii: Various minor and cosmetic fixes
  * Load user completions from $BASH_COMPLETION_USER_DIR/completions
  * synclient: New completion
  * tune2fs: Add missing return in -M arg completion
  * reptyr: Rename file to _reptyr to avoid conflict with upstreamed
    completion
  * dropuser: New completion
  * createuser: New completion
  * createdb, dropdb: Drop -o default, it does not appear to do
    anything good here
  * tshark: Simplify cut usage
  * mcrypt: Simplify -m arg completion
  * strings: Fix -T/--target arg completion with non-English locale
  * chrome, firefox etc: Complete on *.pdf
  * ccache: Add -o/--set-config arg name completion
  * gphoto2: Replace tail with awk
  * gphoto2: Fix split argument handing, and colon treatment in --port
    args
  * Actually install the lz4 completion
  * _pnames: Add -s for producing (possibly) truncated names (RedHat:
    [#744406])
  * (testsuite) Add cd in dir without subdirs or CDPATH test case
  * Protect various compgen invocations from -* leakage (Debian:
    [#766163])
  * pigz, unpigz: Handle *.zz
  * rpmbuild: Complete *.spec on --nobuild
  * mplayer, *xine: Complete on *.mts (Debian: #759219)
  * ant: Support buildfile set in $ANT_ARGS (Alioth: #314735)
  * ant: Don't offer more completions after options that exit
  * 7z, adb: Trivial cleanups
  * python(3): Add -X argument non-completion
  * xsltproc. TODO fix for previous commit
  * xmllint, xmlwf, xsltproc: Complete on *.dbk and *.docbook (Alioth:
    [#314770])
  * xz: Complete -T/--threads argument
  * adb: New completion
  * modprobe: Try parsing help before using hardcoding option list
  * mpv: New completion alias + adjustments for mplayer (Debian:
    [#749115])
  * hostname: New completion
  * nslookup: complete on hosts (Alioth: #314673)
  * eog: Complete on *.pgm (RedHat: #1090481)
  * pngfix: New completion
  * qemu: Fix -balloon arg completion
  * qemu: Apply completion to qemu-kvm/-system-i386/-system-x86_64 too
  * xrandr: Use the invoked command internally, not hardcoded "xrandr"
  * xrandr: Add (some) --setprovider* arg completion support
  * ri: Fix class completion with ri &gt;= 3.
  * ri: Fix colon handling in class completion.
  * flake8: New completion
  * pyflakes: New completion
  * cal,chfn,chsh,dmesg,eject,hexdump,look,newgrp,renice,runuser,su,wr
    ite: Deprecate on Linux in favor of util-linux ones (Debian:
    [#737672])
  * hwclock,ionice,rtcwake: Deprecate in favor of util-linux ones
    (Debian: #737672)
  * ssh-keygen: New completion
  * jpegoptim: New completion
  * ip: Add some addr, addrlabel, and route arg completions
  * aptitude, dpkg: Replace some grep+cuts with awk
  * gcc, lintian, make, pkgadd, slackpkg: grep -&gt; "command grep"
    (Debian: #734095)
  * lintian: Replace some grep+cuts with awk
  * lz4: New completion.
  * optipng: New completion.
  * cppcheck: Include - in --file-list completions.
  * wtf: Look for acronym db from /usr/share/games/bsdgames/acronyms
    too.
  * wtf: Don't offer -f if it was already specified.
  * wtf: Hush stderr when db file doesn't exist.
  * appdata-validate: New completion.
  * timeout: New completion.
  * abook, kldunload: Pre-expand \t instead of relying on sed
    supporting it.
  * dict: Trivial regex cleanup.
  * zopfli: New completion.
  * bzip2, gzip, lzma: Cleanups.
  * 2to3: New completion.
  * file-roller: Reuse unzip's xspec.
  * 7z: New completion.
  * hcitool, rfcomm, ciptool, hciconfig: Don't leak $args.
  * perl: Fix -dt: completion.
  * perl*: Fix handling of relative paths in @INC.
  * wget: Add --accept-regex/--reject-regex/--regex-type arg
    (non)completions.
  * wget: Drop incorrect -nv arg completion.
  * wget: Stop completing after --help/--version.
  * Clean up/compact various globs.
  * cvs: Fix checkout -j non-completion.
  * sh: Complete script arguments with all filenames (Alioth:
    [#314226]).
  * nmcli: Deprecate our completion, upstream has one in 0.9.8.0.
  * cvs rm: Don't filter existing files with -f (RedHat: #949479).
- Drop patches now upstream
  init-completion-boo922758.patch
  pushd-completion-bnc818365.patch
- Rename patches
  bash-completion-2.1.patch becomes bash-completion-2.4.patch
- Port the patches to newer version 2.4
  FOO-dir-completion-boo905348.patch
  LVM-completion-bsc946875.patch
  PS1-completion-boo903362.patch
  backtick-completion-boo940835.patch
  backticks-bsc963140.patch
  ls-completion-boo889319.patch
  respect-variables-boo940837.patch
  rm-completion-smart-boo958462.patch
  sh-script-completion-boo977336.patch
- Only remove completion for umount/mount for older SUSE versions (boo#995045)</changelog>
  <changelog author="werner@suse.de" date="1481716801">- Add patch tar-completion.patch to allow mixed options with long
  and short options (boo#1012212)</changelog>
  <changelog author="werner@suse.de" date="1481803200">- Fix cut&amp;paste error in final ls completion</changelog>
  <changelog author="werner@suse.de" date="1481803201">- Detect if the completions for mount/umount have to be removed
  for modern util-linux package but without using suse_version</changelog>
  <changelog author="nico.kruber@gmail.com" date="1496145600">- Update to version 2.5
  * Support for python gui source files (#91)
  * mr: New completion
  * ssh-keygen: support ed25519 keys (#79)
  * Add sidedoor to _ssh() completion (#106)
  * .ipa is just a zip file and we should let unzip handle it (#71)
  * ant: parse targets in imported buildfiles (#84)
  * Add more tests for ccache
  * ccache: fix completing compiler's flags
  * test suite: Add java/javac non-completion fixture
  * javac: Complete -cp like -classpath
  * travis: Skip bluez and nis for now due to post-install script
    issues
  * test/config/*: Delete trailing whitespace
  * (test suite): Avoid loading user's ~/.bash_completion, fixes #87
  * ip: Recognize a as alias for address and l for link
  * ip: Recognize address in addition to addr
  * mr: Disable "clean" test case, command N/A before mr 1.20141023
  * ssh-keygen: Parse switches with _parse_usage, not _parse_help
  * mplayer: Associate with *.mjpg, *.mjpeg (Debian: #837779)
  * dd: Sync completions with coreutils 8.24
  * travis: Add mr
  * perl: Remove full path to cat in PERLDOC_PAGER call
  * deja-dup: New completion
  * CONTRIBUTING: Reorder sections
  * *: Move indentation settings to .editorconfig
  * make: Declare _make_target_extract_script like other functions
  * Travis: zopfli is AWOL?
  * *: Whitespace fixes
  * Minor edits to README.md (mostly formatting) (#110)
  * Fix bug in 'make' completion when using BSD sed (#108)
  * Add support for Include in ssh config (#70) (#80)
- adapt LVM-completion-bsc946875.patch</changelog>
  <changelog author="werner@suse.de" date="1499169600">- Update to version 2.7
  * Makefile: update default compatdir (#132)
  * Make user completion file configurable, disable in tests
  * test suite: Generalize xspec completion install check
  * pyflakes: Remove redundant xspec completion
  * test suite: Fix __expand_tilde_by_ref test expectation output
  * pdfunite: New *.pdf completion
  + bash-completion (2.6)
  * Add missing sidedoor to .gitignore (#114)
  * test suite: Mark expected centos6 CI _filedir failures as such
  * Expose version in BASH_COMPLETION_VERSINFO, use it in profile.d
    script
  * test suite: Skip an expected make test case failure in centos6 CI
  * test suite: Fix ifdown and ifup CI test skipping
  * test suite: Ignore env var pulled in by use of scp in tests
  * test suite: If colon trim doesn't do anything, trim as usual
  * tar: Comment spelling fixes
  * test suite: Mark dpkg -L test case untested if no packages
    installed
  * test suite: Cosmetic tweaks
  * dpkg: Fix dpkg -i home dir completion
  * test suite: Improve ls home dir test descriptions
  * python: Split module completion to separate helper
  * micropython: New completion, aliased from python
  * test suite: Add Python module completion test case
  * python: Fix traceback avoidance on module completion error
  * openssl: Parse available digests from dgst -h
  * openssl: Add sha2 commands
  * gm: New completion, commands only for now
  * (test suite): Test screen -T completions
  * (test suite): Set TERM to dumb, not dummy
  * Revert "(test suite): Fix alias and cd cursor position tests"
  * mplayer: Remove duplicate *.m4a and *.m4v associations
  * mplayer, xine, etc: Associate *.mp4a and *.mp4v
  * xine etc: Fix *.m4a association
  * bind: Add option and argument (non-)completions
  * _user_at_host: Set nospace only when completing username part
  * _user_at_host: Append @ suffix to username part completions
  * man: Don't check OSTYPE or GNU userland, just enable on all
    systems
  * (test suite): Set dcop result to untested if dcop server is not
    running
  * (test suite): Don't insist on loading all completions dynamically
  * _configured_interfaces: Parse from /etc/network/interfaces.d/* on
    Debian
  * py.test: New completion
  * oowriter: Associate with *.pdf
  * Don't define BASH_COMPLETION_COMPAT_DIR
  * ri: Add option and arg completions
  * (test suite): Add our own dummy ri test fixture
  * (test suite): Info test needs docs, don't exclude from CentOS
  * (test suite): Fix CentOS 6 tcllib setup
  * (test suite): Simplify renice test, fix with only one completion
  * (test suite): Don't assume configured interfaces in CI setups
  * Don't offer * as configured interface when there are none
  * (test suite): Add basic CentOS 6 container for bash 4.1 coverage
  * (test suite): Ignore runtime loaded env function changes
  * (test suite): Add mailman bin dir to PATH for arch test
  * arch: Parse options from --help
  * (test suite): Load tested completions dynamically
  * (test suite): Accept non-whitespace single word in
    assert_complete_any
  * (test suite): Avoid interference from user and system dirs (#87)
  * (test suite): Install some things N/A in ubuntu14 to fedoradev
  * (test suite): Add unrar to ubuntu14 container
  * (test suite): Fix alias and cd cursor position tests
  * (test suite): Add basic alpine test case
  * alpine: Parse opts from -h output, add some opt arg completions
  * (test suite): Install jshint globally in ubuntu14
  * (test suite): Add mailman bin dir to PATH for some mailman tools
  * (test suite): Install jshint to ubuntu14 container with npm
  * unshunt: Parse options from --help
  * (test suite): Test lsof on ubuntu14
  * (test suite): Add basic hping3 test case
  * (test suite): Add our ./configure to PATH to test it, test opts
  * (test suite): Add bunch of packages to ubuntu14 container
  * (test suite): Ensure /usr/(local/)games is in $PATH
  * (test suite): Fix perl -d* test cases with no Devel::* installed
  * (test suite): curl has lots of options, add more test prefix
  * (test suite): Fix tar test case for ones having --owner-map
  * (test suite): Unsupport various kill, renice cases if ps is N/A
  * (test suite): Make chkconfig test behave better in container
  * (test suite): Don't assume mounted filesystems in quota* tests
  * newlist: Parse options from --help, add some arg non-completions
  * (test suite): Delete trailing whitespace
  * (test suite): Don't assume lists set up in newlist test cases
  * (docker): Pull in missing fedoradev xvfb-run which dependency
  * mr: Avoid stderr trash and test suite failure if man is N/A
  * (test suite): Fix mmsitepass completion test
  * tshark -G: Avoid stderr noise when running as superuser
  * (docker): Run completion tests with xvfb-run, e.g. for gkrellm
  * ssh-keygen: Make option parsing work with OpenSSH &lt; 7
  * synclient, udevadm: Avoid use of posix char classes for awk
  * test suite: Add WIP Fedora dev config
  * Travis: Switch tests to docker, update to Ubuntu 14
  * xv: Associate with *.j2c, *.j2k, *.jp2, *.jpf, and *.jpg2 (Debian:
    [#859774])
  * eog: Associate with *.j2c and *.jpg2
  * Bump copyright years
  * xine etc: Associate uppercase *.WM[AV]
  * mplayer: Associate *.weba (#112)
  * xine etc: Associate *.webm and *.weba (#112)
- Modify patches
  * FOO-dir-completion-boo905348.patch
  * PS1-completion-boo903362.patch
  * backtick-completion-boo940835.patch
  * backticks-bsc963140.patch
  * bash-completion-2.4.patch
  * bash-completion.changes
  * bash-completion.spec
  * ls-completion-boo889319.patch
  * respect-variables-boo940837.patch
  * rm-completion-smart-boo958462.patch
  * sh-script-completion-boo977336.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1513598400">- Remove rfkill conflicting with util-linux-2.31.</changelog>
  <changelog author="werner@suse.de" date="1540209600">- Modify patch PS1-completion-boo903362.patch to make it work with
  mksh as well (boo#1104531)</changelog>
  <changelog author="werner@suse.de" date="1633348800">- Add patch boo1190929-9af4afd0.patch for boo#1190929
  modinfo completion fails to recognize .ko.xz</changelog>
</package>
<package pkgid="6268fec746e9d867d00787b3931e581663ae5563241c536fa1afe6fa00f15cbc" name="bash-completion-devel" arch="noarch">
  <version epoch="0" ver="2.7" rel="4.6.1"/>
  <changelog author="werner@suse.de" date="1439380800">- Correct typo in patch ls-completion-boo889319.patch</changelog>
  <changelog author="werner@suse.de" date="1439467200">- Add patch backtick-completion-boo940835.patch to allow correct
  backtick completion (boo#940835)</changelog>
  <changelog author="werner@suse.de" date="1443009600">- Add patch LVM-completion-bsc946875.patch to make LVM comands
  work even without any scan happen (bsc#946875)</changelog>
  <changelog author="werner@suse.de" date="1450440000">- Add patch respect-variables-boo940837.patch to avoid completions
  which results in e.g. ls \$HO
- Add patch rm-completion-smart-boo958462.patch to allow completions
  list e.g. rm prefix*.jpg&lt;TAB&gt;&lt;TAB&gt;
- Modify patch LVM-completion-bsc946875.patch that is add the
  new patch from Liuhua Wang</changelog>
  <changelog author="werner@suse.de" date="1453896000">- Add patch backticks-bsc963140.patch to handle sub commands
  which will be expanded by backticks (bsc#963140)</changelog>
  <changelog author="werner@suse.de" date="1461758400">- Add documentation for this packages below to get the reference
  of the e.g. the variable COMP_FILEDIR_FALLBACK (boo#977336)</changelog>
  <changelog author="werner@suse.de" date="1461758401">- Add patch sh-script-completion-boo977336.patch to make _filedir
  work with COMP_FILEDIR_FALLBACK even if local directries exists
  this is for bug boo##977336</changelog>
  <changelog author="sbrabec@suse.com" date="1461758402">- Remove completions conflicting with util-linux (boo#977259#c3).</changelog>
  <changelog author="werner@suse.de" date="1463572800">- Split off sub packages devel and doc to avoid dependency cycles</changelog>
  <changelog author="sbrabec@suse.com" date="1463572801">- Split doc build into a separate spec file. It makes possible to
  build package in two stages and prevent build loop.</changelog>
  <changelog author="tchvatal@suse.com" date="1472040000">- Mark the documentation as noarch</changelog>
  <changelog author="werner@suse.de" date="1481716800">- Change upstream home to https://github.com/scop/bash-completion
- Update to version 2.4
  * xetex, xelatex, luatex, lualatex: Associate with tex files
  * Support pod document files for perldoc (#39)
  * tipc: add tipc completions
  * rpm: Offer --filetriggers with -q
  * javadoc: Add bunch of option arg (non)completions
  * lrzip: Add -m arg noncompletion
  * pypy*: Add basic --jit arg completion
  * pypy3: Alias to python
  * hcitool,svcadm,tar: Spelling fixes
  * tipc: Invoke ls with "command"
  * tipc: Indentation fix
  * abook: Parse long options from command including full path
  * pyvenv: New completion
  * chroot: New (generic long options) completion, see #38
  * aptitude: List packages using _apt_cache_packages, fixes #33
  * vncviewer: Cleanup shopt use, drop an eval
  * make: Avoid a grep
  * rpm: Fix --whatenhances arg completion
  * aspell, minicom, mysql: Replace use of ls with printf
  * The BitKeeper completion used the wrong set of commands
  * Completion for python zip archives
  * lvm: pvcreate should be able to use all block devcices
  * lvm: fix all commands that should get all PVs
  * tar: Detect GNU/other from --version only once per session
  * tar: Remove unused variable
  * tar: Fix GNU tar help output parsing regex, fixes #15
  * tar: Don't write to /tmp/jetel
  * python: Simplify code
  * python: Complete all files also after -m
  * python: Don't offer options after -c
  * python: Complete all files only if -c is before current word
  * unzip, zipinfo: Complete on *.pyz
  * _lvm: using a single-pattern case and invoking function according
    to words[1]
  * lvm: _lvm_count_args parameter must be quoted in order to failglob
    not to complain
  * gendiff: Quoting suffix pattern to avoid triggering failglob
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (Alioth:
    [#314709])
  * Refactor bts and uscan, since they use common functions
  * uscan: New completion, thanks to Federico Ceratto
  * bts: New completion, thanks to Federico Ceratto.
  * nmcli completion was integrated upstream
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (take 2)
    (Alioth: #314709)
  * umount: Fix mount points escaping/unescaping with Bash-4.3
  * slapt-src: Handle --config=FILE option properly
  * sbopkg, slapt-{get,src}: expand tilde in config file name
  * slapt-{get,src}: Fix issue with sed not being able to handle some
    characters
  * slapt-src: split options from their arguments
  * psql: Tell psql to not load .psqlrc as it may change output format
    (Alioth: #314636)
  * mplayer: -dvd-devices takes dvd devices, dirs and .iso files as
    argument
  * 7z: Improve completion
  * f77, f95: Use the same completion as for g77, g95 if they are
    links to gfortran
  * make: Use only posix basic regexps with sed (Alioth: #314345)
  * perl: -d/-dt option argument is optional (Alioth: #314242)
  * Add config for cmake to bash-completion.
  * kcov: Add new sort types, complete --replace-src-path arguments
  * feh: Add new sort type
  * man: Use -w instead of --path
  * chronyc: Update help text parsing
  * chronyc: Add missing subcommands
  * chronyc: Add -6 option
  * minicom: Recognize user ~/.minirc.* as config files
  * rpmbuild: Complete *.spec on --clean (RedHat: #1132959)
  * tar: rework the completion completely
  * portsnap: New completion.
  * modprobe: fix params with multi-line descriptions
  * gdb: support --args style completion (Alioth: #314664)
  * make: Fix basic regex for portability (Alioth: #314345)
  * gnokii: New completion
  * xmllint, xmlwf, xsltproc: Complete on Mallard *.page files
  * pypy: New completion identical to python (Alioth: #314501)
  * make: Don't pick up variables when makefile is reloaded
  * make: Offer hidden targets when it is clear that the user is
    trying to complete one of them
  * make: Fix detection of intermediate targets where make has changed
    its database whitespace
  * make: completion shouldn't be confused by the output of $(info
    confuse: make)
  * zopflipng: New completion
  * ssh: Extract duplicate code to _ssh_configfile
  * gnokii, minicom: Use grep through "command"
  * Update URLs and various instructions to GitHub
  * ssh: Avoid completing commands before hostname
  * chronyc: Parse command args from help output
  * chronyc: Wrap long lines
  * Load completions also from $XDG_DATA_DIRS (RedHat: #1264094)
  * (testsuite) Ignore files generated by complete-ant-cmd.pl
  * scp, sftp: Complete -S on commands
  * scp, sftp: Fix querying ssh options
  * sftp: Add -l arg non-completion
  * ssh-copy-id: Offer only *.pub to -i
  * mpv: Remove mplayer-aliased completion
  * modplug*: Associate *.oct and *.okt
  * rpm: Add --whatenhances/recommends/suggests/supplements and
  - -recommends/supplements completions
  * pgrep, pidof, pkill, pwdx, vmstat: Add support for procps-ng
  * pdftotext: New completion
  * checksec: New completion
  * ssh: Complete HostbasedKeyTypes,HostKeyAlgorithms,KexAlgorithms
    values
  * ssh: Query ciphers and macs from ssh before hardcoded fallback
  * ssh: Add -Q argument completion
  * sysctl: Return early on --help, --version
  * sysctl: Try parsing options from help before usage
  * eog: Complete on *.ppm (RedHat: #1090481)
  * tar: Plug $line var leak
  * tar: Style tweaks
  * bsdtar, tar: Remove symlinks from git, have make create them
  * jshint: New completion
  * gnokii: Include and install it
  * gnokii: Fix completions of options that are prefixes for others
  * gnokii: Drop dead code
  * (testsuite): Add basic gnokii test case
  * gnokii: Various minor and cosmetic fixes
  * Load user completions from $BASH_COMPLETION_USER_DIR/completions
  * synclient: New completion
  * tune2fs: Add missing return in -M arg completion
  * reptyr: Rename file to _reptyr to avoid conflict with upstreamed
    completion
  * dropuser: New completion
  * createuser: New completion
  * createdb, dropdb: Drop -o default, it does not appear to do
    anything good here
  * tshark: Simplify cut usage
  * mcrypt: Simplify -m arg completion
  * strings: Fix -T/--target arg completion with non-English locale
  * chrome, firefox etc: Complete on *.pdf
  * ccache: Add -o/--set-config arg name completion
  * gphoto2: Replace tail with awk
  * gphoto2: Fix split argument handing, and colon treatment in --port
    args
  * Actually install the lz4 completion
  * _pnames: Add -s for producing (possibly) truncated names (RedHat:
    [#744406])
  * (testsuite) Add cd in dir without subdirs or CDPATH test case
  * Protect various compgen invocations from -* leakage (Debian:
    [#766163])
  * pigz, unpigz: Handle *.zz
  * rpmbuild: Complete *.spec on --nobuild
  * mplayer, *xine: Complete on *.mts (Debian: #759219)
  * ant: Support buildfile set in $ANT_ARGS (Alioth: #314735)
  * ant: Don't offer more completions after options that exit
  * 7z, adb: Trivial cleanups
  * python(3): Add -X argument non-completion
  * xsltproc. TODO fix for previous commit
  * xmllint, xmlwf, xsltproc: Complete on *.dbk and *.docbook (Alioth:
    [#314770])
  * xz: Complete -T/--threads argument
  * adb: New completion
  * modprobe: Try parsing help before using hardcoding option list
  * mpv: New completion alias + adjustments for mplayer (Debian:
    [#749115])
  * hostname: New completion
  * nslookup: complete on hosts (Alioth: #314673)
  * eog: Complete on *.pgm (RedHat: #1090481)
  * pngfix: New completion
  * qemu: Fix -balloon arg completion
  * qemu: Apply completion to qemu-kvm/-system-i386/-system-x86_64 too
  * xrandr: Use the invoked command internally, not hardcoded "xrandr"
  * xrandr: Add (some) --setprovider* arg completion support
  * ri: Fix class completion with ri &gt;= 3.
  * ri: Fix colon handling in class completion.
  * flake8: New completion
  * pyflakes: New completion
  * cal,chfn,chsh,dmesg,eject,hexdump,look,newgrp,renice,runuser,su,wr
    ite: Deprecate on Linux in favor of util-linux ones (Debian:
    [#737672])
  * hwclock,ionice,rtcwake: Deprecate in favor of util-linux ones
    (Debian: #737672)
  * ssh-keygen: New completion
  * jpegoptim: New completion
  * ip: Add some addr, addrlabel, and route arg completions
  * aptitude, dpkg: Replace some grep+cuts with awk
  * gcc, lintian, make, pkgadd, slackpkg: grep -&gt; "command grep"
    (Debian: #734095)
  * lintian: Replace some grep+cuts with awk
  * lz4: New completion.
  * optipng: New completion.
  * cppcheck: Include - in --file-list completions.
  * wtf: Look for acronym db from /usr/share/games/bsdgames/acronyms
    too.
  * wtf: Don't offer -f if it was already specified.
  * wtf: Hush stderr when db file doesn't exist.
  * appdata-validate: New completion.
  * timeout: New completion.
  * abook, kldunload: Pre-expand \t instead of relying on sed
    supporting it.
  * dict: Trivial regex cleanup.
  * zopfli: New completion.
  * bzip2, gzip, lzma: Cleanups.
  * 2to3: New completion.
  * file-roller: Reuse unzip's xspec.
  * 7z: New completion.
  * hcitool, rfcomm, ciptool, hciconfig: Don't leak $args.
  * perl: Fix -dt: completion.
  * perl*: Fix handling of relative paths in @INC.
  * wget: Add --accept-regex/--reject-regex/--regex-type arg
    (non)completions.
  * wget: Drop incorrect -nv arg completion.
  * wget: Stop completing after --help/--version.
  * Clean up/compact various globs.
  * cvs: Fix checkout -j non-completion.
  * sh: Complete script arguments with all filenames (Alioth:
    [#314226]).
  * nmcli: Deprecate our completion, upstream has one in 0.9.8.0.
  * cvs rm: Don't filter existing files with -f (RedHat: #949479).
- Drop patches now upstream
  init-completion-boo922758.patch
  pushd-completion-bnc818365.patch
- Rename patches
  bash-completion-2.1.patch becomes bash-completion-2.4.patch
- Port the patches to newer version 2.4
  FOO-dir-completion-boo905348.patch
  LVM-completion-bsc946875.patch
  PS1-completion-boo903362.patch
  backtick-completion-boo940835.patch
  backticks-bsc963140.patch
  ls-completion-boo889319.patch
  respect-variables-boo940837.patch
  rm-completion-smart-boo958462.patch
  sh-script-completion-boo977336.patch
- Only remove completion for umount/mount for older SUSE versions (boo#995045)</changelog>
  <changelog author="werner@suse.de" date="1481716801">- Add patch tar-completion.patch to allow mixed options with long
  and short options (boo#1012212)</changelog>
  <changelog author="werner@suse.de" date="1481803200">- Fix cut&amp;paste error in final ls completion</changelog>
  <changelog author="werner@suse.de" date="1481803201">- Detect if the completions for mount/umount have to be removed
  for modern util-linux package but without using suse_version</changelog>
  <changelog author="nico.kruber@gmail.com" date="1496145600">- Update to version 2.5
  * Support for python gui source files (#91)
  * mr: New completion
  * ssh-keygen: support ed25519 keys (#79)
  * Add sidedoor to _ssh() completion (#106)
  * .ipa is just a zip file and we should let unzip handle it (#71)
  * ant: parse targets in imported buildfiles (#84)
  * Add more tests for ccache
  * ccache: fix completing compiler's flags
  * test suite: Add java/javac non-completion fixture
  * javac: Complete -cp like -classpath
  * travis: Skip bluez and nis for now due to post-install script
    issues
  * test/config/*: Delete trailing whitespace
  * (test suite): Avoid loading user's ~/.bash_completion, fixes #87
  * ip: Recognize a as alias for address and l for link
  * ip: Recognize address in addition to addr
  * mr: Disable "clean" test case, command N/A before mr 1.20141023
  * ssh-keygen: Parse switches with _parse_usage, not _parse_help
  * mplayer: Associate with *.mjpg, *.mjpeg (Debian: #837779)
  * dd: Sync completions with coreutils 8.24
  * travis: Add mr
  * perl: Remove full path to cat in PERLDOC_PAGER call
  * deja-dup: New completion
  * CONTRIBUTING: Reorder sections
  * *: Move indentation settings to .editorconfig
  * make: Declare _make_target_extract_script like other functions
  * Travis: zopfli is AWOL?
  * *: Whitespace fixes
  * Minor edits to README.md (mostly formatting) (#110)
  * Fix bug in 'make' completion when using BSD sed (#108)
  * Add support for Include in ssh config (#70) (#80)
- adapt LVM-completion-bsc946875.patch</changelog>
  <changelog author="werner@suse.de" date="1499169600">- Update to version 2.7
  * Makefile: update default compatdir (#132)
  * Make user completion file configurable, disable in tests
  * test suite: Generalize xspec completion install check
  * pyflakes: Remove redundant xspec completion
  * test suite: Fix __expand_tilde_by_ref test expectation output
  * pdfunite: New *.pdf completion
  + bash-completion (2.6)
  * Add missing sidedoor to .gitignore (#114)
  * test suite: Mark expected centos6 CI _filedir failures as such
  * Expose version in BASH_COMPLETION_VERSINFO, use it in profile.d
    script
  * test suite: Skip an expected make test case failure in centos6 CI
  * test suite: Fix ifdown and ifup CI test skipping
  * test suite: Ignore env var pulled in by use of scp in tests
  * test suite: If colon trim doesn't do anything, trim as usual
  * tar: Comment spelling fixes
  * test suite: Mark dpkg -L test case untested if no packages
    installed
  * test suite: Cosmetic tweaks
  * dpkg: Fix dpkg -i home dir completion
  * test suite: Improve ls home dir test descriptions
  * python: Split module completion to separate helper
  * micropython: New completion, aliased from python
  * test suite: Add Python module completion test case
  * python: Fix traceback avoidance on module completion error
  * openssl: Parse available digests from dgst -h
  * openssl: Add sha2 commands
  * gm: New completion, commands only for now
  * (test suite): Test screen -T completions
  * (test suite): Set TERM to dumb, not dummy
  * Revert "(test suite): Fix alias and cd cursor position tests"
  * mplayer: Remove duplicate *.m4a and *.m4v associations
  * mplayer, xine, etc: Associate *.mp4a and *.mp4v
  * xine etc: Fix *.m4a association
  * bind: Add option and argument (non-)completions
  * _user_at_host: Set nospace only when completing username part
  * _user_at_host: Append @ suffix to username part completions
  * man: Don't check OSTYPE or GNU userland, just enable on all
    systems
  * (test suite): Set dcop result to untested if dcop server is not
    running
  * (test suite): Don't insist on loading all completions dynamically
  * _configured_interfaces: Parse from /etc/network/interfaces.d/* on
    Debian
  * py.test: New completion
  * oowriter: Associate with *.pdf
  * Don't define BASH_COMPLETION_COMPAT_DIR
  * ri: Add option and arg completions
  * (test suite): Add our own dummy ri test fixture
  * (test suite): Info test needs docs, don't exclude from CentOS
  * (test suite): Fix CentOS 6 tcllib setup
  * (test suite): Simplify renice test, fix with only one completion
  * (test suite): Don't assume configured interfaces in CI setups
  * Don't offer * as configured interface when there are none
  * (test suite): Add basic CentOS 6 container for bash 4.1 coverage
  * (test suite): Ignore runtime loaded env function changes
  * (test suite): Add mailman bin dir to PATH for arch test
  * arch: Parse options from --help
  * (test suite): Load tested completions dynamically
  * (test suite): Accept non-whitespace single word in
    assert_complete_any
  * (test suite): Avoid interference from user and system dirs (#87)
  * (test suite): Install some things N/A in ubuntu14 to fedoradev
  * (test suite): Add unrar to ubuntu14 container
  * (test suite): Fix alias and cd cursor position tests
  * (test suite): Add basic alpine test case
  * alpine: Parse opts from -h output, add some opt arg completions
  * (test suite): Install jshint globally in ubuntu14
  * (test suite): Add mailman bin dir to PATH for some mailman tools
  * (test suite): Install jshint to ubuntu14 container with npm
  * unshunt: Parse options from --help
  * (test suite): Test lsof on ubuntu14
  * (test suite): Add basic hping3 test case
  * (test suite): Add our ./configure to PATH to test it, test opts
  * (test suite): Add bunch of packages to ubuntu14 container
  * (test suite): Ensure /usr/(local/)games is in $PATH
  * (test suite): Fix perl -d* test cases with no Devel::* installed
  * (test suite): curl has lots of options, add more test prefix
  * (test suite): Fix tar test case for ones having --owner-map
  * (test suite): Unsupport various kill, renice cases if ps is N/A
  * (test suite): Make chkconfig test behave better in container
  * (test suite): Don't assume mounted filesystems in quota* tests
  * newlist: Parse options from --help, add some arg non-completions
  * (test suite): Delete trailing whitespace
  * (test suite): Don't assume lists set up in newlist test cases
  * (docker): Pull in missing fedoradev xvfb-run which dependency
  * mr: Avoid stderr trash and test suite failure if man is N/A
  * (test suite): Fix mmsitepass completion test
  * tshark -G: Avoid stderr noise when running as superuser
  * (docker): Run completion tests with xvfb-run, e.g. for gkrellm
  * ssh-keygen: Make option parsing work with OpenSSH &lt; 7
  * synclient, udevadm: Avoid use of posix char classes for awk
  * test suite: Add WIP Fedora dev config
  * Travis: Switch tests to docker, update to Ubuntu 14
  * xv: Associate with *.j2c, *.j2k, *.jp2, *.jpf, and *.jpg2 (Debian:
    [#859774])
  * eog: Associate with *.j2c and *.jpg2
  * Bump copyright years
  * xine etc: Associate uppercase *.WM[AV]
  * mplayer: Associate *.weba (#112)
  * xine etc: Associate *.webm and *.weba (#112)
- Modify patches
  * FOO-dir-completion-boo905348.patch
  * PS1-completion-boo903362.patch
  * backtick-completion-boo940835.patch
  * backticks-bsc963140.patch
  * bash-completion-2.4.patch
  * bash-completion.changes
  * bash-completion.spec
  * ls-completion-boo889319.patch
  * respect-variables-boo940837.patch
  * rm-completion-smart-boo958462.patch
  * sh-script-completion-boo977336.patch</changelog>
  <changelog author="sbrabec@suse.com" date="1513598400">- Remove rfkill conflicting with util-linux-2.31.</changelog>
  <changelog author="werner@suse.de" date="1540209600">- Modify patch PS1-completion-boo903362.patch to make it work with
  mksh as well (boo#1104531)</changelog>
  <changelog author="werner@suse.de" date="1633348800">- Add patch boo1190929-9af4afd0.patch for boo#1190929
  modinfo completion fails to recognize .ko.xz</changelog>
</package>
<package pkgid="7e1ef2319b668daaceb6bb87f4ec8f821ccd58f7d4ba4e4f0d67baf3d0c18a1c" name="bash-completion-doc" arch="noarch">
  <version epoch="0" ver="2.7" rel="4.6.1"/>
  <changelog author="werner@suse.de" date="1416225600">- Add patch PS1-completion-boo903362.patch to avoid trouble if
  restricted characters of the shell are used in PS1 like
  exclamation mark (boo#903362).
- Add patch FOO-dir-completion-boo905348.patch to expand variables
  which value is actual a directory to avoid excaped dollar sign
  (boo#905348).</changelog>
  <changelog author="werner@suse.de" date="1426680000">- Port my dollar completion from /etc/profile.d/completion.bash to
  bash_completion which modifies FOO-dir-completion-boo905348.patch
- Avoid negative cword position counter (boo#922758), this adds
  the patch init-completion-boo922758.patch</changelog>
  <changelog author="werner@suse.de" date="1434369600">- Add patch ls-completion-boo889319.patch to make ls completion
  more smart (boo#889319)</changelog>
  <changelog author="werner@suse.de" date="1439380800">- Correct typo in patch ls-completion-boo889319.patch</changelog>
  <changelog author="werner@suse.de" date="1439467200">- Add patch backtick-completion-boo940835.patch to allow correct
  backtick completion (boo#940835)</changelog>
  <changelog author="werner@suse.de" date="1443009600">- Add patch LVM-completion-bsc946875.patch to make LVM comands
  work even without any scan happen (bsc#946875)</changelog>
  <changelog author="werner@suse.de" date="1450440000">- Add patch respect-variables-boo940837.patch to avoid completions
  which results in e.g. ls \$HO
- Add patch rm-completion-smart-boo958462.patch to allow completions
  list e.g. rm prefix*.jpg&lt;TAB&gt;&lt;TAB&gt;
- Modify patch LVM-completion-bsc946875.patch that is add the
  new patch from Liuhua Wang</changelog>
  <changelog author="werner@suse.de" date="1453896000">- Add patch backticks-bsc963140.patch to handle sub commands
  which will be expanded by backticks (bsc#963140)</changelog>
  <changelog author="werner@suse.de" date="1461758400">- Add documentation for this packages below to get the reference
  of the e.g. the variable COMP_FILEDIR_FALLBACK (boo#977336)</changelog>
  <changelog author="werner@suse.de" date="1461758401">- Add patch sh-script-completion-boo977336.patch to make _filedir
  work with COMP_FILEDIR_FALLBACK even if local directries exists
  this is for bug boo##977336</changelog>
  <changelog author="sbrabec@suse.com" date="1461758402">- Remove completions conflicting with util-linux (boo#977259#c3).</changelog>
  <changelog author="werner@suse.de" date="1463572800">- Split off sub packages devel and doc to avoid dependency cycles</changelog>
  <changelog author="sbrabec@suse.com" date="1463572801">- Split doc build into a separate spec file. It makes possible to
  build package in two stages and prevent build loop.</changelog>
  <changelog author="tchvatal@suse.com" date="1472040000">- Mark the documentation as noarch</changelog>
  <changelog author="werner@suse.de" date="1481716800">- Change upstream home to https://github.com/scop/bash-completion
- Update to version 2.4
  * xetex, xelatex, luatex, lualatex: Associate with tex files
  * Support pod document files for perldoc (#39)
  * tipc: add tipc completions
  * rpm: Offer --filetriggers with -q
  * javadoc: Add bunch of option arg (non)completions
  * lrzip: Add -m arg noncompletion
  * pypy*: Add basic --jit arg completion
  * pypy3: Alias to python
  * hcitool,svcadm,tar: Spelling fixes
  * tipc: Invoke ls with "command"
  * tipc: Indentation fix
  * abook: Parse long options from command including full path
  * pyvenv: New completion
  * chroot: New (generic long options) completion, see #38
  * aptitude: List packages using _apt_cache_packages, fixes #33
  * vncviewer: Cleanup shopt use, drop an eval
  * make: Avoid a grep
  * rpm: Fix --whatenhances arg completion
  * aspell, minicom, mysql: Replace use of ls with printf
  * The BitKeeper completion used the wrong set of commands
  * Completion for python zip archives
  * lvm: pvcreate should be able to use all block devcices
  * lvm: fix all commands that should get all PVs
  * tar: Detect GNU/other from --version only once per session
  * tar: Remove unused variable
  * tar: Fix GNU tar help output parsing regex, fixes #15
  * tar: Don't write to /tmp/jetel
  * python: Simplify code
  * python: Complete all files also after -m
  * python: Don't offer options after -c
  * python: Complete all files only if -c is before current word
  * unzip, zipinfo: Complete on *.pyz
  * _lvm: using a single-pattern case and invoking function according
    to words[1]
  * lvm: _lvm_count_args parameter must be quoted in order to failglob
    not to complain
  * gendiff: Quoting suffix pattern to avoid triggering failglob
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (Alioth:
    [#314709])
  * Refactor bts and uscan, since they use common functions
  * uscan: New completion, thanks to Federico Ceratto
  * bts: New completion, thanks to Federico Ceratto.
  * nmcli completion was integrated upstream
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (take 2)
    (Alioth: #314709)
  * umount: Fix mount points escaping/unescaping with Bash-4.3
  * slapt-src: Handle --config=FILE option properly
  * sbopkg, slapt-{get,src}: expand tilde in config file name
  * slapt-{get,src}: Fix issue with sed not being able to handle some
    characters
  * slapt-src: split options from their arguments
  * psql: Tell psql to not load .psqlrc as it may change output format
    (Alioth: #314636)
  * mplayer: -dvd-devices takes dvd devices, dirs and .iso files as
    argument
  * 7z: Improve completion
  * f77, f95: Use the same completion as for g77, g95 if they are
    links to gfortran
  * make: Use only posix basic regexps with sed (Alioth: #314345)
  * perl: -d/-dt option argument is optional (Alioth: #314242)
  * Add config for cmake to bash-completion.
  * kcov: Add new sort types, complete --replace-src-path arguments
  * feh: Add new sort type
  * man: Use -w instead of --path
  * chronyc: Update help text parsing
  * chronyc: Add missing subcommands
  * chronyc: Add -6 option
  * minicom: Recognize user ~/.minirc.* as config files
  * rpmbuild: Complete *.spec on --clean (RedHat: #1132959)
  * tar: rework the completion completely
  * portsnap: New completion.
  * modprobe: fix params with multi-line descriptions
  * gdb: support --args style completion (Alioth: #314664)
  * make: Fix basic regex for portability (Alioth: #314345)
  * gnokii: New completion
  * xmllint, xmlwf, xsltproc: Complete on Mallard *.page files
  * pypy: New completion identical to python (Alioth: #314501)
  * make: Don't pick up variables when makefile is reloaded
  * make: Offer hidden targets when it is clear that the user is
    trying to complete one of them
  * make: Fix detection of intermediate targets where make has changed
    its database whitespace
  * make: completion shouldn't be confused by the output of $(info
    confuse: make)
  * zopflipng: New completion
  * ssh: Extract duplicate code to _ssh_configfile
  * gnokii, minicom: Use grep through "command"
  * Update URLs and various instructions to GitHub
  * ssh: Avoid completing commands before hostname
  * chronyc: Parse command args from help output
  * chronyc: Wrap long lines
  * Load completions also from $XDG_DATA_DIRS (RedHat: #1264094)
  * (testsuite) Ignore files generated by complete-ant-cmd.pl
  * scp, sftp: Complete -S on commands
  * scp, sftp: Fix querying ssh options
  * sftp: Add -l arg non-completion
  * ssh-copy-id: Offer only *.pub to -i
  * mpv: Remove mplayer-aliased completion
  * modplug*: Associate *.oct and *.okt
  * rpm: Add --whatenhances/recommends/suggests/supplements and
  - -recommends/supplements completions
  * pgrep, pidof, pkill, pwdx, vmstat: Add support for procps-ng
  * pdftotext: New completion
  * checksec: New completion
  * ssh: Complete HostbasedKeyTypes,HostKeyAlgorithms,KexAlgorithms
    values
  * ssh: Query ciphers and macs from ssh before hardcoded fallback
  * ssh: Add -Q argument completion
  * sysctl: Return early on --help, --version
  * sysctl: Try parsing options from help before usage
  * eog: Complete on *.ppm (RedHat: #1090481)
  * tar: Plug $line var leak
  * tar: Style tweaks
  * bsdtar, tar: Remove symlinks from git, have make create them
  * jshint: New completion
  * gnokii: Include and install it
  * gnokii: Fix completions of options that are prefixes for others
  * gnokii: Drop dead code
  * (testsuite): Add basic gnokii test case
  * gnokii: Various minor and cosmetic fixes
  * Load user completions from $BASH_COMPLETION_USER_DIR/completions
  * synclient: New completion
  * tune2fs: Add missing return in -M arg completion
  * reptyr: Rename file to _reptyr to avoid conflict with upstreamed
    completion
  * dropuser: New completion
  * createuser: New completion
  * createdb, dropdb: Drop -o default, it does not appear to do
    anything good here
  * tshark: Simplify cut usage
  * mcrypt: Simplify -m arg completion
  * strings: Fix -T/--target arg completion with non-English locale
  * chrome, firefox etc: Complete on *.pdf
  * ccache: Add -o/--set-config arg name completion
  * gphoto2: Replace tail with awk
  * gphoto2: Fix split argument handing, and colon treatment in --port
    args
  * Actually install the lz4 completion
  * _pnames: Add -s for producing (possibly) truncated names (RedHat:
    [#744406])
  * (testsuite) Add cd in dir without subdirs or CDPATH test case
  * Protect various compgen invocations from -* leakage (Debian:
    [#766163])
  * pigz, unpigz: Handle *.zz
  * rpmbuild: Complete *.spec on --nobuild
  * mplayer, *xine: Complete on *.mts (Debian: #759219)
  * ant: Support buildfile set in $ANT_ARGS (Alioth: #314735)
  * ant: Don't offer more completions after options that exit
  * 7z, adb: Trivial cleanups
  * python(3): Add -X argument non-completion
  * xsltproc. TODO fix for previous commit
  * xmllint, xmlwf, xsltproc: Complete on *.dbk and *.docbook (Alioth:
    [#314770])
  * xz: Complete -T/--threads argument
  * adb: New completion
  * modprobe: Try parsing help before using hardcoding option list
  * mpv: New completion alias + adjustments for mplayer (Debian:
    [#749115])
  * hostname: New completion
  * nslookup: complete on hosts (Alioth: #314673)
  * eog: Complete on *.pgm (RedHat: #1090481)
  * pngfix: New completion
  * qemu: Fix -balloon arg completion
  * qemu: Apply completion to qemu-kvm/-system-i386/-system-x86_64 too
  * xrandr: Use the invoked command internally, not hardcoded "xrandr"
  * xrandr: Add (some) --setprovider* arg completion support
  * ri: Fix class completion with ri &gt;= 3.
  * ri: Fix colon handling in class completion.
  * flake8: New completion
  * pyflakes: New completion
  * cal,chfn,chsh,dmesg,eject,hexdump,look,newgrp,renice,runuser,su,wr
    ite: Deprecate on Linux in favor of util-linux ones (Debian:
    [#737672])
  * hwclock,ionice,rtcwake: Deprecate in favor of util-linux ones
    (Debian: #737672)
  * ssh-keygen: New completion
  * jpegoptim: New completion
  * ip: Add some addr, addrlabel, and route arg completions
  * aptitude, dpkg: Replace some grep+cuts with awk
  * gcc, lintian, make, pkgadd, slackpkg: grep -&gt; "command grep"
    (Debian: #734095)
  * lintian: Replace some grep+cuts with awk
  * lz4: New completion.
  * optipng: New completion.
  * cppcheck: Include - in --file-list completions.
  * wtf: Look for acronym db from /usr/share/games/bsdgames/acronyms
    too.
  * wtf: Don't offer -f if it was already specified.
  * wtf: Hush stderr when db file doesn't exist.
  * appdata-validate: New completion.
  * timeout: New completion.
  * abook, kldunload: Pre-expand \t instead of relying on sed
    supporting it.
  * dict: Trivial regex cleanup.
  * zopfli: New completion.
  * bzip2, gzip, lzma: Cleanups.
  * 2to3: New completion.
  * file-roller: Reuse unzip's xspec.
  * 7z: New completion.
  * hcitool, rfcomm, ciptool, hciconfig: Don't leak $args.
  * perl: Fix -dt: completion.
  * perl*: Fix handling of relative paths in @INC.
  * wget: Add --accept-regex/--reject-regex/--regex-type arg
    (non)completions.
  * wget: Drop incorrect -nv arg completion.
  * wget: Stop completing after --help/--version.
  * Clean up/compact various globs.
  * cvs: Fix checkout -j non-completion.
  * sh: Complete script arguments with all filenames (Alioth:
    [#314226]).
  * nmcli: Deprecate our completion, upstream has one in 0.9.8.0.
  * cvs rm: Don't filter existing files with -f (RedHat: #949479).
- Drop patches now upstream
  init-completion-boo922758.patch
  pushd-completion-bnc818365.patch
- Rename patches
  bash-completion-2.1.patch becomes bash-completion-2.4.patch
- Port the patches to newer version 2.4
  FOO-dir-completion-boo905348.patch
  LVM-completion-bsc946875.patch
  PS1-completion-boo903362.patch
  backtick-completion-boo940835.patch
  backticks-bsc963140.patch
  ls-completion-boo889319.patch
  respect-variables-boo940837.patch
  rm-completion-smart-boo958462.patch
  sh-script-completion-boo977336.patch
- Only remove completion for umount/mount for older SUSE versions (boo#995045)</changelog>
  <changelog author="werner@suse.de" date="1481716801">- Add patch tar-completion.patch to allow mixed options with long
  and short options (boo#1012212)</changelog>
  <changelog author="werner@suse.de" date="1481803200">- Fix cut&amp;paste error in final ls completion</changelog>
  <changelog author="werner@suse.de" date="1481803201">- Detect if the completions for mount/umount have to be removed
  for modern util-linux package but without using suse_version</changelog>
  <changelog author="nico.kruber@gmail.com" date="1496145600">- Update to version 2.5
  * Support for python gui source files (#91)
  * mr: New completion
  * ssh-keygen: support ed25519 keys (#79)
  * Add sidedoor to _ssh() completion (#106)
  * .ipa is just a zip file and we should let unzip handle it (#71)
  * ant: parse targets in imported buildfiles (#84)
  * Add more tests for ccache
  * ccache: fix completing compiler's flags
  * test suite: Add java/javac non-completion fixture
  * javac: Complete -cp like -classpath
  * travis: Skip bluez and nis for now due to post-install script
    issues
  * test/config/*: Delete trailing whitespace
  * (test suite): Avoid loading user's ~/.bash_completion, fixes #87
  * ip: Recognize a as alias for address and l for link
  * ip: Recognize address in addition to addr
  * mr: Disable "clean" test case, command N/A before mr 1.20141023
  * ssh-keygen: Parse switches with _parse_usage, not _parse_help
  * mplayer: Associate with *.mjpg, *.mjpeg (Debian: #837779)
  * dd: Sync completions with coreutils 8.24
  * travis: Add mr
  * perl: Remove full path to cat in PERLDOC_PAGER call
  * deja-dup: New completion
  * CONTRIBUTING: Reorder sections
  * *: Move indentation settings to .editorconfig
  * make: Declare _make_target_extract_script like other functions
  * Travis: zopfli is AWOL?
  * *: Whitespace fixes
  * Minor edits to README.md (mostly formatting) (#110)
  * Fix bug in 'make' completion when using BSD sed (#108)
  * Add support for Include in ssh config (#70) (#80)
- adapt LVM-completion-bsc946875.patch</changelog>
  <changelog author="werner@suse.de" date="1499169600">- Update to version 2.7
  * Makefile: update default compatdir (#132)
  * Make user completion file configurable, disable in tests
  * test suite: Generalize xspec completion install check
  * pyflakes: Remove redundant xspec completion
  * test suite: Fix __expand_tilde_by_ref test expectation output
  * pdfunite: New *.pdf completion
  + bash-completion (2.6)
  * Add missing sidedoor to .gitignore (#114)
  * test suite: Mark expected centos6 CI _filedir failures as such
  * Expose version in BASH_COMPLETION_VERSINFO, use it in profile.d
    script
  * test suite: Skip an expected make test case failure in centos6 CI
  * test suite: Fix ifdown and ifup CI test skipping
  * test suite: Ignore env var pulled in by use of scp in tests
  * test suite: If colon trim doesn't do anything, trim as usual
  * tar: Comment spelling fixes
  * test suite: Mark dpkg -L test case untested if no packages
    installed
  * test suite: Cosmetic tweaks
  * dpkg: Fix dpkg -i home dir completion
  * test suite: Improve ls home dir test descriptions
  * python: Split module completion to separate helper
  * micropython: New completion, aliased from python
  * test suite: Add Python module completion test case
  * python: Fix traceback avoidance on module completion error
  * openssl: Parse available digests from dgst -h
  * openssl: Add sha2 commands
  * gm: New completion, commands only for now
  * (test suite): Test screen -T completions
  * (test suite): Set TERM to dumb, not dummy
  * Revert "(test suite): Fix alias and cd cursor position tests"
  * mplayer: Remove duplicate *.m4a and *.m4v associations
  * mplayer, xine, etc: Associate *.mp4a and *.mp4v
  * xine etc: Fix *.m4a association
  * bind: Add option and argument (non-)completions
  * _user_at_host: Set nospace only when completing username part
  * _user_at_host: Append @ suffix to username part completions
  * man: Don't check OSTYPE or GNU userland, just enable on all
    systems
  * (test suite): Set dcop result to untested if dcop server is not
    running
  * (test suite): Don't insist on loading all completions dynamically
  * _configured_interfaces: Parse from /etc/network/interfaces.d/* on
    Debian
  * py.test: New completion
  * oowriter: Associate with *.pdf
  * Don't define BASH_COMPLETION_COMPAT_DIR
  * ri: Add option and arg completions
  * (test suite): Add our own dummy ri test fixture
  * (test suite): Info test needs docs, don't exclude from CentOS
  * (test suite): Fix CentOS 6 tcllib setup
  * (test suite): Simplify renice test, fix with only one completion
  * (test suite): Don't assume configured interfaces in CI setups
  * Don't offer * as configured interface when there are none
  * (test suite): Add basic CentOS 6 container for bash 4.1 coverage
  * (test suite): Ignore runtime loaded env function changes
  * (test suite): Add mailman bin dir to PATH for arch test
  * arch: Parse options from --help
  * (test suite): Load tested completions dynamically
  * (test suite): Accept non-whitespace single word in
    assert_complete_any
  * (test suite): Avoid interference from user and system dirs (#87)
  * (test suite): Install some things N/A in ubuntu14 to fedoradev
  * (test suite): Add unrar to ubuntu14 container
  * (test suite): Fix alias and cd cursor position tests
  * (test suite): Add basic alpine test case
  * alpine: Parse opts from -h output, add some opt arg completions
  * (test suite): Install jshint globally in ubuntu14
  * (test suite): Add mailman bin dir to PATH for some mailman tools
  * (test suite): Install jshint to ubuntu14 container with npm
  * unshunt: Parse options from --help
  * (test suite): Test lsof on ubuntu14
  * (test suite): Add basic hping3 test case
  * (test suite): Add our ./configure to PATH to test it, test opts
  * (test suite): Add bunch of packages to ubuntu14 container
  * (test suite): Ensure /usr/(local/)games is in $PATH
  * (test suite): Fix perl -d* test cases with no Devel::* installed
  * (test suite): curl has lots of options, add more test prefix
  * (test suite): Fix tar test case for ones having --owner-map
  * (test suite): Unsupport various kill, renice cases if ps is N/A
  * (test suite): Make chkconfig test behave better in container
  * (test suite): Don't assume mounted filesystems in quota* tests
  * newlist: Parse options from --help, add some arg non-completions
  * (test suite): Delete trailing whitespace
  * (test suite): Don't assume lists set up in newlist test cases
  * (docker): Pull in missing fedoradev xvfb-run which dependency
  * mr: Avoid stderr trash and test suite failure if man is N/A
  * (test suite): Fix mmsitepass completion test
  * tshark -G: Avoid stderr noise when running as superuser
  * (docker): Run completion tests with xvfb-run, e.g. for gkrellm
  * ssh-keygen: Make option parsing work with OpenSSH &lt; 7
  * synclient, udevadm: Avoid use of posix char classes for awk
  * test suite: Add WIP Fedora dev config
  * Travis: Switch tests to docker, update to Ubuntu 14
  * xv: Associate with *.j2c, *.j2k, *.jp2, *.jpf, and *.jpg2 (Debian:
    [#859774])
  * eog: Associate with *.j2c and *.jpg2
  * Bump copyright years
  * xine etc: Associate uppercase *.WM[AV]
  * mplayer: Associate *.weba (#112)
  * xine etc: Associate *.webm and *.weba (#112)
- Modify patches
  * FOO-dir-completion-boo905348.patch
  * PS1-completion-boo903362.patch
  * backtick-completion-boo940835.patch
  * backticks-bsc963140.patch
  * bash-completion-2.4.patch
  * bash-completion.changes
  * bash-completion.spec
  * ls-completion-boo889319.patch
  * respect-variables-boo940837.patch
  * rm-completion-smart-boo958462.patch
  * sh-script-completion-boo977336.patch</changelog>
</package>
<package pkgid="5fdd5d6968c495ea04b8d5dc347669aec2c93c71a7a0dd8cf5126c17b3e1d71c" name="bash-completion-doc" arch="src">
  <version epoch="0" ver="2.7" rel="4.6.1"/>
  <changelog author="werner@suse.de" date="1416225600">- Add patch PS1-completion-boo903362.patch to avoid trouble if
  restricted characters of the shell are used in PS1 like
  exclamation mark (boo#903362).
- Add patch FOO-dir-completion-boo905348.patch to expand variables
  which value is actual a directory to avoid excaped dollar sign
  (boo#905348).</changelog>
  <changelog author="werner@suse.de" date="1426680000">- Port my dollar completion from /etc/profile.d/completion.bash to
  bash_completion which modifies FOO-dir-completion-boo905348.patch
- Avoid negative cword position counter (boo#922758), this adds
  the patch init-completion-boo922758.patch</changelog>
  <changelog author="werner@suse.de" date="1434369600">- Add patch ls-completion-boo889319.patch to make ls completion
  more smart (boo#889319)</changelog>
  <changelog author="werner@suse.de" date="1439380800">- Correct typo in patch ls-completion-boo889319.patch</changelog>
  <changelog author="werner@suse.de" date="1439467200">- Add patch backtick-completion-boo940835.patch to allow correct
  backtick completion (boo#940835)</changelog>
  <changelog author="werner@suse.de" date="1443009600">- Add patch LVM-completion-bsc946875.patch to make LVM comands
  work even without any scan happen (bsc#946875)</changelog>
  <changelog author="werner@suse.de" date="1450440000">- Add patch respect-variables-boo940837.patch to avoid completions
  which results in e.g. ls \$HO
- Add patch rm-completion-smart-boo958462.patch to allow completions
  list e.g. rm prefix*.jpg&lt;TAB&gt;&lt;TAB&gt;
- Modify patch LVM-completion-bsc946875.patch that is add the
  new patch from Liuhua Wang</changelog>
  <changelog author="werner@suse.de" date="1453896000">- Add patch backticks-bsc963140.patch to handle sub commands
  which will be expanded by backticks (bsc#963140)</changelog>
  <changelog author="werner@suse.de" date="1461758400">- Add documentation for this packages below to get the reference
  of the e.g. the variable COMP_FILEDIR_FALLBACK (boo#977336)</changelog>
  <changelog author="werner@suse.de" date="1461758401">- Add patch sh-script-completion-boo977336.patch to make _filedir
  work with COMP_FILEDIR_FALLBACK even if local directries exists
  this is for bug boo##977336</changelog>
  <changelog author="sbrabec@suse.com" date="1461758402">- Remove completions conflicting with util-linux (boo#977259#c3).</changelog>
  <changelog author="werner@suse.de" date="1463572800">- Split off sub packages devel and doc to avoid dependency cycles</changelog>
  <changelog author="sbrabec@suse.com" date="1463572801">- Split doc build into a separate spec file. It makes possible to
  build package in two stages and prevent build loop.</changelog>
  <changelog author="tchvatal@suse.com" date="1472040000">- Mark the documentation as noarch</changelog>
  <changelog author="werner@suse.de" date="1481716800">- Change upstream home to https://github.com/scop/bash-completion
- Update to version 2.4
  * xetex, xelatex, luatex, lualatex: Associate with tex files
  * Support pod document files for perldoc (#39)
  * tipc: add tipc completions
  * rpm: Offer --filetriggers with -q
  * javadoc: Add bunch of option arg (non)completions
  * lrzip: Add -m arg noncompletion
  * pypy*: Add basic --jit arg completion
  * pypy3: Alias to python
  * hcitool,svcadm,tar: Spelling fixes
  * tipc: Invoke ls with "command"
  * tipc: Indentation fix
  * abook: Parse long options from command including full path
  * pyvenv: New completion
  * chroot: New (generic long options) completion, see #38
  * aptitude: List packages using _apt_cache_packages, fixes #33
  * vncviewer: Cleanup shopt use, drop an eval
  * make: Avoid a grep
  * rpm: Fix --whatenhances arg completion
  * aspell, minicom, mysql: Replace use of ls with printf
  * The BitKeeper completion used the wrong set of commands
  * Completion for python zip archives
  * lvm: pvcreate should be able to use all block devcices
  * lvm: fix all commands that should get all PVs
  * tar: Detect GNU/other from --version only once per session
  * tar: Remove unused variable
  * tar: Fix GNU tar help output parsing regex, fixes #15
  * tar: Don't write to /tmp/jetel
  * python: Simplify code
  * python: Complete all files also after -m
  * python: Don't offer options after -c
  * python: Complete all files only if -c is before current word
  * unzip, zipinfo: Complete on *.pyz
  * _lvm: using a single-pattern case and invoking function according
    to words[1]
  * lvm: _lvm_count_args parameter must be quoted in order to failglob
    not to complain
  * gendiff: Quoting suffix pattern to avoid triggering failglob
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (Alioth:
    [#314709])
  * Refactor bts and uscan, since they use common functions
  * uscan: New completion, thanks to Federico Ceratto
  * bts: New completion, thanks to Federico Ceratto.
  * nmcli completion was integrated upstream
  * ssh-add, ssh-keygen: -? needs to be quoted under failglob (take 2)
    (Alioth: #314709)
  * umount: Fix mount points escaping/unescaping with Bash-4.3
  * slapt-src: Handle --config=FILE option properly
  * sbopkg, slapt-{get,src}: expand tilde in config file name
  * slapt-{get,src}: Fix issue with sed not being able to handle some
    characters
  * slapt-src: split options from their arguments
  * psql: Tell psql to not load .psqlrc as it may change output format
    (Alioth: #314636)
  * mplayer: -dvd-devices takes dvd devices, dirs and .iso files as
    argument
  * 7z: Improve completion
  * f77, f95: Use the same completion as for g77, g95 if they are
    links to gfortran
  * make: Use only posix basic regexps with sed (Alioth: #314345)
  * perl: -d/-dt option argument is optional (Alioth: #314242)
  * Add config for cmake to bash-completion.
  * kcov: Add new sort types, complete --replace-src-path arguments
  * feh: Add new sort type
  * man: Use -w instead of --path
  * chronyc: Update help text parsing
  * chronyc: Add missing subcommands
  * chronyc: Add -6 option
  * minicom: Recognize user ~/.minirc.* as config files
  * rpmbuild: Complete *.spec on --clean (RedHat: #1132959)
  * tar: rework the completion completely
  * portsnap: New completion.
  * modprobe: fix params with multi-line descriptions
  * gdb: support --args style completion (Alioth: #314664)
  * make: Fix basic regex for portability (Alioth: #314345)
  * gnokii: New completion
  * xmllint, xmlwf, xsltproc: Complete on Mallard *.page files
  * pypy: New completion identical to python (Alioth: #314501)
  * make: Don't pick up variables when makefile is reloaded
  * make: Offer hidden targets when it is clear that the user is
    trying to complete one of them
  * make: Fix detection of intermediate targets where make has changed
    its database whitespace
  * make: completion shouldn't be confused by the output of $(info
    confuse: make)
  * zopflipng: New completion
  * ssh: Extract duplicate code to _ssh_configfile
  * gnokii, minicom: Use grep through "command"
  * Update URLs and various instructions to GitHub
  * ssh: Avoid completing commands before hostname
  * chronyc: Parse command args from help output
  * chronyc: Wrap long lines
  * Load completions also from $XDG_DATA_DIRS (RedHat: #1264094)
  * (testsuite) Ignore files generated by complete-ant-cmd.pl
  * scp, sftp: Complete -S on commands
  * scp, sftp: Fix querying ssh options
  * sftp: Add -l arg non-completion
  * ssh-copy-id: Offer only *.pub to -i
  * mpv: Remove mplayer-aliased completion
  * modplug*: Associate *.oct and *.okt
  * rpm: Add --whatenhances/recommends/suggests/supplements and
  - -recommends/supplements completions
  * pgrep, pidof, pkill, pwdx, vmstat: Add support for procps-ng
  * pdftotext: New completion
  * checksec: New completion
  * ssh: Complete HostbasedKeyTypes,HostKeyAlgorithms,KexAlgorithms
    values
  * ssh: Query ciphers and macs from ssh before hardcoded fallback
  * ssh: Add -Q argument completion
  * sysctl: Return early on --help, --version
  * sysctl: Try parsing options from help before usage
  * eog: Complete on *.ppm (RedHat: #1090481)
  * tar: Plug $line var leak
  * tar: Style tweaks
  * bsdtar, tar: Remove symlinks from git, have make create them
  * jshint: New completion
  * gnokii: Include and install it
  * gnokii: Fix completions of options that are prefixes for others
  * gnokii: Drop dead code
  * (testsuite): Add basic gnokii test case
  * gnokii: Various minor and cosmetic fixes
  * Load user completions from $BASH_COMPLETION_USER_DIR/completions
  * synclient: New completion
  * tune2fs: Add missing return in -M arg completion
  * reptyr: Rename file to _reptyr to avoid conflict with upstreamed
    completion
  * dropuser: New completion
  * createuser: New completion
  * createdb, dropdb: Drop -o default, it does not appear to do
    anything good here
  * tshark: Simplify cut usage
  * mcrypt: Simplify -m arg completion
  * strings: Fix -T/--target arg completion with non-English locale
  * chrome, firefox etc: Complete on *.pdf
  * ccache: Add -o/--set-config arg name completion
  * gphoto2: Replace tail with awk
  * gphoto2: Fix split argument handing, and colon treatment in --port
    args
  * Actually install the lz4 completion
  * _pnames: Add -s for producing (possibly) truncated names (RedHat:
    [#744406])
  * (testsuite) Add cd in dir without subdirs or CDPATH test case
  * Protect various compgen invocations from -* leakage (Debian:
    [#766163])
  * pigz, unpigz: Handle *.zz
  * rpmbuild: Complete *.spec on --nobuild
  * mplayer, *xine: Complete on *.mts (Debian: #759219)
  * ant: Support buildfile set in $ANT_ARGS (Alioth: #314735)
  * ant: Don't offer more completions after options that exit
  * 7z, adb: Trivial cleanups
  * python(3): Add -X argument non-completion
  * xsltproc. TODO fix for previous commit
  * xmllint, xmlwf, xsltproc: Complete on *.dbk and *.docbook (Alioth:
    [#314770])
  * xz: Complete -T/--threads argument
  * adb: New completion
  * modprobe: Try parsing help before using hardcoding option list
  * mpv: New completion alias + adjustments for mplayer (Debian:
    [#749115])
  * hostname: New completion
  * nslookup: complete on hosts (Alioth: #314673)
  * eog: Complete on *.pgm (RedHat: #1090481)
  * pngfix: New completion
  * qemu: Fix -balloon arg completion
  * qemu: Apply completion to qemu-kvm/-system-i386/-system-x86_64 too
  * xrandr: Use the invoked command internally, not hardcoded "xrandr"
  * xrandr: Add (some) --setprovider* arg completion support
  * ri: Fix class completion with ri &gt;= 3.
  * ri: Fix colon handling in class completion.
  * flake8: New completion
  * pyflakes: New completion
  * cal,chfn,chsh,dmesg,eject,hexdump,look,newgrp,renice,runuser,su,wr
    ite: Deprecate on Linux in favor of util-linux ones (Debian:
    [#737672])
  * hwclock,ionice,rtcwake: Deprecate in favor of util-linux ones
    (Debian: #737672)
  * ssh-keygen: New completion
  * jpegoptim: New completion
  * ip: Add some addr, addrlabel, and route arg completions
  * aptitude, dpkg: Replace some grep+cuts with awk
  * gcc, lintian, make, pkgadd, slackpkg: grep -&gt; "command grep"
    (Debian: #734095)
  * lintian: Replace some grep+cuts with awk
  * lz4: New completion.
  * optipng: New completion.
  * cppcheck: Include - in --file-list completions.
  * wtf: Look for acronym db from /usr/share/games/bsdgames/acronyms
    too.
  * wtf: Don't offer -f if it was already specified.
  * wtf: Hush stderr when db file doesn't exist.
  * appdata-validate: New completion.
  * timeout: New completion.
  * abook, kldunload: Pre-expand \t instead of relying on sed
    supporting it.
  * dict: Trivial regex cleanup.
  * zopfli: New completion.
  * bzip2, gzip, lzma: Cleanups.
  * 2to3: New completion.
  * file-roller: Reuse unzip's xspec.
  * 7z: New completion.
  * hcitool, rfcomm, ciptool, hciconfig: Don't leak $args.
  * perl: Fix -dt: completion.
  * perl*: Fix handling of relative paths in @INC.
  * wget: Add --accept-regex/--reject-regex/--regex-type arg
    (non)completions.
  * wget: Drop incorrect -nv arg completion.
  * wget: Stop completing after --help/--version.
  * Clean up/compact various globs.
  * cvs: Fix checkout -j non-completion.
  * sh: Complete script arguments with all filenames (Alioth:
    [#314226]).
  * nmcli: Deprecate our completion, upstream has one in 0.9.8.0.
  * cvs rm: Don't filter existing files with -f (RedHat: #949479).
- Drop patches now upstream
  init-completion-boo922758.patch
  pushd-completion-bnc818365.patch
- Rename patches
  bash-completion-2.1.patch becomes bash-completion-2.4.patch
- Port the patches to newer version 2.4
  FOO-dir-completion-boo905348.patch
  LVM-completion-bsc946875.patch
  PS1-completion-boo903362.patch
  backtick-completion-boo940835.patch
  backticks-bsc963140.patch
  ls-completion-boo889319.patch
  respect-variables-boo940837.patch
  rm-completion-smart-boo958462.patch
  sh-script-completion-boo977336.patch
- Only remove completion for umount/mount for older SUSE versions (boo#995045)</changelog>
  <changelog author="werner@suse.de" date="1481716801">- Add patch tar-completion.patch to allow mixed options with long
  and short options (boo#1012212)</changelog>
  <changelog author="werner@suse.de" date="1481803200">- Fix cut&amp;paste error in final ls completion</changelog>
  <changelog author="werner@suse.de" date="1481803201">- Detect if the completions for mount/umount have to be removed
  for modern util-linux package but without using suse_version</changelog>
  <changelog author="nico.kruber@gmail.com" date="1496145600">- Update to version 2.5
  * Support for python gui source files (#91)
  * mr: New completion
  * ssh-keygen: support ed25519 keys (#79)
  * Add sidedoor to _ssh() completion (#106)
  * .ipa is just a zip file and we should let unzip handle it (#71)
  * ant: parse targets in imported buildfiles (#84)
  * Add more tests for ccache
  * ccache: fix completing compiler's flags
  * test suite: Add java/javac non-completion fixture
  * javac: Complete -cp like -classpath
  * travis: Skip bluez and nis for now due to post-install script
    issues
  * test/config/*: Delete trailing whitespace
  * (test suite): Avoid loading user's ~/.bash_completion, fixes #87
  * ip: Recognize a as alias for address and l for link
  * ip: Recognize address in addition to addr
  * mr: Disable "clean" test case, command N/A before mr 1.20141023
  * ssh-keygen: Parse switches with _parse_usage, not _parse_help
  * mplayer: Associate with *.mjpg, *.mjpeg (Debian: #837779)
  * dd: Sync completions with coreutils 8.24
  * travis: Add mr
  * perl: Remove full path to cat in PERLDOC_PAGER call
  * deja-dup: New completion
  * CONTRIBUTING: Reorder sections
  * *: Move indentation settings to .editorconfig
  * make: Declare _make_target_extract_script like other functions
  * Travis: zopfli is AWOL?
  * *: Whitespace fixes
  * Minor edits to README.md (mostly formatting) (#110)
  * Fix bug in 'make' completion when using BSD sed (#108)
  * Add support for Include in ssh config (#70) (#80)
- adapt LVM-completion-bsc946875.patch</changelog>
  <changelog author="werner@suse.de" date="1499169600">- Update to version 2.7
  * Makefile: update default compatdir (#132)
  * Make user completion file configurable, disable in tests
  * test suite: Generalize xspec completion install check
  * pyflakes: Remove redundant xspec completion
  * test suite: Fix __expand_tilde_by_ref test expectation output
  * pdfunite: New *.pdf completion
  + bash-completion (2.6)
  * Add missing sidedoor to .gitignore (#114)
  * test suite: Mark expected centos6 CI _filedir failures as such
  * Expose version in BASH_COMPLETION_VERSINFO, use it in profile.d
    script
  * test suite: Skip an expected make test case failure in centos6 CI
  * test suite: Fix ifdown and ifup CI test skipping
  * test suite: Ignore env var pulled in by use of scp in tests
  * test suite: If colon trim doesn't do anything, trim as usual
  * tar: Comment spelling fixes
  * test suite: Mark dpkg -L test case untested if no packages
    installed
  * test suite: Cosmetic tweaks
  * dpkg: Fix dpkg -i home dir completion
  * test suite: Improve ls home dir test descriptions
  * python: Split module completion to separate helper
  * micropython: New completion, aliased from python
  * test suite: Add Python module completion test case
  * python: Fix traceback avoidance on module completion error
  * openssl: Parse available digests from dgst -h
  * openssl: Add sha2 commands
  * gm: New completion, commands only for now
  * (test suite): Test screen -T completions
  * (test suite): Set TERM to dumb, not dummy
  * Revert "(test suite): Fix alias and cd cursor position tests"
  * mplayer: Remove duplicate *.m4a and *.m4v associations
  * mplayer, xine, etc: Associate *.mp4a and *.mp4v
  * xine etc: Fix *.m4a association
  * bind: Add option and argument (non-)completions
  * _user_at_host: Set nospace only when completing username part
  * _user_at_host: Append @ suffix to username part completions
  * man: Don't check OSTYPE or GNU userland, just enable on all
    systems
  * (test suite): Set dcop result to untested if dcop server is not
    running
  * (test suite): Don't insist on loading all completions dynamically
  * _configured_interfaces: Parse from /etc/network/interfaces.d/* on
    Debian
  * py.test: New completion
  * oowriter: Associate with *.pdf
  * Don't define BASH_COMPLETION_COMPAT_DIR
  * ri: Add option and arg completions
  * (test suite): Add our own dummy ri test fixture
  * (test suite): Info test needs docs, don't exclude from CentOS
  * (test suite): Fix CentOS 6 tcllib setup
  * (test suite): Simplify renice test, fix with only one completion
  * (test suite): Don't assume configured interfaces in CI setups
  * Don't offer * as configured interface when there are none
  * (test suite): Add basic CentOS 6 container for bash 4.1 coverage
  * (test suite): Ignore runtime loaded env function changes
  * (test suite): Add mailman bin dir to PATH for arch test
  * arch: Parse options from --help
  * (test suite): Load tested completions dynamically
  * (test suite): Accept non-whitespace single word in
    assert_complete_any
  * (test suite): Avoid interference from user and system dirs (#87)
  * (test suite): Install some things N/A in ubuntu14 to fedoradev
  * (test suite): Add unrar to ubuntu14 container
  * (test suite): Fix alias and cd cursor position tests
  * (test suite): Add basic alpine test case
  * alpine: Parse opts from -h output, add some opt arg completions
  * (test suite): Install jshint globally in ubuntu14
  * (test suite): Add mailman bin dir to PATH for some mailman tools
  * (test suite): Install jshint to ubuntu14 container with npm
  * unshunt: Parse options from --help
  * (test suite): Test lsof on ubuntu14
  * (test suite): Add basic hping3 test case
  * (test suite): Add our ./configure to PATH to test it, test opts
  * (test suite): Add bunch of packages to ubuntu14 container
  * (test suite): Ensure /usr/(local/)games is in $PATH
  * (test suite): Fix perl -d* test cases with no Devel::* installed
  * (test suite): curl has lots of options, add more test prefix
  * (test suite): Fix tar test case for ones having --owner-map
  * (test suite): Unsupport various kill, renice cases if ps is N/A
  * (test suite): Make chkconfig test behave better in container
  * (test suite): Don't assume mounted filesystems in quota* tests
  * newlist: Parse options from --help, add some arg non-completions
  * (test suite): Delete trailing whitespace
  * (test suite): Don't assume lists set up in newlist test cases
  * (docker): Pull in missing fedoradev xvfb-run which dependency
  * mr: Avoid stderr trash and test suite failure if man is N/A
  * (test suite): Fix mmsitepass completion test
  * tshark -G: Avoid stderr noise when running as superuser
  * (docker): Run completion tests with xvfb-run, e.g. for gkrellm
  * ssh-keygen: Make option parsing work with OpenSSH &lt; 7
  * synclient, udevadm: Avoid use of posix char classes for awk
  * test suite: Add WIP Fedora dev config
  * Travis: Switch tests to docker, update to Ubuntu 14
  * xv: Associate with *.j2c, *.j2k, *.jp2, *.jpf, and *.jpg2 (Debian:
    [#859774])
  * eog: Associate with *.j2c and *.jpg2
  * Bump copyright years
  * xine etc: Associate uppercase *.WM[AV]
  * mplayer: Associate *.weba (#112)
  * xine etc: Associate *.webm and *.weba (#112)
- Modify patches
  * FOO-dir-completion-boo905348.patch
  * PS1-completion-boo903362.patch
  * backtick-completion-boo940835.patch
  * backticks-bsc963140.patch
  * bash-completion-2.4.patch
  * bash-completion.changes
  * bash-completion.spec
  * ls-completion-boo889319.patch
  * respect-variables-boo940837.patch
  * rm-completion-smart-boo958462.patch
  * sh-script-completion-boo977336.patch</changelog>
</package>
<package pkgid="c754181fb41c2142f9bcdfbcd1d47c52bf04880e942493375746a803aa2b5e15" name="bash-devel" arch="aarch64">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="b8f94a1533827990d3f3a51103d83eb85b613de056e386cb792a13da8e893fce" name="bash-devel" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="53a03c5012fcf95d3959d17015b82cbe3edb6f425c3752f96cad1a3426792d8e" name="bash-devel" arch="s390x">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="d3be6215c5b5a6423770dd97faae7bb294405b952b146931d30f116ae8f40e50" name="bash-devel" arch="x86_64">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="0789e7fc6345e535339cd7b14b5e169ba8676ba9f1af72e6119ccb6de3b7a8ee" name="bash-devel" arch="aarch64">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="06c5f5539555e61f3de6a96e4ccf5b110ba50eef5216b0dbd320ad0c7ae9680f" name="bash-devel" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="5e91c40f94a7eae38c99f427be9c856d120c93ff43fefcb7633718e0493fd96e" name="bash-devel" arch="s390x">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="6202797bc2e736edcf6f21881bcb91daaa9ab3f5736dbf2b2fb63102dc2ffcf5" name="bash-devel" arch="x86_64">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="718e867af8b14506f3673918cc1a1269c147f45bc5aad8cd1fc777483579d8a6" name="bash-doc" arch="noarch">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="2984bdd4a150abc0f30f0471ee45e5cfd2977989e6275e5b8a855fc2e6e10fbf" name="bash-doc" arch="noarch">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="f29678171ec27b21408efe9de7887cb41a0aca5ca4ba672f91c7a34555a71278" name="bash-lang" arch="noarch">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="8e67d2c350761ac8b2a54596be55afb9aca2777d89819f6c103b0d66337240fe" name="bash-lang" arch="noarch">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="b70462a5366bfca4c2abd9d9809f1927cc61ed7b93367f19b213c9f4ab6e4a36" name="bash-loadables" arch="aarch64">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="dbb32ea4d43a59af77f814965531fbd40fcf1f965801aab14d48dfd06ca2b679" name="bash-loadables" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="2b62abd8722d2a26bc7a705a34b5195c28989d8fc88033f56fbd76c04538d27c" name="bash-loadables" arch="s390x">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="4ab5a0f1b23bbf28a68acc8a35773796d4bf701d003b51018badaeb42eeac44f" name="bash-loadables" arch="x86_64">
  <version epoch="0" ver="4.4" rel="19.3.1"/>
  <changelog author="werner@suse.de" date="1493208000">- Simplify patch readline-5.2-conf.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
</package>
<package pkgid="b1a0305b89708c880dca93a877e7d9cbe2e66e01a61c66379e027f5cc2d7bbca" name="bash-loadables" arch="aarch64">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="e336984b8331b3ca15058b18b483b06f65df1fc8ed3f4e65d110f4054be944ae" name="bash-loadables" arch="ppc64le">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="bb4288b148c6f826b525b64564a90b556447acf59494655e607a80c79ea3ef5c" name="bash-loadables" arch="s390x">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="fd23dcaebe0fcccd1300a0b2d2d93dcee1820e09f182b3910f6a8ee8f03e2dd7" name="bash-loadables" arch="x86_64">
  <version epoch="0" ver="4.4" rel="19.6.1"/>
  <changelog author="bwiedemann@suse.com" date="1495627200">- Allow to disable do_profiling in builds (related to boo#1040589)</changelog>
  <changelog author="bwiedemann@suse.com" date="1495713600">- Make build reproducible in spite of profile based optimizations (boo#1040589)</changelog>
  <changelog author="werner@suse.de" date="1506340800">- Modify patch bash-4.4.dif to let bashline.h install as well as
  this header file is included by general.h due to the same patch
  (boo#1060069)</changelog>
  <changelog author="werner@suse.de" date="1512734400">- Enable multibyte characters by default</changelog>
  <changelog author="werner@suse.de" date="1516795200">- Modify patch bash-4.3-pathtemp.patch to avoid crash at full
  file system (boo#1076909)</changelog>
  <changelog author="avindra@opensuse.org" date="1517313600">- Add patches 13-18 to bash-4.4-patches.tar.bz2
  * 13: If a here-document contains a command substitution, the
    command substitution can get access to the file descriptor used
    to write the here-document.
  * 14: Under some circumstances, functions that return via the
    `return' builtin do not clean up memory they allocated to keep
    track of FIFOs.
  * 15: Process substitution can leak internal quoting to the
    parser in the invoked subshell.
  * 16: Bash can perform trap processing while reading command
    substitution output instead of waiting until the command
    completes.
  * 17: There is a memory leak when `read -e' is used to read a
    line using readline.
  * 18: Under certain circumstances (e.g., reading from /dev/zero),
    read(2) will not return -1 even when interrupted by a signal.
    The read builtin needs to check for signals in this case.
- partial cleanup with spec-cleaner</changelog>
  <changelog author="avindra@opensuse.org" date="1517918400">- Add patch 19 to bash-4.4-patches.tar.bz2
  * With certain values for PS1, especially those that wrap onto
    three or more lines, readline will miscalculate the number of
    invisible characters, leading to crashes and core dumps.</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1519732800">- Create readline-devel-static package to re-enable static libraries
  again (boo#1082913)</changelog>
  <changelog author="werner@suse.de" date="1524052800">- Add patch bash-4.4-wait-sigint-handler.patch to fix bug bsc#1086247
  that is repeating self inserting trap due external command in the
  trap.</changelog>
  <changelog author="avindra@opensuse.org" date="1527940800">- Add patch 20, 21, 22 and 23 to bash-4.4-patches.tar.bz2
  * 20: In circumstances involving long-running scripts that create
    and reap many processes, it is possible for the hash table bash
    uses to store exit statuses from asynchronous processes to
    develop loops. This patch fixes the loop causes and adds code
    to detect any future loops.
  * 21: A SIGINT received inside a SIGINT trap handler can possibly
    cause the shell to loop.
  * 22: There are cases where a failing readline command (e.g.,
    delete-char at the end of a line) can cause a multi-character
    key sequence to `back up' and attempt to re-read some of the
    characters in the sequence.
  * 23: When sourcing a file from an interactive shell, setting the
    SIGINT handler to the default and typing ^C will cause the
    shell to exit.
- remove bash-4.4-wait-sigint-handler.patch (upstreamed)</changelog>
  <changelog author="werner@suse.de" date="1528113600">- In patch bash-4.4.dif avoid setgroups(2) but use initgroups(3) (boo#1095670)</changelog>
  <changelog author="werner@suse.de" date="1528891200">- Add patch readline-7.0-screen.patch to be able to parse settings
  in inputrc for all screen TERM variables starting with "screen."
  to fix boo#1095661</changelog>
  <changelog author="bwiedemann@suse.com" date="1530964800">- Add bash-memmove.patch to make bash.html build reproducible (boo#1100488)</changelog>
  <changelog author="werner@suse.de" date="1538136000">- Rework patch readline-7.0-screen.patch</changelog>
  <changelog author="werner@suse.de" date="1559131200">- Add patch bash-4.4-bgpoverflow.patch which is a backport from bash
  5.0 to perform better with large numbers of sub processes (bsc#1133773)</changelog>
  <changelog author="werner@suse.de" date="1565956800">- Rework patch readline-7.0-screen.patch again for bug boo#1143055
  * Map all "screen(-xxx)?.yyy(-zzz)?" to "screen" as well as
    map "konsole(-xxx)?" and "gnome(-xxx)?" to "xterm"</changelog>
  <changelog author="werner@suse.de" date="1600257600">- Move /bin/bash to /usr/bin/bash and provide old location as
  symbolic link of new location (jsc#SLE-15652)
- Remove minimal sh build option as not used</changelog>
  <changelog author="werner@suse.de" date="1620129600">- Add patch bsc1183064.patch
  * Fix bug bsc#1183064: Segfault from reading a history file not
    starting with # with HISTTIMEFORMAT set and history_multiline_entries
    nonzero and with the history cleared and read on the same input line.</changelog>
  <changelog author="werner@suse.de" date="1628078400">- Add patch bash-4.4-jobctrl.patch to allow process group asignment
  even for modern kernels (bsc#1057452, bsc#1188287)</changelog>
</package>
<package pkgid="1de550fa85a95d7be55639db5ae86d5806b22793aa44e555ab7c36cd9d6ce9e7" name="bind" arch="src">
  <version epoch="0" ver="9.16.6" rel="12.54.2"/>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1613390400">- CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy
  negotiation can be targeted by a buffer overflow attack
  [bsc#1182246, CVE-2020-8625, bind-CVE-2020-8625.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1613563200">- dnssec-keygen can no longer generate HMAC keys.
  Use tsig-keygen instead.
  modified genDDNSkey script to reflect this.
  [vendor-files/tools/bind.genDDNSkey, bsc#1180933]</changelog>
  <changelog author="josef.moellers@suse.com" date="1618833600">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1627992000">- Fix off-by-one error when calculating new hashtable size
  When calculating the new hashtable bitsize, there was an off-by-one
  error that would allow the new bitsize to be larger than maximum allowed
  causing assertion failure in the rehash() function.
  [bsc#1188763, 0001-Fix-off-by-one-error-when-calculating-new-hashtable.patch]</changelog>
</package>
<package pkgid="5a51ebd208347f6794a66b818c242b771952f123b502382b85781b3388360264" name="bind" arch="aarch64">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="706419daee858f8de20c2124ec4954d1e65c6f874e3ae57c56634a75d1d9346e" name="bind" arch="ppc64le">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="934798825b74426507c36b4c5bafc2d77b48c987dd0f84c2527582881d423df3" name="bind" arch="s390x">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="ac3acdf3418a6dca21b1f8d5a89bb0e972319f490dd936165f67dd74192f2063" name="bind" arch="src">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="befe35ec79df90aeb40afbd8aee38bee1ce90fbd70bd3b6e8334a814fcd5f7be" name="bind" arch="x86_64">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="91c123a953ff89753d3f9dc69bda1322e59ed2a4fe268d666fcd87433d4e4b84" name="bind" arch="aarch64">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="92b1650b623c81260bbaa99e3187cc4a5fe6b9921db21d4cecfd76066659e234" name="bind" arch="ppc64le">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="23f8231fc5dff05bb9bb7b56716eb96816f71464208b537cb0eff7eef3141735" name="bind" arch="s390x">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="0bbae4d1bd4344a3a91f1ce6e0cfeb74fd73e46ae6c91b914d5c4e7e414bfbbf" name="bind" arch="src">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="c37982afe149007feab2788cb9778043c096fd0229b4d80fe81a04989e264145" name="bind" arch="x86_64">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="823811284241bd1742f2f7c7d0f96b591f25d1c06ebe17e296cf5f61dc36e82b" name="bind-chrootenv" arch="aarch64">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="c94c54c9274df69b54f36f9847bba568799f1e444637b43a35982feb314c417d" name="bind-chrootenv" arch="ppc64le">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="e3ab705f8437c05790fb75bdefcbe9a4d004a2b92e14527a3046c001f8436c34" name="bind-chrootenv" arch="s390x">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="7324ba6dbd7474423354e2f1a4bc508ac2960bd3a02bfd213e2b32b1bb5c8031" name="bind-chrootenv" arch="x86_64">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="bb8bfb9db160da355aef00a6a54e10490f3e2c700254ec19c970359f6d820f61" name="bind-chrootenv" arch="aarch64">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="9fd8f80ebae78b0f193f8073e27e4615dd3f99a5e05b6f2dc7d7dd69f44011be" name="bind-chrootenv" arch="ppc64le">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="f4b7beaef57298d5622d81fc0c1a0ae6dcb0cb930394a287c3193cb9c6751c93" name="bind-chrootenv" arch="s390x">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="8948cfdd5e1950546e768d2fa89f1cfc6f3c41129b115fc3b00133516c41cec3" name="bind-chrootenv" arch="x86_64">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="34c27b09d979cb90a9887c75e59b7df53d339053a046741bc9f1e2cacb3165d7" name="bind-devel-32bit" arch="x86_64">
  <version epoch="0" ver="9.16.6" rel="12.54.2"/>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1613390400">- CVE-2020-8625: A vulnerability in BIND's GSSAPI security policy
  negotiation can be targeted by a buffer overflow attack
  [bsc#1182246, CVE-2020-8625, bind-CVE-2020-8625.patch]</changelog>
  <changelog author="josef.moellers@suse.com" date="1613563200">- dnssec-keygen can no longer generate HMAC keys.
  Use tsig-keygen instead.
  modified genDDNSkey script to reflect this.
  [vendor-files/tools/bind.genDDNSkey, bsc#1180933]</changelog>
  <changelog author="josef.moellers@suse.com" date="1618833600">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1627992000">- Fix off-by-one error when calculating new hashtable size
  When calculating the new hashtable bitsize, there was an off-by-one
  error that would allow the new bitsize to be larger than maximum allowed
  causing assertion failure in the rehash() function.
  [bsc#1188763, 0001-Fix-off-by-one-error-when-calculating-new-hashtable.patch]</changelog>
</package>
<package pkgid="1b7e0bfca0cea83398679eacb1ede3164076c3a0098302cb22d5c69d7ba9a01c" name="bind-devel" arch="aarch64">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="77ff560e626c1e103b5ecde2b4e8188fbbdeb51ad1cc37ccc57568b7f5619337" name="bind-devel" arch="ppc64le">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="c7b229116e7a21249ceae783c9aa2a5515852b06d24a1b0ba189e7293acbbb53" name="bind-devel" arch="s390x">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="8e66c4e5823f43884c11166917dd18de61f359ea03540c7f5f01ca344c092095" name="bind-devel" arch="x86_64">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="ebc1bc401f8ffec8168b168e85ad137aacc578ccfa0262178b2af9781197634f" name="bind-devel" arch="aarch64">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="6e474dc867012a6df2fb7de11dce34154aa1402f3b8bf6cdac1de937a64b480e" name="bind-devel" arch="ppc64le">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="649cd59dce9f57df588b9b25a11bb379f3f5ae0ed3d18dcdfbdf49cce9893d91" name="bind-devel" arch="s390x">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="f006393a721aa2cee00cb31ecb81db64721ba9d519adf4080a4f8277032a1b5d" name="bind-devel" arch="x86_64">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="aab8e69d5766892c1bb0a380679a90a32708e96b0e55ad302d06cc7e751d3c67" name="bind-doc" arch="noarch">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="e345f3392f0692f8568318544e1c97392221d3a24f732d5b215a7da43756033f" name="bind-doc" arch="noarch">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="06059ce3847c3278225080c7b6daca07c42c1ba8363508a407f86a338c61eec2" name="bind-utils" arch="aarch64">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="bfdd796416d428d0de71cdb66bd90ff8488803dee2744f7769d792d79de65962" name="bind-utils" arch="ppc64le">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="29526f79e963b283b1b2421a7720fa3ecd38e5fa6a52335e28ee69fd74f942d0" name="bind-utils" arch="s390x">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="1077edcc09eb7e0e441e7f03ed3abce78038080c76da5c4613dcd20489126202" name="bind-utils" arch="x86_64">
  <version epoch="0" ver="9.16.6" rel="22.10.1"/>
  <changelog author="kukuk@suse.com" date="1584705600">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
  <changelog author="josef.moellers@suse.com" date="1626868800">- Since BIND 9.9, it has been easier to use tsig-keygen and
  ddns-confgen to generare TSIG keys. In 9.13, TSIG support was
  removed from dnssec-keygen, so now it is just for DNSKEY (and KEY
  for obscure cases). tsig-keygen is now used to generate DDNS keys.
  [bsc#1187921, vendor-files.tar.bz2]</changelog>
</package>
<package pkgid="0efe2837903ae5b41a0f7272b04befc385862fb7c81cf65d3192fdedc626980f" name="bind-utils" arch="aarch64">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="0966b43260dee81b19e9257e8769e9fcbfa3385646809903868524af48a3f13a" name="bind-utils" arch="ppc64le">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="94934f5cec0e7a7e1ad4330c91038cacf9f44725a7ee4f1af9f1e6e7b1474797" name="bind-utils" arch="s390x">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="61acf4365cf2f01f0b179ee59671e71fe276fe5df4238eacd4a993feb0db343f" name="bind-utils" arch="x86_64">
  <version epoch="0" ver="9.16.6" rel="22.7.1"/>
  <changelog author="josef.moellers@suse.com" date="1584705600">- Upgrade to version 9.16.1
  * UDP network ports used for listening can no longer simultaneously
    be used for sending traffic.
  * The system-provided POSIX Threads read-write lock implementation
    is now used by default instead of the native BIND 9 implementation.
  * Fixed re-signing issues with inline zones which resulted in records
    being re-signed late or not at all.
  [bind-9.16.1.tar.xz]</changelog>
  <changelog author="kukuk@suse.com" date="1584705601">- coreutils are not used in %post, remove Requires.
- Use systemd_ordering instead of hard requiring systemd</changelog>
  <changelog author="kukuk@suse.com" date="1584792000">- Use sysusers.d to create named user
- Have only one package creating the user</changelog>
  <changelog author="josef.moellers@suse.com" date="1588939200">- bind needs an accurate clock, so wait for the time-sync.target
  to be reached before starting bind.
  [bsc#1170667, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1589544000">- Upgrade to version bind-9.16.3
  Fixing two security problems:
  * Further limit the number of queries that can be triggered from
    a request.  Root and TLD servers are no longer exempt
    from max-recursion-queries.  Fetches for missing name server
    address records are limited to 4 for any domain. (CVE-2020-8616)
  * Replaying a TSIG BADTIME response as a request could trigger an
    assertion failure. (CVE-2020-8617)
  Also
  * Add engine support to OpenSSL EdDSA implementation.
  * Add engine support to OpenSSL ECDSA implementation.
  * Update PKCS#11 EdDSA implementation to PKCS#11 v3.0.
  * Warn about AXFR streams with inconsistent message IDs.
  * Make ISC rwlock implementation the default again.
  For more see CHANGS file in source RPM.
  [CVE-2020-8616, CVE-2020-8617, bsc#1171740, bind-9.16.3.tar.xz]</changelog>
  <changelog author="josef.moellers@suse.com" date="1592481600">- Upgrade to version bind-9.16.4
  Fixing two security problems:
  * It was possible to trigger an INSIST when determining
    whether a record would fit into a TCP message buffer.
    (CVE-2020-8618)
  * It was possible to trigger an INSIST in
    lib/dns/rbtdb.c:new_reference() with a particular zone
    content and query patterns. (CVE-2020-8619)
  Also the following functional changes:
  * Reject DS records at the zone apex when loading
    master files. Log but otherwise ignore attempts to
    add DS records at the zone apex via UPDATE.
  * The default value of "max-stale-ttl" has been changed
    from 1 week to 12 hours.
  * Zone timers are now exported via statistics channel.
    Thanks to Paul Frieden, Verizon Media.
  Added support for idn2 to spec file (Thanks to Holger Bruenjes
  &lt;holgerbruenjes@gmx.net&gt;).
  More internal changes see the CHANGES file in the source RPM
  This update obsoletes Makefile.in.diff
  [bsc#1172958, CVE-2020-8618, CVE-2020-8619, Makefile.in.diff
  bind.spec]</changelog>
  <changelog author="josef.moellers@suse.com" date="1593518400">- Changed /var/lib/named to owner root:named and perms rwxrwxr-t
  so that named, being a/the only member of the "named" group
  has full r/w access yet cannot change directories owned by root
  in the case of a compromized named.
  [bsc#1173307, bind-chrootenv.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1595332800">- Upgrade to version bind-9.16.5
  * The "primary" and "secondary" keywords, when used
    as parameters for "check-names", were not
    processed correctly and were being ignored.
  * 'rndc dnstap -roll &lt;value&gt;' did not limit the number of
    saved files to &lt;value&gt;.
  * Add 'rndc dnssec -status' command.
  * Addressed a couple of situations where named could crash
  For the full list, see the CHANGES file in the source RPM.</changelog>
  <changelog author="josef.moellers@suse.com" date="1596715200">- Added "/etc/bind.keys" to NAMED_CONF_INCLUDE_FILES in
  /etc/sysconfig/named to suppress warning message re
  missing file.
  [vendor-files.tar.bz2, bsc#1173983]</changelog>
  <changelog author="josef.moellers@suse.com" date="1597752000">- Upgrade to version 9.16.6
  Fixes five vilnerabilities:
  5481.   [security]      "update-policy" rules of type "subdomain" were
    incorrectly treated as "zonesub" rules, which allowed
    keys used in "subdomain" rules to update names outside
    of the specified subdomains. The problem was fixed by
    making sure "subdomain" rules are again processed as
    described in the ARM. (CVE-2020-8624) [GL #2055]
  5480.   [security]      When BIND 9 was compiled with native PKCS#11 support, it
    was possible to trigger an assertion failure in code
    determining the number of bits in the PKCS#11 RSA public
    key with a specially crafted packet. (CVE-2020-8623)
    [GL #2037]
  5479.   [security]      named could crash in certain query resolution scenarios
    where QNAME minimization and forwarding were both
    enabled. (CVE-2020-8621) [GL #1997]
  5478.   [security]      It was possible to trigger an assertion failure by
    sending a specially crafted large TCP DNS message.
    (CVE-2020-8620) [GL #1996]
  5476.   [security]      It was possible to trigger an assertion failure when
    verifying the response to a TSIG-signed request.
    (CVE-2020-8622) [GL #2028]
  For the less severe bugs fixed, see the CHANGES file.
  [bsc#1175443, CVE-2020-8624, CVE-2020-8623, CVE-2020-8621,
  CVE-2020-8620, CVE-2020-8622]</changelog>
  <changelog author="dimstar@opensuse.org" date="1598616000">- Require /sbin/start_daemon: both init scripts, the one used in
  systemd context as well as legacy sysv, make use of start_daemon.</changelog>
  <changelog author="max@suse.com" date="1599220800">- Put libns into a separate subpackage to avoid file conflicts
  in the libisc subpackage due to different sonums (bsc#1176092).</changelog>
  <changelog author="josef.moellers@suse.com" date="1600171200">- /usr/bin/genDDNSkey: Removing the use of the -r option in the call
  of /usr/sbin/dnssec-keygen as BIND now uses the random number
  functions provided by the crypto library (i.e., OpenSSL or a
  PKCS#11 provider) as a source of randomness rather than /dev/random.
  Therefore the -r command line option no longer has any effect on
  dnssec-keygen. Leaving the option in genDDNSkey as to not break
  compatibility. Patch provided by Stefan Eisenwiener.
  [bsc#1171313, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1600430400">- Removed "-r /dev/urandom" from all invocations of rndc-confgen
  (init/named system/lwresd.init system/named.init in vendor-files)
  as this option is deprecated and causes rndc-confgen to fail.
  [bsc#1173311, bsc#1176674, bsc#1170713, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1603800000">- Add /usr/lib64/named to the files and directories in
  bind-chrootenv.conf. This directory contains plugins loaded
  after the chroot().
- Replaced named's dependency on time-sync with a dependency on time-set
  in named.service. The former leads to a dependency-loop.
- Removed "dnssec-enable" from named.conf as it has been obsoleted.
  Added a comment for reference which should be removed
  in the future.
- Added a comment to the "dnssec-validation" in named.conf
  with a reference to forwarders which do not return signed responses.
- Replaced an INSIST macro which calls abort with a test and a
  diagnostic output.
  [bsc#1177913,bsc#1178078,bsc#1177790,bsc#1177603,bsc#1175894,
  bsc#1177915,
  bind-Print-diagnostics-on-dns_name_issubdomain-failure-in.patch,
  bind-chrootenv.conf,vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1604664000">- Added special make instruction for the "Administrator Reference
  Manual" which is built using python3-Sphinx
  [bsc#1177983, bind.spec]
- Removed "Before=nss-lookup.target" from named.service as that
  leads to a systemd ordering cycle
  [bsc#1177491, bsc#1178626, bsc#1177991, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1605182400">- Removed baselibs.conf as SLE does not distribute 32 bit libraries.
  [baselibs.conf]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run
  [bsc#1185073, bind-replace-varrun-with-run.patch,
  bind-chrootenv.conf, vendor-files.tar.bz2]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619179200">- pass PIE compiler and linker flags via environment variables to make
  /usr/bin/delv in bind-tools also position independent (bsc#1183453).
- drop pie_compile.diff: no longer needed, this patch is difficult to
  maintain, the environment variable approach is less error prone.
  [bsc#1183453, bind.spec, pie_compile.diff]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619611200">- * A broken inbound incremental zone update (IXFR)
    can cause named to terminate unexpectedly
    [CVE-2021-25214, bind-CVE-2021-25214.patch]
  * An assertion check can fail while answering queries
    for DNAME records that require the DNAME to be processed to resolve
    itself
    [CVE-2021-25215, bind-CVE-2021-25215.patch]
  * A second vulnerability in BIND's GSSAPI security
    policy negotiation can be targeted by a buffer overflow attack
    This does not affect this package as the affected code is
    disabled.
    [CVE-2021-25216]
  [bsc#1185345]</changelog>
</package>
<package pkgid="49621236c0e4a34a5a54dbe316651d2af62d1bf4094a3417af433ab121c6d445" name="binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="4736a3886ff2369cf1705dbb12dee68cef3d46f234ef6ffa7dff833082151102" name="binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="8f28c2a60bcd27c9aa66a26e0beb3e6fe4e94a96a54528af07e1690787e59c68" name="binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="8408e7a2302c23af4542f0fcdc1c2015e6a2289f6f7a0d6984fc7bc5460aa7ac" name="binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="9ad170896dad9887492fb92e6a6c94ce828b932241fac23b2d2ebaa8ca5be593" name="binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="c5031e6b92ad81c7ccd923f6a372573d08e7b36f736e14ad1da03addb1948fef" name="binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="3820b68972c24b6e7422171da3937e79574ad1a7019ea38e7fb3ac99b7e450b4" name="binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="061cc6d1b9cf469ec35a83fa94e391d2771cd87217cd2f1fc95125ddeb89871c" name="binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="6527f2853350b3c47db6752688225cdca6e5c78bdf029eb5f5379e80bf5ee771" name="binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="ddb5312296f2474808423f12d3ed43e3039c88b74672d5f583015e08691260e8" name="binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="49739b8c72ec316a9955a4a69db1d31045bc6b9925436cce1a1ea24a2dc3ef59" name="binutils-devel" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="eafbaa0883b3d11f4b76d07c3e2457bf31b77172f8907b69633b4b564ee74989" name="binutils-devel" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="a99cd4e5043b5a4bc4a5a7fe8523c86dabf2f85950446336f9e9cd0c890a3c65" name="binutils-devel" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="a7fcbac7e3f6a3ec57f9ce4daa9e0e4ca5f4d782c408b929800c3e19e12ddade" name="binutils-devel" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="e80562818d9e8a89f4f6ccca7fc500ff9e02e3cbec8090f39011018524862800" name="binutils-devel" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="88c1fe4841c3b204c70e52154ead8396beb5a4e43b9952712b3795f6bf0a26ff" name="binutils-devel" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="b617e7fcea70a8d8f05a1d58e2db8bbd9be08513dee4700c3b460b7cc5b044cf" name="binutils-devel" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="0c07bab4219ab5f6e918732cdbb76703ca5b7cefcea8b19b3a34fefa27b12e33" name="binutils-devel" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="d14a6e9d492619cf553df259953f891fc61ba33967a587a2efaf86cb4a7fab89" name="binutils-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="7a4834e24923fb66a72e8b631d7ce4005e1625613fbc609c980938900822fb60" name="binutils-devel-32bit" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="3d6884eb6edff3ec1339bc035c64a1d2a4f681516829d1d79a9d24fc476cff57" name="binutils-gold" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="28b402d0c39e721d0116ba4006f01451062ca99091750050d43b028d0261e93f" name="binutils-gold" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="50b7bea4e43f7fcbb5325a42fb110a6db2d37fe3905e37015b17c738c01a2016" name="binutils-gold" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="366aab93e1b36c080bda6582e68c2d7ddd89660f610c062df899c4177cca2053" name="binutils-gold" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.2"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="26961b61cbb224d63afdffb1f3eedcdb67f85f76b3011ad5c86cbe5dc491a664" name="binutils-gold" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="f464a9084f87dd566f926950438a6a536bb2ac40027fd6cd9bd9ad5874104f4a" name="binutils-gold" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="d6f4a456a9ccf5eb2defc39cf9431813c6b2b591835fcde5a85568c2c2d89439" name="binutils-gold" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="0f2f08dc4c2ac146a8072d93b01361b970093cd96367b48678c90feff0503427" name="binutils-gold" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="591f812b7ae689c51fff781d51a83849a55e335789ca4206e09515dbb47e2f5c" name="bison" arch="aarch64">
  <version epoch="0" ver="3.0.4" rel="3.3.1"/>
  <changelog author="schwab@suse.de" date="1373371200">- Override broken configure checks</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1375531200">- Update to bision 3.0
  * deep overhaul/improvements of the diagnostics
  * more versatile means to describe semantic value types,
  including the ability to store genuine C++ objects in C++ parsers
  * push-parser interface extended to Java
  * parse-time semantic predicates for GLR parsers.
  * This is a major update, please see https://lwn.net/Articles/561990/
  for all details and backward incompatible changes.</changelog>
  <changelog author="schwab@linux-m68k.org" date="1380283200">- location-eof-check.patch: Fix broken EOF check</changelog>
  <changelog author="p.drouand@gmail.com" date="1419422400">- Update to version 3.0.2
  + Generated source files when errors are reported
  + %empty is used in reports
  + When C++ variant support is enabled, an error triggered via YYERROR,
    but not caught via error recovery, resulted in a double deletion.
- Remove location-eof-check.patch; merged on upstream release</changelog>
  <changelog author="p.drouand@gmail.com" date="1421928000">- Update to version 3.0.3
  Bug fixes
  * C++ with Variants (lalr1.cc)
    Problems with %destructor and '%define parse.assert' have been fixed.
  * Named %union support (yacc.c, glr.c)
    Bison 3.0 introduced a regression on named %union such as
    %union foo { int ival; };
    The possibility to use a name was introduced "for Yacc compatibility".
    It is however not required by POSIX Yacc, and its usefulness is not clear.
  * %define api.value.type union with %defines (yacc.c, glr.c)
    The C parsers were broken when %defines was used together with "%define
    api.value.type union".
  * Redeclarations are reported in proper order
  Documentation
  * Bison now installs various files in its docdir (which defaults to
    '/usr/local/share/doc/bison'), including the three fully blown examples
    extracted from the documentation:
  - rpcalc
    Reverse polish calculator, a simple introductory example.
  - mfcalc
    Multi-function Calc, a calculator with memory and functions and located
    error messages.
  - calc++
    a calculator in C++ using variant support and token constructors.
- Split out translation files
- Pass "--docdir=%{_docdir}/%{name}" and do not perform %doc anymore</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Add gpg signature
- Update to 3.0.4:
  * Fix a compiler warning when no %destructor use $$.
  * Several portability issues in tests were fixed.</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Set the installinfo in preun rather than postun to avoid ugly
  warning about file not being present.
- Remove the Obsolete for old ppc64 support that won't get triggered</changelog>
  <changelog author="tchvatal@suse.com" date="1481716800">- Update keyring file to not be 38 MB large...</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix.patch: Add forward declaration to compile with GCC7.</changelog>
  <changelog author="pmonreal@suse.com" date="1621512000">- Fix build: [bsc#1183777]
  * Adjust to the glibc removal of libio.h in 2.28+
- Add bison-glibc-libio.patch</changelog>
</package>
<package pkgid="2a902994b2280a80b27b8214a9303580cec0ae621ede5c66d150642911a3bea1" name="bison" arch="ppc64le">
  <version epoch="0" ver="3.0.4" rel="3.3.1"/>
  <changelog author="schwab@suse.de" date="1373371200">- Override broken configure checks</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1375531200">- Update to bision 3.0
  * deep overhaul/improvements of the diagnostics
  * more versatile means to describe semantic value types,
  including the ability to store genuine C++ objects in C++ parsers
  * push-parser interface extended to Java
  * parse-time semantic predicates for GLR parsers.
  * This is a major update, please see https://lwn.net/Articles/561990/
  for all details and backward incompatible changes.</changelog>
  <changelog author="schwab@linux-m68k.org" date="1380283200">- location-eof-check.patch: Fix broken EOF check</changelog>
  <changelog author="p.drouand@gmail.com" date="1419422400">- Update to version 3.0.2
  + Generated source files when errors are reported
  + %empty is used in reports
  + When C++ variant support is enabled, an error triggered via YYERROR,
    but not caught via error recovery, resulted in a double deletion.
- Remove location-eof-check.patch; merged on upstream release</changelog>
  <changelog author="p.drouand@gmail.com" date="1421928000">- Update to version 3.0.3
  Bug fixes
  * C++ with Variants (lalr1.cc)
    Problems with %destructor and '%define parse.assert' have been fixed.
  * Named %union support (yacc.c, glr.c)
    Bison 3.0 introduced a regression on named %union such as
    %union foo { int ival; };
    The possibility to use a name was introduced "for Yacc compatibility".
    It is however not required by POSIX Yacc, and its usefulness is not clear.
  * %define api.value.type union with %defines (yacc.c, glr.c)
    The C parsers were broken when %defines was used together with "%define
    api.value.type union".
  * Redeclarations are reported in proper order
  Documentation
  * Bison now installs various files in its docdir (which defaults to
    '/usr/local/share/doc/bison'), including the three fully blown examples
    extracted from the documentation:
  - rpcalc
    Reverse polish calculator, a simple introductory example.
  - mfcalc
    Multi-function Calc, a calculator with memory and functions and located
    error messages.
  - calc++
    a calculator in C++ using variant support and token constructors.
- Split out translation files
- Pass "--docdir=%{_docdir}/%{name}" and do not perform %doc anymore</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Add gpg signature
- Update to 3.0.4:
  * Fix a compiler warning when no %destructor use $$.
  * Several portability issues in tests were fixed.</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Set the installinfo in preun rather than postun to avoid ugly
  warning about file not being present.
- Remove the Obsolete for old ppc64 support that won't get triggered</changelog>
  <changelog author="tchvatal@suse.com" date="1481716800">- Update keyring file to not be 38 MB large...</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix.patch: Add forward declaration to compile with GCC7.</changelog>
  <changelog author="pmonreal@suse.com" date="1621512000">- Fix build: [bsc#1183777]
  * Adjust to the glibc removal of libio.h in 2.28+
- Add bison-glibc-libio.patch</changelog>
</package>
<package pkgid="94af3cfe7026464d1e8e625c509be63af9107a787e7f7858b25b39a1ed672ff7" name="bison" arch="s390x">
  <version epoch="0" ver="3.0.4" rel="3.3.1"/>
  <changelog author="schwab@suse.de" date="1373371200">- Override broken configure checks</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1375531200">- Update to bision 3.0
  * deep overhaul/improvements of the diagnostics
  * more versatile means to describe semantic value types,
  including the ability to store genuine C++ objects in C++ parsers
  * push-parser interface extended to Java
  * parse-time semantic predicates for GLR parsers.
  * This is a major update, please see https://lwn.net/Articles/561990/
  for all details and backward incompatible changes.</changelog>
  <changelog author="schwab@linux-m68k.org" date="1380283200">- location-eof-check.patch: Fix broken EOF check</changelog>
  <changelog author="p.drouand@gmail.com" date="1419422400">- Update to version 3.0.2
  + Generated source files when errors are reported
  + %empty is used in reports
  + When C++ variant support is enabled, an error triggered via YYERROR,
    but not caught via error recovery, resulted in a double deletion.
- Remove location-eof-check.patch; merged on upstream release</changelog>
  <changelog author="p.drouand@gmail.com" date="1421928000">- Update to version 3.0.3
  Bug fixes
  * C++ with Variants (lalr1.cc)
    Problems with %destructor and '%define parse.assert' have been fixed.
  * Named %union support (yacc.c, glr.c)
    Bison 3.0 introduced a regression on named %union such as
    %union foo { int ival; };
    The possibility to use a name was introduced "for Yacc compatibility".
    It is however not required by POSIX Yacc, and its usefulness is not clear.
  * %define api.value.type union with %defines (yacc.c, glr.c)
    The C parsers were broken when %defines was used together with "%define
    api.value.type union".
  * Redeclarations are reported in proper order
  Documentation
  * Bison now installs various files in its docdir (which defaults to
    '/usr/local/share/doc/bison'), including the three fully blown examples
    extracted from the documentation:
  - rpcalc
    Reverse polish calculator, a simple introductory example.
  - mfcalc
    Multi-function Calc, a calculator with memory and functions and located
    error messages.
  - calc++
    a calculator in C++ using variant support and token constructors.
- Split out translation files
- Pass "--docdir=%{_docdir}/%{name}" and do not perform %doc anymore</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Add gpg signature
- Update to 3.0.4:
  * Fix a compiler warning when no %destructor use $$.
  * Several portability issues in tests were fixed.</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Set the installinfo in preun rather than postun to avoid ugly
  warning about file not being present.
- Remove the Obsolete for old ppc64 support that won't get triggered</changelog>
  <changelog author="tchvatal@suse.com" date="1481716800">- Update keyring file to not be 38 MB large...</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix.patch: Add forward declaration to compile with GCC7.</changelog>
  <changelog author="pmonreal@suse.com" date="1621512000">- Fix build: [bsc#1183777]
  * Adjust to the glibc removal of libio.h in 2.28+
- Add bison-glibc-libio.patch</changelog>
</package>
<package pkgid="68512b70de2b388fd2e0b7a6d1089bd11339123723eb76c3baa257b7d81ebb1c" name="bison" arch="src">
  <version epoch="0" ver="3.0.4" rel="3.3.1"/>
  <changelog author="coolo@novell.com" date="1265630400">- package yacc.1 too</changelog>
  <changelog author="rguenther@suse.de" date="1265803200">- Update to version 2.4.1.
- Apply fix for GCC 4.5 compliance.
- Apply fix for unsupported output file names.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1307448000">- Update to version 2.5
- Fixes GCC 4.6 warnings
- Changelist too long to fit here, see NEWS.</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="aj@suse.de" date="1326110400">- Own /usr/share/aclocal</changelog>
  <changelog author="aj@suse.de" date="1342526400">- Fix build with missing gets declaration (glibc 2.16)</changelog>
  <changelog author="nmo.marques@gmail.com" date="1348401600">- Update to version 2.6.2:
  + Buffer overruns, complaints from Flex, and portability issues
    in the test suite have been fixed.
  + Changelist too long to fit here, see NEWS
- Source format is now .xz
- Remove bison-stdio.in.patch: seems upstreamed
- Add 'xz' to BuildRequires</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1352721600">- bison 2.6.5
  * Incorrect definitions of YY_, issued by yacc.c when no parser header is
  generated, are removed.
  * Fix compiler warnings in the generated parser (yacc.c, glr.c)
  * Warnings about uninitialized yylval and/or yylloc for push parsers with a
  pure interface have been fixed for GCC 4.0 up to 4.8, and Clang 2.9 to
  3.2.</changelog>
  <changelog author="adrian@suse.com" date="1360152000">- bison update to 2.7
  * Changes in the format of error messages
  * New format for error reports: carets
  * New value for %define variable: api.pure full
  * New %define variable: api.location.type (glr.cc, lalr1.cc, lalr1.java)
  * Exception safety (lalr1.cc)
  * Graph improvements in DOT and XSLT
  * %language is no longer an experimental feature.</changelog>
  <changelog author="mmeister@suse.com" date="1363867200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="schwab@suse.de" date="1373371200">- Override broken configure checks</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1375531200">- Update to bision 3.0
  * deep overhaul/improvements of the diagnostics
  * more versatile means to describe semantic value types,
  including the ability to store genuine C++ objects in C++ parsers
  * push-parser interface extended to Java
  * parse-time semantic predicates for GLR parsers.
  * This is a major update, please see https://lwn.net/Articles/561990/
  for all details and backward incompatible changes.</changelog>
  <changelog author="schwab@linux-m68k.org" date="1380283200">- location-eof-check.patch: Fix broken EOF check</changelog>
  <changelog author="p.drouand@gmail.com" date="1419422400">- Update to version 3.0.2
  + Generated source files when errors are reported
  + %empty is used in reports
  + When C++ variant support is enabled, an error triggered via YYERROR,
    but not caught via error recovery, resulted in a double deletion.
- Remove location-eof-check.patch; merged on upstream release</changelog>
  <changelog author="p.drouand@gmail.com" date="1421928000">- Update to version 3.0.3
  Bug fixes
  * C++ with Variants (lalr1.cc)
    Problems with %destructor and '%define parse.assert' have been fixed.
  * Named %union support (yacc.c, glr.c)
    Bison 3.0 introduced a regression on named %union such as
    %union foo { int ival; };
    The possibility to use a name was introduced "for Yacc compatibility".
    It is however not required by POSIX Yacc, and its usefulness is not clear.
  * %define api.value.type union with %defines (yacc.c, glr.c)
    The C parsers were broken when %defines was used together with "%define
    api.value.type union".
  * Redeclarations are reported in proper order
  Documentation
  * Bison now installs various files in its docdir (which defaults to
    '/usr/local/share/doc/bison'), including the three fully blown examples
    extracted from the documentation:
  - rpcalc
    Reverse polish calculator, a simple introductory example.
  - mfcalc
    Multi-function Calc, a calculator with memory and functions and located
    error messages.
  - calc++
    a calculator in C++ using variant support and token constructors.
- Split out translation files
- Pass "--docdir=%{_docdir}/%{name}" and do not perform %doc anymore</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Add gpg signature
- Update to 3.0.4:
  * Fix a compiler warning when no %destructor use $$.
  * Several portability issues in tests were fixed.</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Set the installinfo in preun rather than postun to avoid ugly
  warning about file not being present.
- Remove the Obsolete for old ppc64 support that won't get triggered</changelog>
  <changelog author="tchvatal@suse.com" date="1481716800">- Update keyring file to not be 38 MB large...</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix.patch: Add forward declaration to compile with GCC7.</changelog>
  <changelog author="pmonreal@suse.com" date="1621512000">- Fix build: [bsc#1183777]
  * Adjust to the glibc removal of libio.h in 2.28+
- Add bison-glibc-libio.patch</changelog>
</package>
<package pkgid="4dbd39cd88fff001abbf11f3f50eaaff513255bfc0774faa77bb18e31c93db68" name="bison" arch="x86_64">
  <version epoch="0" ver="3.0.4" rel="3.3.1"/>
  <changelog author="schwab@suse.de" date="1373371200">- Override broken configure checks</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1375531200">- Update to bision 3.0
  * deep overhaul/improvements of the diagnostics
  * more versatile means to describe semantic value types,
  including the ability to store genuine C++ objects in C++ parsers
  * push-parser interface extended to Java
  * parse-time semantic predicates for GLR parsers.
  * This is a major update, please see https://lwn.net/Articles/561990/
  for all details and backward incompatible changes.</changelog>
  <changelog author="schwab@linux-m68k.org" date="1380283200">- location-eof-check.patch: Fix broken EOF check</changelog>
  <changelog author="p.drouand@gmail.com" date="1419422400">- Update to version 3.0.2
  + Generated source files when errors are reported
  + %empty is used in reports
  + When C++ variant support is enabled, an error triggered via YYERROR,
    but not caught via error recovery, resulted in a double deletion.
- Remove location-eof-check.patch; merged on upstream release</changelog>
  <changelog author="p.drouand@gmail.com" date="1421928000">- Update to version 3.0.3
  Bug fixes
  * C++ with Variants (lalr1.cc)
    Problems with %destructor and '%define parse.assert' have been fixed.
  * Named %union support (yacc.c, glr.c)
    Bison 3.0 introduced a regression on named %union such as
    %union foo { int ival; };
    The possibility to use a name was introduced "for Yacc compatibility".
    It is however not required by POSIX Yacc, and its usefulness is not clear.
  * %define api.value.type union with %defines (yacc.c, glr.c)
    The C parsers were broken when %defines was used together with "%define
    api.value.type union".
  * Redeclarations are reported in proper order
  Documentation
  * Bison now installs various files in its docdir (which defaults to
    '/usr/local/share/doc/bison'), including the three fully blown examples
    extracted from the documentation:
  - rpcalc
    Reverse polish calculator, a simple introductory example.
  - mfcalc
    Multi-function Calc, a calculator with memory and functions and located
    error messages.
  - calc++
    a calculator in C++ using variant support and token constructors.
- Split out translation files
- Pass "--docdir=%{_docdir}/%{name}" and do not perform %doc anymore</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Add gpg signature
- Update to 3.0.4:
  * Fix a compiler warning when no %destructor use $$.
  * Several portability issues in tests were fixed.</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Set the installinfo in preun rather than postun to avoid ugly
  warning about file not being present.
- Remove the Obsolete for old ppc64 support that won't get triggered</changelog>
  <changelog author="tchvatal@suse.com" date="1481716800">- Update keyring file to not be 38 MB large...</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix.patch: Add forward declaration to compile with GCC7.</changelog>
  <changelog author="pmonreal@suse.com" date="1621512000">- Fix build: [bsc#1183777]
  * Adjust to the glibc removal of libio.h in 2.28+
- Add bison-glibc-libio.patch</changelog>
</package>
<package pkgid="ecbecb5581fe1f7cfd9276954dbfff9254adeec7aeab0341525f99e03ecce3be" name="bison-32bit" arch="x86_64">
  <version epoch="0" ver="3.0.4" rel="3.3.1"/>
  <changelog author="schwab@suse.de" date="1373371200">- Override broken configure checks</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1375531200">- Update to bision 3.0
  * deep overhaul/improvements of the diagnostics
  * more versatile means to describe semantic value types,
  including the ability to store genuine C++ objects in C++ parsers
  * push-parser interface extended to Java
  * parse-time semantic predicates for GLR parsers.
  * This is a major update, please see https://lwn.net/Articles/561990/
  for all details and backward incompatible changes.</changelog>
  <changelog author="schwab@linux-m68k.org" date="1380283200">- location-eof-check.patch: Fix broken EOF check</changelog>
  <changelog author="p.drouand@gmail.com" date="1419422400">- Update to version 3.0.2
  + Generated source files when errors are reported
  + %empty is used in reports
  + When C++ variant support is enabled, an error triggered via YYERROR,
    but not caught via error recovery, resulted in a double deletion.
- Remove location-eof-check.patch; merged on upstream release</changelog>
  <changelog author="p.drouand@gmail.com" date="1421928000">- Update to version 3.0.3
  Bug fixes
  * C++ with Variants (lalr1.cc)
    Problems with %destructor and '%define parse.assert' have been fixed.
  * Named %union support (yacc.c, glr.c)
    Bison 3.0 introduced a regression on named %union such as
    %union foo { int ival; };
    The possibility to use a name was introduced "for Yacc compatibility".
    It is however not required by POSIX Yacc, and its usefulness is not clear.
  * %define api.value.type union with %defines (yacc.c, glr.c)
    The C parsers were broken when %defines was used together with "%define
    api.value.type union".
  * Redeclarations are reported in proper order
  Documentation
  * Bison now installs various files in its docdir (which defaults to
    '/usr/local/share/doc/bison'), including the three fully blown examples
    extracted from the documentation:
  - rpcalc
    Reverse polish calculator, a simple introductory example.
  - mfcalc
    Multi-function Calc, a calculator with memory and functions and located
    error messages.
  - calc++
    a calculator in C++ using variant support and token constructors.
- Split out translation files
- Pass "--docdir=%{_docdir}/%{name}" and do not perform %doc anymore</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Add gpg signature
- Update to 3.0.4:
  * Fix a compiler warning when no %destructor use $$.
  * Several portability issues in tests were fixed.</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Set the installinfo in preun rather than postun to avoid ugly
  warning about file not being present.
- Remove the Obsolete for old ppc64 support that won't get triggered</changelog>
  <changelog author="tchvatal@suse.com" date="1481716800">- Update keyring file to not be 38 MB large...</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix.patch: Add forward declaration to compile with GCC7.</changelog>
  <changelog author="pmonreal@suse.com" date="1621512000">- Fix build: [bsc#1183777]
  * Adjust to the glibc removal of libio.h in 2.28+
- Add bison-glibc-libio.patch</changelog>
</package>
<package pkgid="b263b900667792cc28b338e0270e90d4fbd77e8aa6e138b28b8b8addf91b3275" name="bison-lang" arch="noarch">
  <version epoch="0" ver="3.0.4" rel="3.3.1"/>
  <changelog author="schwab@suse.de" date="1373371200">- Override broken configure checks</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1375531200">- Update to bision 3.0
  * deep overhaul/improvements of the diagnostics
  * more versatile means to describe semantic value types,
  including the ability to store genuine C++ objects in C++ parsers
  * push-parser interface extended to Java
  * parse-time semantic predicates for GLR parsers.
  * This is a major update, please see https://lwn.net/Articles/561990/
  for all details and backward incompatible changes.</changelog>
  <changelog author="schwab@linux-m68k.org" date="1380283200">- location-eof-check.patch: Fix broken EOF check</changelog>
  <changelog author="p.drouand@gmail.com" date="1419422400">- Update to version 3.0.2
  + Generated source files when errors are reported
  + %empty is used in reports
  + When C++ variant support is enabled, an error triggered via YYERROR,
    but not caught via error recovery, resulted in a double deletion.
- Remove location-eof-check.patch; merged on upstream release</changelog>
  <changelog author="p.drouand@gmail.com" date="1421928000">- Update to version 3.0.3
  Bug fixes
  * C++ with Variants (lalr1.cc)
    Problems with %destructor and '%define parse.assert' have been fixed.
  * Named %union support (yacc.c, glr.c)
    Bison 3.0 introduced a regression on named %union such as
    %union foo { int ival; };
    The possibility to use a name was introduced "for Yacc compatibility".
    It is however not required by POSIX Yacc, and its usefulness is not clear.
  * %define api.value.type union with %defines (yacc.c, glr.c)
    The C parsers were broken when %defines was used together with "%define
    api.value.type union".
  * Redeclarations are reported in proper order
  Documentation
  * Bison now installs various files in its docdir (which defaults to
    '/usr/local/share/doc/bison'), including the three fully blown examples
    extracted from the documentation:
  - rpcalc
    Reverse polish calculator, a simple introductory example.
  - mfcalc
    Multi-function Calc, a calculator with memory and functions and located
    error messages.
  - calc++
    a calculator in C++ using variant support and token constructors.
- Split out translation files
- Pass "--docdir=%{_docdir}/%{name}" and do not perform %doc anymore</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Add gpg signature
- Update to 3.0.4:
  * Fix a compiler warning when no %destructor use $$.
  * Several portability issues in tests were fixed.</changelog>
  <changelog author="tchvatal@suse.com" date="1441108800">- Set the installinfo in preun rather than postun to avoid ugly
  warning about file not being present.
- Remove the Obsolete for old ppc64 support that won't get triggered</changelog>
  <changelog author="tchvatal@suse.com" date="1481716800">- Update keyring file to not be 38 MB large...</changelog>
  <changelog author="mliska@suse.cz" date="1481889600">- gcc7-fix.patch: Add forward declaration to compile with GCC7.</changelog>
  <changelog author="pmonreal@suse.com" date="1621512000">- Fix build: [bsc#1183777]
  * Adjust to the glibc removal of libio.h in 2.28+
- Add bison-glibc-libio.patch</changelog>
</package>
<package pkgid="c0ce251943bd0e5cd65c10c8781bdd52c2eef08899a18aa762c0a3a21d4ca374" name="bluez" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="46b743621acb215d22fbdb9be7b0e128877259a1b99b51530a5fca4b1e4cdd0f" name="bluez" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="d2f8c1d0fbe89c51ac394956690bef26493b98ae03b8cf45fe8fb7b8ecef81f5" name="bluez" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="a41798be5ef7c9a7cb3cb45601910551c72a5730f6b432dc78309ff5c1e14497" name="bluez" arch="src">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="a607aa619da89ce2004ac9a6dc7900bccef37d831d61173aaa00d418ea04a20f" name="bluez" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="085f5154e307a91c6e0fc3228017d7f58d8a929e1a5ecec4eb99d463c2c81222" name="bluez" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="7d20511fa59f1fc4ab1c48601db0fb2af378d31c00e7e5ca6a69a9b43a6965df" name="bluez" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="ccaebd49971c1c9872ffaaceb869183570bdaa4383bea12a5f6577e572fa3da6" name="bluez" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="fd04b2e11c4fe336655a18d967b4be93347106ee42adabfe2660abc7b5396364" name="bluez" arch="src">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="9667364d34263a6b790645f45ac12ea74f40112e85bb627978cff275e418b5bc" name="bluez" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="35f8eb59f8b82355fc4b212643922d43bb933634085a47a74f568db32016c0b3" name="bluez-auto-enable-devices" arch="noarch">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="258eb825c94dca89329ba4436b3062925644b00a0db917e3d79a54df82b0a6af" name="bluez-auto-enable-devices" arch="noarch">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="cb11f7b1b9760b302052051afbde671325f1db3b1813b443c076d17f0dc969fa" name="bluez-cups" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="04c7997aaee1b4947318e84d2833fd2b0d0f86515268e9c5790b6964a25a8004" name="bluez-cups" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="55582cce0b20bfcd28adf50462a1946dd8cc94a775514ea3099922e123e9eccf" name="bluez-cups" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="fe639fb74ecb2b70043e27b904b4ae9a9e7da8b010aecfbe5aa258104b2b1c1e" name="bluez-cups" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="1f9fecc7c7818ff8068c290ebb66e8ad8d62b671fca94f01203fc1e44a41bcbd" name="bluez-cups" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="f4caf84484c8c6f23e7385785bf498bf4d9df9ab11cf03957e40a2912eb1aef6" name="bluez-cups" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="9dc9add0b79920fcf9f0d0d9e617dfb25c1af608c9168c58b7a90bb26a76c8ae" name="bluez-cups" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="13e8ef59fac354b45c253cb633622b41bd701452366bfdb9e72eb6c11d1d4646" name="bluez-cups" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="fc2402ba11e09b4f310376f019f85888c3068b2e810c0a2f3f94a4f66b258b7d" name="bluez-deprecated" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="1f286a109430165ddb4b66fe7e5b0f436e422ce5b59b300ceda28657afb2b68c" name="bluez-deprecated" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="54989b303c19929c908b76d74464af655fd889149bde8854b31a948eee8cdc2b" name="bluez-deprecated" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="74f71f81b2773242c1c6eef3b8cd8c2d8918f9cad7ed205a625727c84cc51067" name="bluez-deprecated" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="efe6a10650485799d07b40e0479d0a1d2a455edc504f6b42356a0c77abfa62f9" name="bluez-deprecated" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="4eed8d39785f3ee05d9c5ac24e478bc9911b51d061e8c36621fa88a29217f878" name="bluez-deprecated" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="d66963126829e5a943aafacb350af404cfe14936bc9dc0fa33a20a085a3d62f5" name="bluez-deprecated" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="989ac9e45cd98758df97cef3621f894c47de03c9175bcdb30b0f22cd10f0cdda" name="bluez-deprecated" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="0796ce4dd27dbdc55757f182a042df18db14f333b843d739083aecbe96f3d1f9" name="bluez-devel-32bit" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="85229042d342d39ce306a20a3f975eec816e57d88aa715b72da213587f4baa0d" name="bluez-devel-32bit" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="2117ba9b222881b004d04076145a521ea3db1e6d54decb7d08c3a85f25c6959f" name="bluez-devel" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="c00d3502d6e1939c5be9081c15da4221d3e90314325876b58715aa5777e50a94" name="bluez-devel" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="01b35517ce5ec2f427cd8f194a6c6c105b58fe3407be5d4e4583bccb2c3db64e" name="bluez-devel" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="0c8963e2a61e70049d64733b6c4252419c3a29960ac3b1227ed8d98f6aaa9b21" name="bluez-devel" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="633ec98bfc58108ae252e3e63ecd0947a5970d015bef685c0de0f0d048682748" name="bluez-devel" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="2da9104b6c6471d434f0f647aa32ed35d1257b413e515e269f8355bdb815960f" name="bluez-devel" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="b4fe0edb17f1765bf961335efcc35430a005bab197cf71310a781158f6e8ae34" name="bluez-devel" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="bf35db19412ec9626a6557047fda8224826dd1bde734fd87d23127493e09a2f7" name="bluez-devel" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="50b2f2ff06bb4ea8cac010456361fba6e9de52c1cc5f2487a9800fe46ccf6c1d" name="bluez-test" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="8809acb460520beb4b63d34e8b7f708bff412f00a3b62e85a3e708cad2a5c59f" name="bluez-test" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="ee4ace692f292841308bb32651e5f89c88f03940aefb93535add0950b4a0652f" name="bluez-test" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="f2703e95e8c6da93b9c899464e50bf70a9bc1c930a22edf617bfd5caecf969c0" name="bluez-test" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.3.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1494072000">- update to version 5.45:
  This is mostly a bugfix release with fixes in ATT, GATT, OBEX
  and AVDTP.
  Feature-wise there are some new things as well, such as btmon
  support decoding Bluetooth 5.0 HCI commands and events.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
</package>
<package pkgid="72e8f10a3a1be1beb4817bff8a8c8359718472676844e3cb500ff02cb9042957" name="bluez-test" arch="aarch64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="becc2cb30394992bad8fec6940f1096bdab579453ac8b6f081f853fc90363990" name="bluez-test" arch="ppc64le">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="1bad9c3d9b1ff36ca49e0e6d4f2ae26d589373c4996b5e5630e289acda7b2cdd" name="bluez-test" arch="s390x">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="bde182ba5a2e949a3dad0cc81f51d71d3968e31efa04be4d01e02673c663c8fa" name="bluez-test" arch="x86_64">
  <version epoch="0" ver="5.55" rel="3.6.1"/>
  <changelog author="seife+obs@b1-systems.com" date="1495800000">- add bluez-5.45-disable-broken-tests.diff to disable two broken
  tests (reported upstream but not yet fixed)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1496923200">- add bluez-auto-enable-devices subpackage with main.conf which
  auto-enables all devices (boo#1039476)</changelog>
  <changelog author="msuchanek@suse.com" date="1498392000">- Add %post/%postun to bluez-auto-enable-devices so the settings
  change takes effect (boo#1039476)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1499428800">- enable sixaxis plugin</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1500120000">- update to version 5.46:
  * Fix issue with handling ATT over BR/EDR connections.
  * Fix issue with SDP browsing cleanup after connection.
  * Fix issue with pointer dereference and OPP Put request.
  * Fix issue with identity address updates during pairing.
  * Fix issue with not removing services that had disappeared.
  * Add support for improved discovery of included services.
  * Add support for simplified characteristics discovery.
  * Add support for GATT caching configuration option.
  * Add experimental support for AcquireWrite and AcquireNotify.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1505649600">- update to version 5.47:
  This release contains various fixes to GATT, A2DP and BR/EDR vs
  LE bearer handling. There?s also a notable SDP fix for CVE-2017-
  1000250 (part of the recently announced BlueBorne vulnerabilities).
  Feature-wise, there?s now support for adding the appearance and
  local name to advertising data through the Advertising D-Bus
  interface. The btmon tool is now also able to better decode most
  Bluetooth 5.0 HCI commands and events.
  The Bluetooth Mesh Profile specification was released recently,
  and this BlueZ release comes with initial support for it in the
  form of a new meshctl tool. Using this tool it?s possible to
  provision mesh devices through the GATT Provisioning Bearer
  (PB-GATT), as well as communicate with them (e.g. configure them)
  using the GATT Proxy protocol.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1513080000">- add 0001-obexd-use-AM_LDFLAGS-for-linking.patch
- document systemd dependency during %post</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1514548800">- update to version 5.48:
  This release brings many fixes and feature enhancements.
  Some notable enhancements include support for devices with the
  BLE battery service, as well as improved Mesh support in the
  meshctl tool. Several previously experimental D-Bus APIs have now
  been marked as stable, notably the Advertising Manager API as
  well as the AquireWrite &amp; AquireNotify GATT APIs.
  As far as fixes go, these can be found in many areas of the stack,
  including A2DP, AVCTP, device discovery, Mesh, and GATT.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1517313600">- Add disable_some_obex_tests.patch bypass boo#1078285 for PowerPC</changelog>
  <changelog author="acho@suse.com" date="1525435200">- Add
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump memory leak in pin_code_reply_dump().
  (bsc#1013721)(CVE-2016-9800)
  CVE-2016-9804-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Fix hcidump buffer overflow in commands_dump().
  (bsc#1013877)(CVE-2016-9804)</changelog>
  <changelog author="acho@suse.com" date="1530187200">- Add lost patches for RPi3 bluetooth support (bsc#995059)(bsc#1094902)
  0001-rpi3-bcm43xx-The-UART-speed-must-be-reset-after-the-firmw.patch
  0002-rpi3-Move-the-43xx-firmware-into-lib-firmware.patch</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1531483200">- add 0001-core-Fixes-order-InterfaceAdded.patch (boo#1101119)
  to fix headset connect after suspend/resume</changelog>
  <changelog author="acho@suse.com" date="1544184000">- Add hcidump-fixed-hci-frame-dump-stack-buffer-overflow.patch
  to replace
  CVE-2016-9800-tool-hcidump-Fix-memory-leak-with-malformed-packet.patch
  (PATCH-FIX-UPSTREAM)(bsc#1013721)(CVE-2016-9800)
  Add hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  to fix global buffer overflow (PATCH-FIX-UPSTREAM)
  (bsc#1013732)(CVE-2016-9801)
- Fix %ifarch range.</changelog>
  <changelog author="acho@suse.com" date="1548331200">- Add:btmon: multiple memory management vulnerabilities fixed
  Multiple different memory management vulnerabilities were discovered
  in btmon while fuzzing it with American Fuzzy Lop. Purpose of this
  fuzzing effort was to find some bugs in btmon, analyse and fix them
  but also try to exploit them. Also goal was to prove that fuzzing is
  low effort way to find bugs that could end up being severe ones.
  Most common weakness appeared to be buffer over-read which was
  usually caused by missing boundary checks before accessing array.
  Integer underflows were also quite common. Most interesting bug was
  simple buffer overflow that was actually discovered already couple
  years ago by op7ic:
  https://www.spinics.net/lists/linux-bluetooth/msg68898.html
  but it was still not fixed. This particular vulnerability ended up
  being quite easily exploitable if certain mitigation technics were
  disabled.(bsc#1015173)(CVE-2016-9918)(bsc#1013893)(CVE-2016-9802)
  0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  0005-btmon-fix-stack-buffer-overflow.patch
  0006-btmon-fix-multiple-segfaults.patch
  0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  0012-btmon-fix-segfault-caused-by-buffer-over-read.patch</changelog>
  <changelog author="acho@suse.com" date="1556193600">- Add
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch
  * amp_assoc_dump() didn't check the length of amp assoc struct.
  (bsc#1013712)(CVE-2016-9798)(bsc#1013708)(CVE-2016-9797)
  Add hcidump-Fix-memory-leak-with-malformed-packet.patch
  * Do not allow to read more than allocated data buffer size.
  (bsc#1015171)(CVE-2016-9917)
- Refresh patches:
  patches/bluez-cups-libexec.patch
  patches/bluez-5.45-disable-broken-tests.diff
- fix bluez.changes:
  add (bsc#1013893)(CVE-2016-9802) tag for last log.</changelog>
  <changelog author="acho@suse.com" date="1571140800">- Add
  hcidump-Fixed-malformed-segment-frame-length.patch
  * Ensure the L2CAP SDUs whose length field match the actual frame
  length.(bsc#1013712)(CVE-2016-9798)
- Modify bluez.changes:
  Remove (bsc#1013712)(CVE-2016-9798) tag from patch
  hcidump-Add-assoc-dump-function-assoc-date-length-ch.patch</changelog>
  <changelog author="acho@suse.com" date="1575547200">- Add tools-Fix-build-after-y2038-changes-in-glibc.patch
  * The 32-bit SIOCGSTAMP has been deprecated. Use the deprecated
  name to fix the build.(bsc#1156544)</changelog>
  <changelog author="acho@suse.com" date="1600171200">- update to 5.55:
  * Fix issue with handling security level for HoG.
  * Fix issue with handling HIDSDPDisable attribute.
  * Fix issue with handling HID virtual cable unplug.
  * Fix issue with handling HID channel disconnect order.
  * Fix issue with handling AVDTP delay reporting states.
  * Fix issue with handling AVRCP notification events.
  * Fix issue with handling AVRCP list player attributes.
  * Fix issue with handling AVRCP category 1 player settings.
  * Fix issue with handling AVRCP media player passthrough bitmask.
  * Fix issue with handling HFP 1.7 default features.
  * Fix issue with handling GATT disconnecting handling.
  * Fix issue with handling GATT database hash.
  * Fix issue with handling service changed characteristic.
  * Fix issue with handling read of multiple characteristic values.
  * Fix issue with handling Just-Works auto-accept pairing.
  * Fix issue with handling authentication of bonded devices.
  * Fix issue with handling L2CAP streaming mode for AVDTP.
  * Fix issue with handling SysEx parser for MIDI support.
  * Fix issue with handling configured scan parameter values.
  * Fix issue with handling temporary devices removal.
  * Fix issue with handling advertising flags.
- update to bluez-5.54:
  * Fix issue with HOGP to accept data only from bonded devices.
  * Fix issue with A2DP sessions being connected at the same time.
  * Fix issue with class UUID matches before connecting profile.
  * Add support for handling MTU auto-tuning option for AVDTP.
  * Add support for new policy for Just-Works repairing.
  * Add support for Enhanced ATT bearer (EATT).
- update to bluez-5.53:
  * Fix issue with handling unregistration for advertisment.
  * Fix issue with A2DP and handling recovering process.
  * Fix issue with udpating input device information.
  * Add support for loading blocked keys.
- update to version 5.52:
  * Fix issue with AVDTP session disconnect timeout handling.
  * Mark media endpoint APIs as stable interfaces.
- update to version 5.51:
  * Fix issue with first agent not being registered as default.
  * Fix issue with loading devices without Service Changed CCC.
  * Fix issue with GATT client and extended property reading.
  * Fix issue with handling GATT client invalid read behavior.
  * Fix issue with handling GATT disconnect handler removal.
  * Fix issue with missing GATT/GAP service records for SDP.
  * Fix issue with checking SDP continuation state length.
  * Fix issue with HID device removal on HoG disconnect.
  * Fix issue with AVDTP and session destroy handling.
  * Fix issue with AVCTP and output MTU accounting.
  * Fix issue with AVRCP and creating media items.
  * Add support for GATT database caching feature.
  * Add experimental support for Bluetooth Mesh Profile.
- update to version 5.50:
  - Fix issue with GATT and reading long values.
  - Fix issue with GATT and reading multiple includes.
  - Fix issue with GATT and service changes when offline.
  - Fix issue with handling secondary service discovery.
  - Fix issue with handling persistency of CCC values.
  - Fix issue with handling Mesh session on disconnection.
  - Fix issue with handling Mesh proxy PDU SAR message length.
  - Fix issue with handling Mesh default heartbeat TTL value.
  - Add support for Mesh node-reset operation handling.
  - Add support for GATT authorization request handling.
  - Add support for GATT minimum key size requirements.
  - Add support for GATT server and included services.
  - Add support for handling additional advertising data.
  - Add support for handling separate discoverable state.
  - Add support for enabling HFP version 1.7 features.
  - Add support for dedicated Bluetooth logging daemon.
- update to version 5.49:
  This is mostly a bug fix release, with fixes to features such as
  AVCTP, OBEX, GATT and Mesh. There are however some notable new
  features also, such as improved heartbeat management support in
  meshctl as well as a new experimental ConnectDevice D-Bus method
  on the Adapter interface, which can be used for quick device
  object creation for testing purpose or when information about the
  device has been received over some Out-of-Band channel.
- Add --enable-external-ell to actually make use of pkgconfig(ell).
- remove obsolete upstreamed patches:
  * 0001-obexd-use-AM_LDFLAGS-for-linking.patch
  * 0001-core-Fixes-order-InterfaceAdded.patch
  * tools-Fix-build-after-y2038-changes-in-glibc.patch
  * hcidump-Fix-set_ext_ctrl-global-buffer-overflow.patch
  * 0001-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0002-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0003-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0004-btmon-Fix-crash-caused-by-integer-underflow.patch
  * 0005-btmon-fix-stack-buffer-overflow.patch
  * 0006-btmon-fix-multiple-segfaults.patch
  * 0007-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0008-btmon-fix-segfault-caused-by-integer-undeflow.patch
  * 0009-btmon-fix-segfault-caused-by-buffer-over-read.patch
  * 0010-btmon-fix-segfault-caused-by-buffer-overflow.patch
  * 0011-btmon-fix-segfault-caused-by-integer-underflow.patch
  * 0012-btmon-fix-segfault-caused-by-buffer-over-read.patch
- use autopatch, spec-cleaner
- refresh other patches</changelog>
  <changelog author="acho@suse.com" date="1623412800">- Add
  shared-gatt-server-Fix-not-properly-checking-for-sec.patch
  * Fix not properly checking for secure flags
  (bsc#1186463 CVE-2021-0129 CVE-2020-26558)</changelog>
  <changelog author="acho@suse.com" date="1626264000">- Add gatt-Fix-potential-buffer-out-of-bound.patch
  * When client features is read check if the offset is within the cli_feat
    bounds. (bsc#1187165 CVE-2021-3588)
- Add shared-gatt-db-Introduce-gatt_db_attribute_set_fixed.patch
  * This enables user to inform if an attribute has a fixed length so it can
    automatically perform bounds checking. (bsc#1187165 CVE-2021-3588)
- Add gatt-Make-use-of-gatt_db_attribute_set_fixed_length.patch
  * This makes use of gatt_db_attribute_set_fixed_length so the database is
    aware of the length of the values and perform bounds checking.
  (bsc#1187165 CVE-2021-3588)</changelog>
</package>
<package pkgid="8924f21129375cda67aeca2b98f3e75d8067bf45edae2201cce8b33927b88053" name="bouncycastle" arch="noarch">
  <version epoch="0" ver="1.64" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1423569600">- Version bump to 1.50 to match Fedora
- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1424433600">- Disable tests on obs as they hang</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1445601600">- Version update to 1.53 (latest upstream)
  * No obvious changelog
  * Fixes bnc#951727 CVE-2015-7940</changelog>
  <changelog author="tchvatal@suse.com" date="1455969600">- Version update to 1.54:
  * No obvious changelog to be found
  * Fixes bnc#967521 CVE-2015-7575</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local
- Fixed requires
- Spec file cleaned</changelog>
  <changelog author="fstrba@suse.com" date="1504785600">- Set java source and target to 1.6 to allow building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1505476800">- Version update to 1.58
- Added patch:
  * ambiguous-reseed.patch
    + Upstream fix for an ambiguous overload</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility</changelog>
  <changelog author="abergmann@suse.com" date="1528718400">- Version update to 1.59:
  * CVE-2017-13098: Fix against Bleichenbacher oracle when not
    using the lightweight APIs (boo#1072697).
  * CVE-2016-1000338: Fix DSA ASN.1 validation during encoding of
    signature on verification (boo#1095722).
  * CVE-2016-1000339: Fix AESEngine key information leak via lookup
    table accesses (boo#1095853).
  * CVE-2016-1000340: Fix carry propagation bugs in the
    implementation of squaring for several raw math classes
    (boo#1095854).
  * CVE-2016-1000341: Fix DSA signature generation vulnerability to
    timing attack (boo#1095852).
  * CVE-2016-1000342: Fix ECDSA ASN.1 validation during encoding of
    signature on verification (boo#1095850).
  * CVE-2016-1000343: Fix week default settings for private DSA key
    pair generation (boo#1095849).
  * CVE-2016-1000344: Remove DHIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096026).
  * CVE-2016-1000345: Fix DHIES/ECIES CBC mode padding oracle
    attack (boo#1096025).
  * CVE-2016-1000346: Fix other party DH public key validation
    (boo#1096024).
  * CVE-2016-1000352: Remove ECIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096022).
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html
- Removed patch:
  * ambiguous-reseed.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="pmonreal@suse.com" date="1621598400">- Security fix: [bsc#1186328, CVE-2020-15522]
  * Fixes a timing issue within the EC math library
  * Blind the inversion when normalizing
- Add bouncycastle-CVE-2020-15522.patch</changelog>
</package>
<package pkgid="55ac4a0222db8945d3ba577faf1458a10812281eaa3904a196c5c559a751f9ce" name="bouncycastle" arch="src">
  <version epoch="0" ver="1.64" rel="3.3.1"/>
  <changelog author="mvyskocil@suse.com" date="1384430400">- Don't own /etc/java/security to not clash with javapackages-tools
- Don't mark random files as config</changelog>
  <changelog author="darin@darins.net" date="1400155200">- disable bytecode check on sle_11</changelog>
  <changelog author="tchvatal@suse.com" date="1404734400">- Depend on junit not junit4</changelog>
  <changelog author="tchvatal@suse.com" date="1423569600">- Version bump to 1.50 to match Fedora
- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1424433600">- Disable tests on obs as they hang</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1445601600">- Version update to 1.53 (latest upstream)
  * No obvious changelog
  * Fixes bnc#951727 CVE-2015-7940</changelog>
  <changelog author="tchvatal@suse.com" date="1455969600">- Version update to 1.54:
  * No obvious changelog to be found
  * Fixes bnc#967521 CVE-2015-7575</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local
- Fixed requires
- Spec file cleaned</changelog>
  <changelog author="fstrba@suse.com" date="1504785600">- Set java source and target to 1.6 to allow building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1505476800">- Version update to 1.58
- Added patch:
  * ambiguous-reseed.patch
    + Upstream fix for an ambiguous overload</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility</changelog>
  <changelog author="abergmann@suse.com" date="1528718400">- Version update to 1.59:
  * CVE-2017-13098: Fix against Bleichenbacher oracle when not
    using the lightweight APIs (boo#1072697).
  * CVE-2016-1000338: Fix DSA ASN.1 validation during encoding of
    signature on verification (boo#1095722).
  * CVE-2016-1000339: Fix AESEngine key information leak via lookup
    table accesses (boo#1095853).
  * CVE-2016-1000340: Fix carry propagation bugs in the
    implementation of squaring for several raw math classes
    (boo#1095854).
  * CVE-2016-1000341: Fix DSA signature generation vulnerability to
    timing attack (boo#1095852).
  * CVE-2016-1000342: Fix ECDSA ASN.1 validation during encoding of
    signature on verification (boo#1095850).
  * CVE-2016-1000343: Fix week default settings for private DSA key
    pair generation (boo#1095849).
  * CVE-2016-1000344: Remove DHIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096026).
  * CVE-2016-1000345: Fix DHIES/ECIES CBC mode padding oracle
    attack (boo#1096025).
  * CVE-2016-1000346: Fix other party DH public key validation
    (boo#1096024).
  * CVE-2016-1000352: Remove ECIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096022).
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html
- Removed patch:
  * ambiguous-reseed.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="pmonreal@suse.com" date="1621598400">- Security fix: [bsc#1186328, CVE-2020-15522]
  * Fixes a timing issue within the EC math library
  * Blind the inversion when normalizing
- Add bouncycastle-CVE-2020-15522.patch</changelog>
</package>
<package pkgid="37a93e8ebcde8d9f9988e5725d6e53c1364737a30783f39abdec97fd46dc2ce2" name="bouncycastle-javadoc" arch="noarch">
  <version epoch="0" ver="1.64" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1423569600">- Version bump to 1.50 to match Fedora
- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1424433600">- Disable tests on obs as they hang</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1445601600">- Version update to 1.53 (latest upstream)
  * No obvious changelog
  * Fixes bnc#951727 CVE-2015-7940</changelog>
  <changelog author="tchvatal@suse.com" date="1455969600">- Version update to 1.54:
  * No obvious changelog to be found
  * Fixes bnc#967521 CVE-2015-7575</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local
- Fixed requires
- Spec file cleaned</changelog>
  <changelog author="fstrba@suse.com" date="1504785600">- Set java source and target to 1.6 to allow building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1505476800">- Version update to 1.58
- Added patch:
  * ambiguous-reseed.patch
    + Upstream fix for an ambiguous overload</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility</changelog>
  <changelog author="abergmann@suse.com" date="1528718400">- Version update to 1.59:
  * CVE-2017-13098: Fix against Bleichenbacher oracle when not
    using the lightweight APIs (boo#1072697).
  * CVE-2016-1000338: Fix DSA ASN.1 validation during encoding of
    signature on verification (boo#1095722).
  * CVE-2016-1000339: Fix AESEngine key information leak via lookup
    table accesses (boo#1095853).
  * CVE-2016-1000340: Fix carry propagation bugs in the
    implementation of squaring for several raw math classes
    (boo#1095854).
  * CVE-2016-1000341: Fix DSA signature generation vulnerability to
    timing attack (boo#1095852).
  * CVE-2016-1000342: Fix ECDSA ASN.1 validation during encoding of
    signature on verification (boo#1095850).
  * CVE-2016-1000343: Fix week default settings for private DSA key
    pair generation (boo#1095849).
  * CVE-2016-1000344: Remove DHIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096026).
  * CVE-2016-1000345: Fix DHIES/ECIES CBC mode padding oracle
    attack (boo#1096025).
  * CVE-2016-1000346: Fix other party DH public key validation
    (boo#1096024).
  * CVE-2016-1000352: Remove ECIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096022).
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html
- Removed patch:
  * ambiguous-reseed.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="pmonreal@suse.com" date="1621598400">- Security fix: [bsc#1186328, CVE-2020-15522]
  * Fixes a timing issue within the EC math library
  * Blind the inversion when normalizing
- Add bouncycastle-CVE-2020-15522.patch</changelog>
</package>
<package pkgid="a50130a7a73e584cb5ff6cb7c0bcd842a43a44328e2fb6e70f899a27041fab80" name="bouncycastle-mail" arch="noarch">
  <version epoch="0" ver="1.64" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1423569600">- Version bump to 1.50 to match Fedora
- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1424433600">- Disable tests on obs as they hang</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1445601600">- Version update to 1.53 (latest upstream)
  * No obvious changelog
  * Fixes bnc#951727 CVE-2015-7940</changelog>
  <changelog author="tchvatal@suse.com" date="1455969600">- Version update to 1.54:
  * No obvious changelog to be found
  * Fixes bnc#967521 CVE-2015-7575</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local
- Fixed requires
- Spec file cleaned</changelog>
  <changelog author="fstrba@suse.com" date="1504785600">- Set java source and target to 1.6 to allow building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1505476800">- Version update to 1.58
- Added patch:
  * ambiguous-reseed.patch
    + Upstream fix for an ambiguous overload</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility</changelog>
  <changelog author="abergmann@suse.com" date="1528718400">- Version update to 1.59:
  * CVE-2017-13098: Fix against Bleichenbacher oracle when not
    using the lightweight APIs (boo#1072697).
  * CVE-2016-1000338: Fix DSA ASN.1 validation during encoding of
    signature on verification (boo#1095722).
  * CVE-2016-1000339: Fix AESEngine key information leak via lookup
    table accesses (boo#1095853).
  * CVE-2016-1000340: Fix carry propagation bugs in the
    implementation of squaring for several raw math classes
    (boo#1095854).
  * CVE-2016-1000341: Fix DSA signature generation vulnerability to
    timing attack (boo#1095852).
  * CVE-2016-1000342: Fix ECDSA ASN.1 validation during encoding of
    signature on verification (boo#1095850).
  * CVE-2016-1000343: Fix week default settings for private DSA key
    pair generation (boo#1095849).
  * CVE-2016-1000344: Remove DHIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096026).
  * CVE-2016-1000345: Fix DHIES/ECIES CBC mode padding oracle
    attack (boo#1096025).
  * CVE-2016-1000346: Fix other party DH public key validation
    (boo#1096024).
  * CVE-2016-1000352: Remove ECIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096022).
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html
- Removed patch:
  * ambiguous-reseed.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="pmonreal@suse.com" date="1621598400">- Security fix: [bsc#1186328, CVE-2020-15522]
  * Fixes a timing issue within the EC math library
  * Blind the inversion when normalizing
- Add bouncycastle-CVE-2020-15522.patch</changelog>
</package>
<package pkgid="fa950cdaaf0fc333687886494fb99e3090fcc9c5151746cb38006c9fb6e965d4" name="bouncycastle-pg" arch="noarch">
  <version epoch="0" ver="1.64" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1423569600">- Version bump to 1.50 to match Fedora
- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1424433600">- Disable tests on obs as they hang</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1445601600">- Version update to 1.53 (latest upstream)
  * No obvious changelog
  * Fixes bnc#951727 CVE-2015-7940</changelog>
  <changelog author="tchvatal@suse.com" date="1455969600">- Version update to 1.54:
  * No obvious changelog to be found
  * Fixes bnc#967521 CVE-2015-7575</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local
- Fixed requires
- Spec file cleaned</changelog>
  <changelog author="fstrba@suse.com" date="1504785600">- Set java source and target to 1.6 to allow building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1505476800">- Version update to 1.58
- Added patch:
  * ambiguous-reseed.patch
    + Upstream fix for an ambiguous overload</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility</changelog>
  <changelog author="abergmann@suse.com" date="1528718400">- Version update to 1.59:
  * CVE-2017-13098: Fix against Bleichenbacher oracle when not
    using the lightweight APIs (boo#1072697).
  * CVE-2016-1000338: Fix DSA ASN.1 validation during encoding of
    signature on verification (boo#1095722).
  * CVE-2016-1000339: Fix AESEngine key information leak via lookup
    table accesses (boo#1095853).
  * CVE-2016-1000340: Fix carry propagation bugs in the
    implementation of squaring for several raw math classes
    (boo#1095854).
  * CVE-2016-1000341: Fix DSA signature generation vulnerability to
    timing attack (boo#1095852).
  * CVE-2016-1000342: Fix ECDSA ASN.1 validation during encoding of
    signature on verification (boo#1095850).
  * CVE-2016-1000343: Fix week default settings for private DSA key
    pair generation (boo#1095849).
  * CVE-2016-1000344: Remove DHIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096026).
  * CVE-2016-1000345: Fix DHIES/ECIES CBC mode padding oracle
    attack (boo#1096025).
  * CVE-2016-1000346: Fix other party DH public key validation
    (boo#1096024).
  * CVE-2016-1000352: Remove ECIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096022).
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html
- Removed patch:
  * ambiguous-reseed.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="pmonreal@suse.com" date="1621598400">- Security fix: [bsc#1186328, CVE-2020-15522]
  * Fixes a timing issue within the EC math library
  * Blind the inversion when normalizing
- Add bouncycastle-CVE-2020-15522.patch</changelog>
</package>
<package pkgid="e9235dce9ae8b4d1323fd1b7b1c484dac809f98241069af4aebc60a86609bc2c" name="bouncycastle-pkix" arch="noarch">
  <version epoch="0" ver="1.64" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1423569600">- Version bump to 1.50 to match Fedora
- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1424433600">- Disable tests on obs as they hang</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1445601600">- Version update to 1.53 (latest upstream)
  * No obvious changelog
  * Fixes bnc#951727 CVE-2015-7940</changelog>
  <changelog author="tchvatal@suse.com" date="1455969600">- Version update to 1.54:
  * No obvious changelog to be found
  * Fixes bnc#967521 CVE-2015-7575</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local
- Fixed requires
- Spec file cleaned</changelog>
  <changelog author="fstrba@suse.com" date="1504785600">- Set java source and target to 1.6 to allow building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1505476800">- Version update to 1.58
- Added patch:
  * ambiguous-reseed.patch
    + Upstream fix for an ambiguous overload</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility</changelog>
  <changelog author="abergmann@suse.com" date="1528718400">- Version update to 1.59:
  * CVE-2017-13098: Fix against Bleichenbacher oracle when not
    using the lightweight APIs (boo#1072697).
  * CVE-2016-1000338: Fix DSA ASN.1 validation during encoding of
    signature on verification (boo#1095722).
  * CVE-2016-1000339: Fix AESEngine key information leak via lookup
    table accesses (boo#1095853).
  * CVE-2016-1000340: Fix carry propagation bugs in the
    implementation of squaring for several raw math classes
    (boo#1095854).
  * CVE-2016-1000341: Fix DSA signature generation vulnerability to
    timing attack (boo#1095852).
  * CVE-2016-1000342: Fix ECDSA ASN.1 validation during encoding of
    signature on verification (boo#1095850).
  * CVE-2016-1000343: Fix week default settings for private DSA key
    pair generation (boo#1095849).
  * CVE-2016-1000344: Remove DHIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096026).
  * CVE-2016-1000345: Fix DHIES/ECIES CBC mode padding oracle
    attack (boo#1096025).
  * CVE-2016-1000346: Fix other party DH public key validation
    (boo#1096024).
  * CVE-2016-1000352: Remove ECIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096022).
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html
- Removed patch:
  * ambiguous-reseed.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="pmonreal@suse.com" date="1621598400">- Security fix: [bsc#1186328, CVE-2020-15522]
  * Fixes a timing issue within the EC math library
  * Blind the inversion when normalizing
- Add bouncycastle-CVE-2020-15522.patch</changelog>
</package>
<package pkgid="a3bb4c3af66688d902c52d4b9e36a6969e3e162a0e1bcce245e418f301628f06" name="bouncycastle-tls" arch="noarch">
  <version epoch="0" ver="1.64" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1423569600">- Version bump to 1.50 to match Fedora
- Cleanup with spec-cleaner</changelog>
  <changelog author="tchvatal@suse.com" date="1424433600">- Disable tests on obs as they hang</changelog>
  <changelog author="tchvatal@suse.com" date="1426680000">- Fix build with new javapackages-tools</changelog>
  <changelog author="tchvatal@suse.com" date="1445601600">- Version update to 1.53 (latest upstream)
  * No obvious changelog
  * Fixes bnc#951727 CVE-2015-7940</changelog>
  <changelog author="tchvatal@suse.com" date="1455969600">- Version update to 1.54:
  * No obvious changelog to be found
  * Fixes bnc#967521 CVE-2015-7575</changelog>
  <changelog author="pcervinka@suse.com" date="1495195200">- New build dependency: javapackages-local
- Fixed requires
- Spec file cleaned</changelog>
  <changelog author="fstrba@suse.com" date="1504785600">- Set java source and target to 1.6 to allow building with jdk9</changelog>
  <changelog author="fstrba@suse.com" date="1505476800">- Version update to 1.58
- Added patch:
  * ambiguous-reseed.patch
    + Upstream fix for an ambiguous overload</changelog>
  <changelog author="fstrba@suse.com" date="1526385600">- Build with source and target 8 to prepare for a possible removal
  of 1.6 compatibility</changelog>
  <changelog author="abergmann@suse.com" date="1528718400">- Version update to 1.59:
  * CVE-2017-13098: Fix against Bleichenbacher oracle when not
    using the lightweight APIs (boo#1072697).
  * CVE-2016-1000338: Fix DSA ASN.1 validation during encoding of
    signature on verification (boo#1095722).
  * CVE-2016-1000339: Fix AESEngine key information leak via lookup
    table accesses (boo#1095853).
  * CVE-2016-1000340: Fix carry propagation bugs in the
    implementation of squaring for several raw math classes
    (boo#1095854).
  * CVE-2016-1000341: Fix DSA signature generation vulnerability to
    timing attack (boo#1095852).
  * CVE-2016-1000342: Fix ECDSA ASN.1 validation during encoding of
    signature on verification (boo#1095850).
  * CVE-2016-1000343: Fix week default settings for private DSA key
    pair generation (boo#1095849).
  * CVE-2016-1000344: Remove DHIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096026).
  * CVE-2016-1000345: Fix DHIES/ECIES CBC mode padding oracle
    attack (boo#1096025).
  * CVE-2016-1000346: Fix other party DH public key validation
    (boo#1096024).
  * CVE-2016-1000352: Remove ECIES from the provider to disable the
    unsafe usage of ECB mode (boo#1096022).
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html
- Removed patch:
  * ambiguous-reseed.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1532001600">- Version update to 1.60 bsc#1100694:
  * CVE-2018-1000613 Use of Externally-ControlledInput to Select Classes or Code
  * CVE-2018-1000180: issue around primality tests for RSA key pair generation
    if done using only the low-level API [bsc#1096291]
  * Release notes:
    http://www.bouncycastle.org/releasenotes.html</changelog>
  <changelog author="fstrba@suse.com" date="1569326400">- Package also the bcpkix bcpg bcmail bctls artifacts in separate
  sub-packages
- Revert to building with source/target 6, since it is still
  possible
- Added patch:
  * bouncycastle-javadoc.patch
    + fix javadoc build</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708800">- Version update to 1.63
  * Defects Fixed:
  - The ASN.1 parser would throw a large object exception for some objects
    which could be safely parsed.
  - GOST3412-2015 CTR mode was unusable at the JCE level.
  - The DSTU MACs were failing to reset fully on doFinal().
  - The DSTU MACs would throw an exception if the key was a multiple of the
    size as the MAC's underlying buffer size.
  - EdEC and QTESLA were not previously usable with the post Java 9 module structure.
  - ECNR was not correctly bounds checking the input and could produce invalid signatures.
  - ASN.1: Enforce no leading zeroes in OID branches (longer than 1 character).
  - TLS: Fix X448 support in JcaTlsCrypto.
  - Fixed field reduction for secp128r1 custom curve.
  - Fixed unsigned multiplications in X448 field squaring.
  - Some issues over subset Name Constraint validation in the CertPath analyser
  - TimeStampResponse.getEncoded() could throw an exception if the TimeStampToken was null.
  - Unnecessary memory usage in the ARGON2 implementation has been removed.
  - Param-Z in the GOST-28147 algorithm was not resolving correctly.
  - It is now possible to specify different S-Box parameters for the GOST 28147-89 MAC.
  * Additional Features and Functionality:
  - QTESLA is now updated with the round 2 changes. Note: the security catergories,
    and in some cases key generation and signatures, have changed. The round 1 version is
    now moved to org.bouncycastle.pqc.crypto.qteslarnd1, this package will be deleted in
    1.64. Please keep in mind that QTESLA may continue to evolve.
  - Support has been added for generating Ed25519/Ed448 signed certificates.
  - A method for recovering the message/digest value from an ECNR signature has been added.
  - Support for the ZUC-128 and ZUC-256 ciphers and MACs has been added to the provider
    and the lightweight API.
  - Support has been added for ChaCha20-Poly1305 AEAD mode from RFC 7539.
  - Improved performance for multiple ECDSA verifications using same public key.
  - Support for PBKDF2withHmacSM3 has been added to the BC provider.
  - The S/MIME API has been fixed to avoid unnecessary delays due to DNS resolution of a
    hosts name in internal MimeMessage preparation.
  - The valid path for EST services has been updated to cope with the characters used in
    the Aruba clearpass EST implementation.
- Version update to 1.62
  * Defects Fixed:
  - DTLS: Fixed infinite loop on IO exceptions.
  - DTLS: Retransmission timers now properly apply to flights monolithically.
  - BCJSSE: setEnabledCipherSuites ignores unsupported cipher suites.
  - BCJSSE: SSLSocket implementations store passed-in 'host' before connecting.
  - BCJSSE: Handle SSLEngine closure prior to handshake.
  - BCJSSE: Provider now configurable using security config under Java 11 and later.
  - EdDSA verifiers now reject overly long signatures.
  - XMSS/XMSS^MT OIDs now using the values defined in RFC 8391.
  - XMSS/XMSS^MT keys now encoded with OID at start.
  - An error causing valid paths to be rejected due to DN based name constraints
    has been fixed in the CertPath API.
  - Name constraint resolution now includes special handling of serial numbers.
  - Cipher implementations now handle ByteBuffer usage where the ByteBuffer has
    no backing array.
  - CertificateFactory now enforces presence of PEM headers when required.
  - A performance issue with RSA key pair generation that was introduced in 1.61
    has been mostly eliminated.
  * Additional Features and Functionality:
  - Builders for X509 certificates and CRLs now support replace and remove extension methods.
  - DTLS: Added server-side support for HelloVerifyRequest.
  - DTLS: Added support for an overall handshake timeout.
  - DTLS: Added support for the heartbeat extension (RFC 6520).
  - DTLS: Improve record seq. behaviour in HelloVerifyRequest scenarios.
  - TLS: BasicTlsPSKIdentity now reusable (returns cloned array from getPSK).
  - BCJSSE: Improved ALPN support, including selectors from Java 9.
  - Lightweight RSADigestSigner now support use of NullDigest.
  - SM2Engine now supports C1C3C2 mode.
  - SHA256withSM2 now added to provider.
  - BCJSSE: Added support for ALPN selectors (including in BC extension API for earlier JDKs).
  - BCJSSE: Support 'SSL' algorithm for SSLContext (alias for 'TLS').
  - The BLAKE2xs XOF has been added to the lightweight API.
  - Utility classes added to support journaling of SecureRandom and algorithms to allow
    persistance and later resumption.
  - PGP SexprParser now handles some unprotected key types.
  - NONEwithRSA support added to lightweight RSADigestSigner.
  - Support for the Ethereum flavor of IES has been added to the lightweight API.
- Version update to 1.61
  * Defects Fixed:
  - Use of EC named curves could be lost if keys were constructed.
    via a key factory and algorithm parameters.
  - RFC3211WrapEngine would not properly handle messages longer than 127 bytes.
  - The JCE implementations for RFC3211 would not return null AlgorithmParameters.
  - TLS: Don't check CCS status for hello_request.
  - TLS: Tolerate unrecognized hash algorithms.
  - TLS: Tolerate unrecognized SNI types.
  - Incompatibility issue in ECIES-KEM encryption in cofactor fixed.
  - Issue with XMSS/XMSSMT private key loading which could result in invalid signatures fixed.
  - StateAwareSignature.isSigningCapable() now returns false when the
    key has reached it's maximum number of signatures.
  - The McEliece KeyPairGenerator was failing to initialize the underlying
    class if a SecureRandom was explicitly passed.
  - The McEliece cipher would sometimes report the wrong value on a call
    to Cipher.getOutputSize(int).
  - CSHAKEDigest.leftEncode() was using the wrong endianness for multi byte values.
  - Some ciphers, such as CAST6, were missing AlgorithmParameters implementations.
  - An issue with the default "m" parameter for 1024 bit Diffie-Hellman keys which
    could result in an exception on key pair generation has been fixed.
  - The SPHINCS256 implementation is now more tolerant of parameters wrapped with a
    SecureRandom and will not throw an exception if it receives one.
  - A regression in PGPUtil.writeFileToLiteralData() which could cause corrupted
    literal data has been fixed.
  - Several parsing issues related to the processing of CMP PKIPublicationInfo.
  - The ECGOST curves for id-tc26-gost-3410-12-256-paramSetA and
    id-tc26-gost-3410-12-512-paramSetC had incorrect co-factors.
  * Additional Features and Functionality:
  - The qTESLA signature algorithm has been added to PQC light-weight API and the PQC provider.
  - The password hashing function, Argon2 has been added to the lightweight API.
  - BCJSSE: Added support for endpoint ID validation (HTTPS, LDAP, LDAPS).
  - BCJSSE: Added support for 'useCipherSuitesOrder' parameter.
  - BCJSSE: Added support for ALPN.
  - BCJSSE: Various changes for improved compatibility with SunJSSE.
  - BCJSSE: Provide default extended key/trust managers.
  - TLS: Added support for TLS 1.2 features from RFC 8446.
  - TLS: Removed support for EC point compression.
  - TLS: Removed support for record compression.
  - TLS: Updated to RFC 7627 from draft-ietf-tls-session-hash-04.
  - TLS: Improved certificate sig. alg. checks.
  - TLS: Finalised support for RFC 8442 cipher suites.
  - Support has been added to the main Provider for the Ed25519 and Ed448 signature algorithms.
  - Support has been added to the main Provider for the X25519 and X448 key agreement algorithms.
  - Utility classes have been added for handling OpenSSH keys.
  - Support for processing messages built using GPG and Curve25519 has been added to the OpenPGP API.
  - The provider now recognises the standard SM3 OID.
  - A new API for directly parsing and creating S/MIME documents has been added to the PKIX API.
  - SM2 in public key cipher mode has been added to the provider API.
  - The BCFKSLoadStoreParameter has been extended to allow the use of certificates and digital
    signatures for verifying the integrity of BCFKS key stores.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570708801">- Version update to 1.64 [bsc#1153385, CVE-2019-17359]
  [bsc#1096291, CVE-2018-1000180][bsc#1100694, CVE-2018-1000613]
  * Security Advisory:
  - CVE-2019-17359: A change to the ASN.1 parser in 1.63 introduced
    a regression that can cause an OutOfMemoryError to occur on
    parsing ASN.1 data.
  * Defects Fixed:
  - OpenSSH: Fixed padding in generated Ed25519 private keys.
  - GOST3410-2012-512 now uses the GOST3411-2012-256 as its KDF digest.
  - Validation of headers in PemReader now looks for tailing dashes in header.
  - Some compatibility issues around the signature encryption algorithm
    field in CMS SignedData and the GOST algorithms have been addressed.
  * Additional Features and Functionality:
  - PKCS12 key stores containing only certificates can now be created
    without the need to provide passwords.
  - BCJSSE: Initial support for AlgorithmConstraints; protocol versions
    and cipher suites.
  - BCJSSE: Initial support for 'jdk.tls.disabledAlgorithms'; protocol
    versions and cipher suites.
  - BCJSSE: Add SecurityManager check to access session context.
  - BCJSSE: Improved SunJSSE compatibility of the NULL_SESSION.
  - BCJSSE: SSLContext algorithms updated for SunJSSE compatibility
    (default enabled protocols).
  - The digest functions Haraka-256 and Haraka-512 have been added to
    the provider and the light-weight API
  - XMSS/XMSS^MT key management now allows for allocating subsets of the
    private key space using the extraKeyShard() method. Use of
    StateAwareSignature is now deprecated.
  - Support for Java 11's NamedParameterSpec class has been added
    (using reflection) to the EC and EdEC KeyPairGenerator implementations.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1570881600">- Update pom files with those from Maven repository.</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573041600">- Fix arch dependent macros in noarch package [bsc#1109539]</changelog>
  <changelog author="pmonreal@suse.com" date="1621598400">- Security fix: [bsc#1186328, CVE-2020-15522]
  * Fixes a timing issue within the EC math library
  * Blind the inversion when normalizing
- Add bouncycastle-CVE-2020-15522.patch</changelog>
</package>
<package pkgid="14afc0eb321939d7955dea204d0663da629e74e01feb172abd746fab5438bafb" name="bpftrace" arch="aarch64">
  <version epoch="0" ver="0.11.4" rel="3.2.1"/>
  <changelog author="asarai@suse.com" date="1540900800">- Initial bpftrace 0.0.0 import. Upstream doesn't really have versioning, so
  now we just use _service and pull from master. BCC required a bit of
  vendoring work, though hopefully we can switch to using bcc-tool-devel.
  boo#1117223</changelog>
  <changelog author="asarai@suse.com" date="1543147200">- Switch to using bcc-devel from Base:System. This required a few backports
  from upstream and some other various changes. boo#1117223
  https://github.com/iovisor/bpftrace/pull/227
  * 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1547553600">- Update bpftrace import to 0.0.0 (again).
- Remove patch for bcc-devel now that there is an upstream fix for it
  (https://github.com/iovisor/bpftrace/pull/327). boo#1117223
  - 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1556107200">- Update bpftrace to v0.9.
- Deprecated: sym() and stack() are deprecated.
    Use ksym() and kstack() instead.</changelog>
  <changelog author="asarai@suse.com" date="1561550400">- Update bpftrace to v0.9.1. Upstream changelog:
  * Additions:
    + Introduce compound assignment operators (+= and friends).
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Add basic support to enums (treat them as constants).
    + Add macro definition support.
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Allow comparison of two string variables.
    + Add pre and post behavior to ++ and -- operators.
  * Breaking changes:
  - Ban kprobes that cause CPU deadlocks.
    + Add unsafe-mode and make default execution mode safe-mode.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1563019200">- Use %cmake for building, don't set flags manually.
- Use %cmake_install instead of installing manually.
- install-man-dir.patch: Fix installation directory for man pages.
- Fix executable bit for tools.
- Fix shebangs in %prep, use -exec instead of piping to xargs.
- Disable LTO, because -flto=&lt;number&gt; isn't supported by Clang.
  Also LTO is perhaps not so important here.</changelog>
  <changelog author="aojeagarcia@suse.com" date="1566302400">- Add readline missing dependency</changelog>
  <changelog author="mpluskal@suse.com" date="1566302401">- Cleanup using spec-cleaner</changelog>
  <changelog author="glin@suse.com" date="1574164800">- Update bpftrace to v0.9.2
  + New environment variables (BPFTRACE_NO_USER_SYMBOLS,
    BPFTRACE_LOG_SIZE)
  + New probe type: memory watchpoint
  + Support for JSON output
- Exclude armv7 and i586 since bcc doesn't support USDT for these
  two architectures</changelog>
  <changelog author="aloisio@gmx.com" date="1574337600">- Update to version 0.9.3
  * Allow attaching to uprobes at an offset
  * BTF support
  * integer casts
  * integer pointer casts</changelog>
  <changelog author="asarai@suse.com" date="1580472000">- Fix builds on Leap 15.1. This requires quite a bit of trickery related to
  binutils (see boo#1162312), but it's nothing too hard.
- Added patch to workaround boo#1162312.
  + boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch</changelog>
  <changelog author="asarai@suse.com" date="1580904000">- Update to bpftrace 0.9.4.
  * New calls: signal, override, strncmp.
  * Support for attaching to `kprobes` at an offset.
  * Support for struct bitfields.
  See the upstream changelog for more details:
    &lt;https://github.com/iovisor/bpftrace/releases/tag/v0.9.4&gt;</changelog>
  <changelog author="idonmez@suse.com" date="1586865600">- Update to version 0.10.0
  * Support for LLVM 9 and LLVM 10 has been added.
  * See the complete changelog at https://github.com/iovisor/bpftrace/releases/tag/v0.10.0
- Drop upstreamed patches:
  - boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch
  - install-man-dir.patch</changelog>
  <changelog author="asarai@suse.com" date="1594814400">- Update to bpftrace 0.11.0.</changelog>
  <changelog author="asarai@suse.com" date="1604145600">- Update to bpftrace 0.11.2.
  * Support for LLVM 11.</changelog>
  <changelog author="mrueckert@suse.de" date="1604923200">- added detect-7-arg-bpf_attach_uprobe.patch:
  fix build with new bpf_attach_uprobe in TW</changelog>
  <changelog author="asarai@suse.com" date="1605355200">- Update to bpftrace 0.11.4.
  * Alpine build bug fix release
  * bcc 0.17 support release
- Remove upstreamed patches:
  - detect-7-arg-bpf_attach_uprobe.patch</changelog>
  <changelog author="asarai@suse.com" date="1606132800">- Do not strip bpftrace binaries -- bpftrace depends on debuginfos for
  /proc/self/exe in order to implement the BEGIN trigger. bsc#1178928</changelog>
  <changelog author="glin@suse.com" date="1610107200">- Add bpftrace-bsc1180670-sync-man-page-and-help.patch to sync
  man page and help (bsc1180670)</changelog>
</package>
<package pkgid="687a84fff7ae342958b17c0a6fa3c42102eee32b862d2fcb3acff1a2e23cdf0d" name="bpftrace" arch="ppc64le">
  <version epoch="0" ver="0.11.4" rel="3.2.1"/>
  <changelog author="asarai@suse.com" date="1540900800">- Initial bpftrace 0.0.0 import. Upstream doesn't really have versioning, so
  now we just use _service and pull from master. BCC required a bit of
  vendoring work, though hopefully we can switch to using bcc-tool-devel.
  boo#1117223</changelog>
  <changelog author="asarai@suse.com" date="1543147200">- Switch to using bcc-devel from Base:System. This required a few backports
  from upstream and some other various changes. boo#1117223
  https://github.com/iovisor/bpftrace/pull/227
  * 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1547553600">- Update bpftrace import to 0.0.0 (again).
- Remove patch for bcc-devel now that there is an upstream fix for it
  (https://github.com/iovisor/bpftrace/pull/327). boo#1117223
  - 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1556107200">- Update bpftrace to v0.9.
- Deprecated: sym() and stack() are deprecated.
    Use ksym() and kstack() instead.</changelog>
  <changelog author="asarai@suse.com" date="1561550400">- Update bpftrace to v0.9.1. Upstream changelog:
  * Additions:
    + Introduce compound assignment operators (+= and friends).
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Add basic support to enums (treat them as constants).
    + Add macro definition support.
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Allow comparison of two string variables.
    + Add pre and post behavior to ++ and -- operators.
  * Breaking changes:
  - Ban kprobes that cause CPU deadlocks.
    + Add unsafe-mode and make default execution mode safe-mode.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1563019200">- Use %cmake for building, don't set flags manually.
- Use %cmake_install instead of installing manually.
- install-man-dir.patch: Fix installation directory for man pages.
- Fix executable bit for tools.
- Fix shebangs in %prep, use -exec instead of piping to xargs.
- Disable LTO, because -flto=&lt;number&gt; isn't supported by Clang.
  Also LTO is perhaps not so important here.</changelog>
  <changelog author="aojeagarcia@suse.com" date="1566302400">- Add readline missing dependency</changelog>
  <changelog author="mpluskal@suse.com" date="1566302401">- Cleanup using spec-cleaner</changelog>
  <changelog author="glin@suse.com" date="1574164800">- Update bpftrace to v0.9.2
  + New environment variables (BPFTRACE_NO_USER_SYMBOLS,
    BPFTRACE_LOG_SIZE)
  + New probe type: memory watchpoint
  + Support for JSON output
- Exclude armv7 and i586 since bcc doesn't support USDT for these
  two architectures</changelog>
  <changelog author="aloisio@gmx.com" date="1574337600">- Update to version 0.9.3
  * Allow attaching to uprobes at an offset
  * BTF support
  * integer casts
  * integer pointer casts</changelog>
  <changelog author="asarai@suse.com" date="1580472000">- Fix builds on Leap 15.1. This requires quite a bit of trickery related to
  binutils (see boo#1162312), but it's nothing too hard.
- Added patch to workaround boo#1162312.
  + boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch</changelog>
  <changelog author="asarai@suse.com" date="1580904000">- Update to bpftrace 0.9.4.
  * New calls: signal, override, strncmp.
  * Support for attaching to `kprobes` at an offset.
  * Support for struct bitfields.
  See the upstream changelog for more details:
    &lt;https://github.com/iovisor/bpftrace/releases/tag/v0.9.4&gt;</changelog>
  <changelog author="idonmez@suse.com" date="1586865600">- Update to version 0.10.0
  * Support for LLVM 9 and LLVM 10 has been added.
  * See the complete changelog at https://github.com/iovisor/bpftrace/releases/tag/v0.10.0
- Drop upstreamed patches:
  - boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch
  - install-man-dir.patch</changelog>
  <changelog author="asarai@suse.com" date="1594814400">- Update to bpftrace 0.11.0.</changelog>
  <changelog author="asarai@suse.com" date="1604145600">- Update to bpftrace 0.11.2.
  * Support for LLVM 11.</changelog>
  <changelog author="mrueckert@suse.de" date="1604923200">- added detect-7-arg-bpf_attach_uprobe.patch:
  fix build with new bpf_attach_uprobe in TW</changelog>
  <changelog author="asarai@suse.com" date="1605355200">- Update to bpftrace 0.11.4.
  * Alpine build bug fix release
  * bcc 0.17 support release
- Remove upstreamed patches:
  - detect-7-arg-bpf_attach_uprobe.patch</changelog>
  <changelog author="asarai@suse.com" date="1606132800">- Do not strip bpftrace binaries -- bpftrace depends on debuginfos for
  /proc/self/exe in order to implement the BEGIN trigger. bsc#1178928</changelog>
  <changelog author="glin@suse.com" date="1610107200">- Add bpftrace-bsc1180670-sync-man-page-and-help.patch to sync
  man page and help (bsc1180670)</changelog>
</package>
<package pkgid="437d0be29a05a200dd5053cd9f84c82485a8b1d11d61d5d121d1376339d00870" name="bpftrace" arch="s390x">
  <version epoch="0" ver="0.11.4" rel="3.2.1"/>
  <changelog author="asarai@suse.com" date="1540900800">- Initial bpftrace 0.0.0 import. Upstream doesn't really have versioning, so
  now we just use _service and pull from master. BCC required a bit of
  vendoring work, though hopefully we can switch to using bcc-tool-devel.
  boo#1117223</changelog>
  <changelog author="asarai@suse.com" date="1543147200">- Switch to using bcc-devel from Base:System. This required a few backports
  from upstream and some other various changes. boo#1117223
  https://github.com/iovisor/bpftrace/pull/227
  * 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1547553600">- Update bpftrace import to 0.0.0 (again).
- Remove patch for bcc-devel now that there is an upstream fix for it
  (https://github.com/iovisor/bpftrace/pull/327). boo#1117223
  - 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1556107200">- Update bpftrace to v0.9.
- Deprecated: sym() and stack() are deprecated.
    Use ksym() and kstack() instead.</changelog>
  <changelog author="asarai@suse.com" date="1561550400">- Update bpftrace to v0.9.1. Upstream changelog:
  * Additions:
    + Introduce compound assignment operators (+= and friends).
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Add basic support to enums (treat them as constants).
    + Add macro definition support.
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Allow comparison of two string variables.
    + Add pre and post behavior to ++ and -- operators.
  * Breaking changes:
  - Ban kprobes that cause CPU deadlocks.
    + Add unsafe-mode and make default execution mode safe-mode.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1563019200">- Use %cmake for building, don't set flags manually.
- Use %cmake_install instead of installing manually.
- install-man-dir.patch: Fix installation directory for man pages.
- Fix executable bit for tools.
- Fix shebangs in %prep, use -exec instead of piping to xargs.
- Disable LTO, because -flto=&lt;number&gt; isn't supported by Clang.
  Also LTO is perhaps not so important here.</changelog>
  <changelog author="aojeagarcia@suse.com" date="1566302400">- Add readline missing dependency</changelog>
  <changelog author="mpluskal@suse.com" date="1566302401">- Cleanup using spec-cleaner</changelog>
  <changelog author="glin@suse.com" date="1574164800">- Update bpftrace to v0.9.2
  + New environment variables (BPFTRACE_NO_USER_SYMBOLS,
    BPFTRACE_LOG_SIZE)
  + New probe type: memory watchpoint
  + Support for JSON output
- Exclude armv7 and i586 since bcc doesn't support USDT for these
  two architectures</changelog>
  <changelog author="aloisio@gmx.com" date="1574337600">- Update to version 0.9.3
  * Allow attaching to uprobes at an offset
  * BTF support
  * integer casts
  * integer pointer casts</changelog>
  <changelog author="asarai@suse.com" date="1580472000">- Fix builds on Leap 15.1. This requires quite a bit of trickery related to
  binutils (see boo#1162312), but it's nothing too hard.
- Added patch to workaround boo#1162312.
  + boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch</changelog>
  <changelog author="asarai@suse.com" date="1580904000">- Update to bpftrace 0.9.4.
  * New calls: signal, override, strncmp.
  * Support for attaching to `kprobes` at an offset.
  * Support for struct bitfields.
  See the upstream changelog for more details:
    &lt;https://github.com/iovisor/bpftrace/releases/tag/v0.9.4&gt;</changelog>
  <changelog author="idonmez@suse.com" date="1586865600">- Update to version 0.10.0
  * Support for LLVM 9 and LLVM 10 has been added.
  * See the complete changelog at https://github.com/iovisor/bpftrace/releases/tag/v0.10.0
- Drop upstreamed patches:
  - boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch
  - install-man-dir.patch</changelog>
  <changelog author="asarai@suse.com" date="1594814400">- Update to bpftrace 0.11.0.</changelog>
  <changelog author="asarai@suse.com" date="1604145600">- Update to bpftrace 0.11.2.
  * Support for LLVM 11.</changelog>
  <changelog author="mrueckert@suse.de" date="1604923200">- added detect-7-arg-bpf_attach_uprobe.patch:
  fix build with new bpf_attach_uprobe in TW</changelog>
  <changelog author="asarai@suse.com" date="1605355200">- Update to bpftrace 0.11.4.
  * Alpine build bug fix release
  * bcc 0.17 support release
- Remove upstreamed patches:
  - detect-7-arg-bpf_attach_uprobe.patch</changelog>
  <changelog author="asarai@suse.com" date="1606132800">- Do not strip bpftrace binaries -- bpftrace depends on debuginfos for
  /proc/self/exe in order to implement the BEGIN trigger. bsc#1178928</changelog>
  <changelog author="glin@suse.com" date="1610107200">- Add bpftrace-bsc1180670-sync-man-page-and-help.patch to sync
  man page and help (bsc1180670)</changelog>
</package>
<package pkgid="ccdd3c6d067c315f1e73a59e2c0c4fcf3a850af4e4189a4b04f73586c0367a0f" name="bpftrace" arch="src">
  <version epoch="0" ver="0.11.4" rel="3.2.1"/>
  <changelog author="asarai@suse.com" date="1540900800">- Initial bpftrace 0.0.0 import. Upstream doesn't really have versioning, so
  now we just use _service and pull from master. BCC required a bit of
  vendoring work, though hopefully we can switch to using bcc-tool-devel.
  boo#1117223</changelog>
  <changelog author="asarai@suse.com" date="1543147200">- Switch to using bcc-devel from Base:System. This required a few backports
  from upstream and some other various changes. boo#1117223
  https://github.com/iovisor/bpftrace/pull/227
  * 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1547553600">- Update bpftrace import to 0.0.0 (again).
- Remove patch for bcc-devel now that there is an upstream fix for it
  (https://github.com/iovisor/bpftrace/pull/327). boo#1117223
  - 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1556107200">- Update bpftrace to v0.9.
- Deprecated: sym() and stack() are deprecated.
    Use ksym() and kstack() instead.</changelog>
  <changelog author="asarai@suse.com" date="1561550400">- Update bpftrace to v0.9.1. Upstream changelog:
  * Additions:
    + Introduce compound assignment operators (+= and friends).
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Add basic support to enums (treat them as constants).
    + Add macro definition support.
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Allow comparison of two string variables.
    + Add pre and post behavior to ++ and -- operators.
  * Breaking changes:
  - Ban kprobes that cause CPU deadlocks.
    + Add unsafe-mode and make default execution mode safe-mode.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1563019200">- Use %cmake for building, don't set flags manually.
- Use %cmake_install instead of installing manually.
- install-man-dir.patch: Fix installation directory for man pages.
- Fix executable bit for tools.
- Fix shebangs in %prep, use -exec instead of piping to xargs.
- Disable LTO, because -flto=&lt;number&gt; isn't supported by Clang.
  Also LTO is perhaps not so important here.</changelog>
  <changelog author="aojeagarcia@suse.com" date="1566302400">- Add readline missing dependency</changelog>
  <changelog author="mpluskal@suse.com" date="1566302401">- Cleanup using spec-cleaner</changelog>
  <changelog author="glin@suse.com" date="1574164800">- Update bpftrace to v0.9.2
  + New environment variables (BPFTRACE_NO_USER_SYMBOLS,
    BPFTRACE_LOG_SIZE)
  + New probe type: memory watchpoint
  + Support for JSON output
- Exclude armv7 and i586 since bcc doesn't support USDT for these
  two architectures</changelog>
  <changelog author="aloisio@gmx.com" date="1574337600">- Update to version 0.9.3
  * Allow attaching to uprobes at an offset
  * BTF support
  * integer casts
  * integer pointer casts</changelog>
  <changelog author="asarai@suse.com" date="1580472000">- Fix builds on Leap 15.1. This requires quite a bit of trickery related to
  binutils (see boo#1162312), but it's nothing too hard.
- Added patch to workaround boo#1162312.
  + boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch</changelog>
  <changelog author="asarai@suse.com" date="1580904000">- Update to bpftrace 0.9.4.
  * New calls: signal, override, strncmp.
  * Support for attaching to `kprobes` at an offset.
  * Support for struct bitfields.
  See the upstream changelog for more details:
    &lt;https://github.com/iovisor/bpftrace/releases/tag/v0.9.4&gt;</changelog>
  <changelog author="idonmez@suse.com" date="1586865600">- Update to version 0.10.0
  * Support for LLVM 9 and LLVM 10 has been added.
  * See the complete changelog at https://github.com/iovisor/bpftrace/releases/tag/v0.10.0
- Drop upstreamed patches:
  - boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch
  - install-man-dir.patch</changelog>
  <changelog author="asarai@suse.com" date="1594814400">- Update to bpftrace 0.11.0.</changelog>
  <changelog author="asarai@suse.com" date="1604145600">- Update to bpftrace 0.11.2.
  * Support for LLVM 11.</changelog>
  <changelog author="mrueckert@suse.de" date="1604923200">- added detect-7-arg-bpf_attach_uprobe.patch:
  fix build with new bpf_attach_uprobe in TW</changelog>
  <changelog author="asarai@suse.com" date="1605355200">- Update to bpftrace 0.11.4.
  * Alpine build bug fix release
  * bcc 0.17 support release
- Remove upstreamed patches:
  - detect-7-arg-bpf_attach_uprobe.patch</changelog>
  <changelog author="asarai@suse.com" date="1606132800">- Do not strip bpftrace binaries -- bpftrace depends on debuginfos for
  /proc/self/exe in order to implement the BEGIN trigger. bsc#1178928</changelog>
  <changelog author="glin@suse.com" date="1610107200">- Add bpftrace-bsc1180670-sync-man-page-and-help.patch to sync
  man page and help (bsc1180670)</changelog>
</package>
<package pkgid="ceb8ffac71c16f190247d9e95ce82eed4bd45e96f8c2576328539433bafa5564" name="bpftrace" arch="x86_64">
  <version epoch="0" ver="0.11.4" rel="3.2.1"/>
  <changelog author="asarai@suse.com" date="1540900800">- Initial bpftrace 0.0.0 import. Upstream doesn't really have versioning, so
  now we just use _service and pull from master. BCC required a bit of
  vendoring work, though hopefully we can switch to using bcc-tool-devel.
  boo#1117223</changelog>
  <changelog author="asarai@suse.com" date="1543147200">- Switch to using bcc-devel from Base:System. This required a few backports
  from upstream and some other various changes. boo#1117223
  https://github.com/iovisor/bpftrace/pull/227
  * 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1547553600">- Update bpftrace import to 0.0.0 (again).
- Remove patch for bcc-devel now that there is an upstream fix for it
  (https://github.com/iovisor/bpftrace/pull/327). boo#1117223
  - 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1556107200">- Update bpftrace to v0.9.
- Deprecated: sym() and stack() are deprecated.
    Use ksym() and kstack() instead.</changelog>
  <changelog author="asarai@suse.com" date="1561550400">- Update bpftrace to v0.9.1. Upstream changelog:
  * Additions:
    + Introduce compound assignment operators (+= and friends).
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Add basic support to enums (treat them as constants).
    + Add macro definition support.
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Allow comparison of two string variables.
    + Add pre and post behavior to ++ and -- operators.
  * Breaking changes:
  - Ban kprobes that cause CPU deadlocks.
    + Add unsafe-mode and make default execution mode safe-mode.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1563019200">- Use %cmake for building, don't set flags manually.
- Use %cmake_install instead of installing manually.
- install-man-dir.patch: Fix installation directory for man pages.
- Fix executable bit for tools.
- Fix shebangs in %prep, use -exec instead of piping to xargs.
- Disable LTO, because -flto=&lt;number&gt; isn't supported by Clang.
  Also LTO is perhaps not so important here.</changelog>
  <changelog author="aojeagarcia@suse.com" date="1566302400">- Add readline missing dependency</changelog>
  <changelog author="mpluskal@suse.com" date="1566302401">- Cleanup using spec-cleaner</changelog>
  <changelog author="glin@suse.com" date="1574164800">- Update bpftrace to v0.9.2
  + New environment variables (BPFTRACE_NO_USER_SYMBOLS,
    BPFTRACE_LOG_SIZE)
  + New probe type: memory watchpoint
  + Support for JSON output
- Exclude armv7 and i586 since bcc doesn't support USDT for these
  two architectures</changelog>
  <changelog author="aloisio@gmx.com" date="1574337600">- Update to version 0.9.3
  * Allow attaching to uprobes at an offset
  * BTF support
  * integer casts
  * integer pointer casts</changelog>
  <changelog author="asarai@suse.com" date="1580472000">- Fix builds on Leap 15.1. This requires quite a bit of trickery related to
  binutils (see boo#1162312), but it's nothing too hard.
- Added patch to workaround boo#1162312.
  + boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch</changelog>
  <changelog author="asarai@suse.com" date="1580904000">- Update to bpftrace 0.9.4.
  * New calls: signal, override, strncmp.
  * Support for attaching to `kprobes` at an offset.
  * Support for struct bitfields.
  See the upstream changelog for more details:
    &lt;https://github.com/iovisor/bpftrace/releases/tag/v0.9.4&gt;</changelog>
  <changelog author="idonmez@suse.com" date="1586865600">- Update to version 0.10.0
  * Support for LLVM 9 and LLVM 10 has been added.
  * See the complete changelog at https://github.com/iovisor/bpftrace/releases/tag/v0.10.0
- Drop upstreamed patches:
  - boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch
  - install-man-dir.patch</changelog>
  <changelog author="asarai@suse.com" date="1594814400">- Update to bpftrace 0.11.0.</changelog>
  <changelog author="asarai@suse.com" date="1604145600">- Update to bpftrace 0.11.2.
  * Support for LLVM 11.</changelog>
  <changelog author="mrueckert@suse.de" date="1604923200">- added detect-7-arg-bpf_attach_uprobe.patch:
  fix build with new bpf_attach_uprobe in TW</changelog>
  <changelog author="asarai@suse.com" date="1605355200">- Update to bpftrace 0.11.4.
  * Alpine build bug fix release
  * bcc 0.17 support release
- Remove upstreamed patches:
  - detect-7-arg-bpf_attach_uprobe.patch</changelog>
  <changelog author="asarai@suse.com" date="1606132800">- Do not strip bpftrace binaries -- bpftrace depends on debuginfos for
  /proc/self/exe in order to implement the BEGIN trigger. bsc#1178928</changelog>
  <changelog author="glin@suse.com" date="1610107200">- Add bpftrace-bsc1180670-sync-man-page-and-help.patch to sync
  man page and help (bsc1180670)</changelog>
</package>
<package pkgid="14afe9b7fcb5c484bd749cf26d1e31a88cae3ca346d972e68110ab0d99372b0a" name="bpftrace-tools" arch="noarch">
  <version epoch="0" ver="0.11.4" rel="3.2.1"/>
  <changelog author="asarai@suse.com" date="1540900800">- Initial bpftrace 0.0.0 import. Upstream doesn't really have versioning, so
  now we just use _service and pull from master. BCC required a bit of
  vendoring work, though hopefully we can switch to using bcc-tool-devel.
  boo#1117223</changelog>
  <changelog author="asarai@suse.com" date="1543147200">- Switch to using bcc-devel from Base:System. This required a few backports
  from upstream and some other various changes. boo#1117223
  https://github.com/iovisor/bpftrace/pull/227
  * 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1547553600">- Update bpftrace import to 0.0.0 (again).
- Remove patch for bcc-devel now that there is an upstream fix for it
  (https://github.com/iovisor/bpftrace/pull/327). boo#1117223
  - 0001-cmake-fix-builds-within-OBS.patch</changelog>
  <changelog author="asarai@suse.com" date="1556107200">- Update bpftrace to v0.9.
- Deprecated: sym() and stack() are deprecated.
    Use ksym() and kstack() instead.</changelog>
  <changelog author="asarai@suse.com" date="1561550400">- Update bpftrace to v0.9.1. Upstream changelog:
  * Additions:
    + Introduce compound assignment operators (+= and friends).
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Add basic support to enums (treat them as constants).
    + Add macro definition support.
    + Add support for arrays and IPv6 for the ntop builtin function.
    + Allow comparison of two string variables.
    + Add pre and post behavior to ++ and -- operators.
  * Breaking changes:
  - Ban kprobes that cause CPU deadlocks.
    + Add unsafe-mode and make default execution mode safe-mode.</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1563019200">- Use %cmake for building, don't set flags manually.
- Use %cmake_install instead of installing manually.
- install-man-dir.patch: Fix installation directory for man pages.
- Fix executable bit for tools.
- Fix shebangs in %prep, use -exec instead of piping to xargs.
- Disable LTO, because -flto=&lt;number&gt; isn't supported by Clang.
  Also LTO is perhaps not so important here.</changelog>
  <changelog author="aojeagarcia@suse.com" date="1566302400">- Add readline missing dependency</changelog>
  <changelog author="mpluskal@suse.com" date="1566302401">- Cleanup using spec-cleaner</changelog>
  <changelog author="glin@suse.com" date="1574164800">- Update bpftrace to v0.9.2
  + New environment variables (BPFTRACE_NO_USER_SYMBOLS,
    BPFTRACE_LOG_SIZE)
  + New probe type: memory watchpoint
  + Support for JSON output
- Exclude armv7 and i586 since bcc doesn't support USDT for these
  two architectures</changelog>
  <changelog author="aloisio@gmx.com" date="1574337600">- Update to version 0.9.3
  * Allow attaching to uprobes at an offset
  * BTF support
  * integer casts
  * integer pointer casts</changelog>
  <changelog author="asarai@suse.com" date="1580472000">- Fix builds on Leap 15.1. This requires quite a bit of trickery related to
  binutils (see boo#1162312), but it's nothing too hard.
- Added patch to workaround boo#1162312.
  + boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch</changelog>
  <changelog author="asarai@suse.com" date="1580904000">- Update to bpftrace 0.9.4.
  * New calls: signal, override, strncmp.
  * Support for attaching to `kprobes` at an offset.
  * Support for struct bitfields.
  See the upstream changelog for more details:
    &lt;https://github.com/iovisor/bpftrace/releases/tag/v0.9.4&gt;</changelog>
  <changelog author="idonmez@suse.com" date="1586865600">- Update to version 0.10.0
  * Support for LLVM 9 and LLVM 10 has been added.
  * See the complete changelog at https://github.com/iovisor/bpftrace/releases/tag/v0.10.0
- Drop upstreamed patches:
  - boo1162312-cmake-use-_LIBRARIES-when-testing-for-libbfd-version.patch
  - install-man-dir.patch</changelog>
  <changelog author="asarai@suse.com" date="1594814400">- Update to bpftrace 0.11.0.</changelog>
  <changelog author="asarai@suse.com" date="1604145600">- Update to bpftrace 0.11.2.
  * Support for LLVM 11.</changelog>
  <changelog author="mrueckert@suse.de" date="1604923200">- added detect-7-arg-bpf_attach_uprobe.patch:
  fix build with new bpf_attach_uprobe in TW</changelog>
  <changelog author="asarai@suse.com" date="1605355200">- Update to bpftrace 0.11.4.
  * Alpine build bug fix release
  * bcc 0.17 support release
- Remove upstreamed patches:
  - detect-7-arg-bpf_attach_uprobe.patch</changelog>
  <changelog author="asarai@suse.com" date="1606132800">- Do not strip bpftrace binaries -- bpftrace depends on debuginfos for
  /proc/self/exe in order to implement the BEGIN trigger. bsc#1178928</changelog>
  <changelog author="glin@suse.com" date="1610107200">- Add bpftrace-bsc1180670-sync-man-page-and-help.patch to sync
  man page and help (bsc1180670)</changelog>
</package>
<package pkgid="b3f8b48eab3c626289db4307046fd7fb580a76c8ab05dcc50216038ad6571b99" name="brp-check-suse" arch="aarch64">
  <version epoch="0" ver="84.87+git20181106.224b37d" rel="3.18.2"/>
  <changelog author="dmueller@suse.com" date="1413806400">- Update to version 13.2+git20140829.9539e1d:
  + xdg_menu: use File::Find instead of calling out to find
  + brp-25-symlink: fix missing alternatives
  + brp-25-symlink: fix eating /./ in path
  + brp-25-symlink: massive rewrite to reduce number of calls
  + brp-40-rootfs: reduce number of calls
  + brp-60-hook: add some double quotes
  + brp-50-check-python: add some double quotes, remove commented code
  + Adwaita is a defined icon theme mandatory installed as dependency to GTK3.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1424174400">- Update to version 13.2+git20150217.031533d:
  + - Update applications.menu from desktop-data to accept new
    Categories (bnc#443364), remove PuzzleGame (now LogicGame)
    (thanks sbrabec)</changelog>
  <changelog author="ro@suse.de" date="1428667200">- do not fail over new DefaultLayout element (from adrian)
- brp-25-symlink: handle properly symlinks to root directory
  (fix bnc#781101) (from sleep_walker)</changelog>
  <changelog author="ro@suse.de" date="1452686400">- update tarball to actually include last fixes, new version
  is 13.2+git20150521.971ea2f (bnc#781101)
- change neededforbuild to BuildRequires in output text in
  brp-25-symlink
- do not fail over new DefaultLayout element
- brp-25-symlink: handle properly symlinks to root directory</changelog>
  <changelog author="lnussel@suse.de" date="1473163200">- Update to version 84.87+git20160906.bb0a7d0:
  * brp-25-symlink: handle properly symlinks to root directory
  * - do not fail over new DefaultLayout element
  * neededforbuild -&gt; BuildRequires
  * properly create tarball
  * Hint to the desktop category rules. (#6)</changelog>
  <changelog author="dimstar@opensuse.org" date="1496404800">- Update to version 84.87+git20170602.cec5415:
  * Add missing newline to Category error message
  * brp-25-symlink: do not relink /etc/os-release</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1536408000">- Update to version 84.87+git20180809.3335364:
  * Handle whitespace in symlinks correctly
- Use %license
- Keep brp-65-lib64-linux also on aarch64</changelog>
  <changelog author="ro@suse.de" date="1541505600">- Update to version 84.87+git20181106.224b37d:
  * brp-15-strip-debug: deal with libs where file outputs
    more text after "not stripped" (bsc#1114695)</changelog>
  <changelog author="lnussel@suse.de" date="1602504000">- Remove desktop file category check. The check was dropped in
  Factory a while ago already which makes backports of packages
  harder (boo#1074711).</changelog>
  <changelog author="ro@suse.de" date="1618833600">- add patch to implement fipscheck (bsc#1184555)
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch</changelog>
  <changelog author="ro@suse.de" date="1618920000">- revisited bsc#1184555 help generating FIPS hmac files
- drop previous patch
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch
- add brp-50-generate-fips-hmac</changelog>
  <changelog author="ro@suse.de" date="1619784000">- make sure all brp-scripts are actually executable
  (still bsc#1184555)</changelog>
  <changelog author="ro@suse.de" date="1620993600">- add patches to support reproducible builds (bsc#1186049)
  - brp-25-symlink-sort-input.patch
  - normalize input by sorting the list of found symlinks
  - brp-25-symlink-print-all-errors.patch
  - print all errors before exiting
  - brp-75-ar-initial-version.patch
  - sort the content of ar archives using objcopy
  - brp-75-ar-allow-override.patch
  - allow overriding the ar sorting by using NO_BRP_AR</changelog>
</package>
<package pkgid="8d9da5fe90a9a25ff976c837d5d1d55d25f790947d327ab3672c80636169321d" name="brp-check-suse" arch="ppc64le">
  <version epoch="0" ver="84.87+git20181106.224b37d" rel="3.18.2"/>
  <changelog author="dmueller@suse.com" date="1413806400">- Update to version 13.2+git20140829.9539e1d:
  + xdg_menu: use File::Find instead of calling out to find
  + brp-25-symlink: fix missing alternatives
  + brp-25-symlink: fix eating /./ in path
  + brp-25-symlink: massive rewrite to reduce number of calls
  + brp-40-rootfs: reduce number of calls
  + brp-60-hook: add some double quotes
  + brp-50-check-python: add some double quotes, remove commented code
  + Adwaita is a defined icon theme mandatory installed as dependency to GTK3.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1424174400">- Update to version 13.2+git20150217.031533d:
  + - Update applications.menu from desktop-data to accept new
    Categories (bnc#443364), remove PuzzleGame (now LogicGame)
    (thanks sbrabec)</changelog>
  <changelog author="ro@suse.de" date="1428667200">- do not fail over new DefaultLayout element (from adrian)
- brp-25-symlink: handle properly symlinks to root directory
  (fix bnc#781101) (from sleep_walker)</changelog>
  <changelog author="ro@suse.de" date="1452686400">- update tarball to actually include last fixes, new version
  is 13.2+git20150521.971ea2f (bnc#781101)
- change neededforbuild to BuildRequires in output text in
  brp-25-symlink
- do not fail over new DefaultLayout element
- brp-25-symlink: handle properly symlinks to root directory</changelog>
  <changelog author="lnussel@suse.de" date="1473163200">- Update to version 84.87+git20160906.bb0a7d0:
  * brp-25-symlink: handle properly symlinks to root directory
  * - do not fail over new DefaultLayout element
  * neededforbuild -&gt; BuildRequires
  * properly create tarball
  * Hint to the desktop category rules. (#6)</changelog>
  <changelog author="dimstar@opensuse.org" date="1496404800">- Update to version 84.87+git20170602.cec5415:
  * Add missing newline to Category error message
  * brp-25-symlink: do not relink /etc/os-release</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1536408000">- Update to version 84.87+git20180809.3335364:
  * Handle whitespace in symlinks correctly
- Use %license
- Keep brp-65-lib64-linux also on aarch64</changelog>
  <changelog author="ro@suse.de" date="1541505600">- Update to version 84.87+git20181106.224b37d:
  * brp-15-strip-debug: deal with libs where file outputs
    more text after "not stripped" (bsc#1114695)</changelog>
  <changelog author="lnussel@suse.de" date="1602504000">- Remove desktop file category check. The check was dropped in
  Factory a while ago already which makes backports of packages
  harder (boo#1074711).</changelog>
  <changelog author="ro@suse.de" date="1618833600">- add patch to implement fipscheck (bsc#1184555)
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch</changelog>
  <changelog author="ro@suse.de" date="1618920000">- revisited bsc#1184555 help generating FIPS hmac files
- drop previous patch
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch
- add brp-50-generate-fips-hmac</changelog>
  <changelog author="ro@suse.de" date="1619784000">- make sure all brp-scripts are actually executable
  (still bsc#1184555)</changelog>
  <changelog author="ro@suse.de" date="1620993600">- add patches to support reproducible builds (bsc#1186049)
  - brp-25-symlink-sort-input.patch
  - normalize input by sorting the list of found symlinks
  - brp-25-symlink-print-all-errors.patch
  - print all errors before exiting
  - brp-75-ar-initial-version.patch
  - sort the content of ar archives using objcopy
  - brp-75-ar-allow-override.patch
  - allow overriding the ar sorting by using NO_BRP_AR</changelog>
</package>
<package pkgid="6dd8454d6287943950a680e3757e8564f2e11da55d0f6cb30c6c1e434a3b1a89" name="brp-check-suse" arch="s390x">
  <version epoch="0" ver="84.87+git20181106.224b37d" rel="3.18.2"/>
  <changelog author="dmueller@suse.com" date="1413806400">- Update to version 13.2+git20140829.9539e1d:
  + xdg_menu: use File::Find instead of calling out to find
  + brp-25-symlink: fix missing alternatives
  + brp-25-symlink: fix eating /./ in path
  + brp-25-symlink: massive rewrite to reduce number of calls
  + brp-40-rootfs: reduce number of calls
  + brp-60-hook: add some double quotes
  + brp-50-check-python: add some double quotes, remove commented code
  + Adwaita is a defined icon theme mandatory installed as dependency to GTK3.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1424174400">- Update to version 13.2+git20150217.031533d:
  + - Update applications.menu from desktop-data to accept new
    Categories (bnc#443364), remove PuzzleGame (now LogicGame)
    (thanks sbrabec)</changelog>
  <changelog author="ro@suse.de" date="1428667200">- do not fail over new DefaultLayout element (from adrian)
- brp-25-symlink: handle properly symlinks to root directory
  (fix bnc#781101) (from sleep_walker)</changelog>
  <changelog author="ro@suse.de" date="1452686400">- update tarball to actually include last fixes, new version
  is 13.2+git20150521.971ea2f (bnc#781101)
- change neededforbuild to BuildRequires in output text in
  brp-25-symlink
- do not fail over new DefaultLayout element
- brp-25-symlink: handle properly symlinks to root directory</changelog>
  <changelog author="lnussel@suse.de" date="1473163200">- Update to version 84.87+git20160906.bb0a7d0:
  * brp-25-symlink: handle properly symlinks to root directory
  * - do not fail over new DefaultLayout element
  * neededforbuild -&gt; BuildRequires
  * properly create tarball
  * Hint to the desktop category rules. (#6)</changelog>
  <changelog author="dimstar@opensuse.org" date="1496404800">- Update to version 84.87+git20170602.cec5415:
  * Add missing newline to Category error message
  * brp-25-symlink: do not relink /etc/os-release</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1536408000">- Update to version 84.87+git20180809.3335364:
  * Handle whitespace in symlinks correctly
- Use %license
- Keep brp-65-lib64-linux also on aarch64</changelog>
  <changelog author="ro@suse.de" date="1541505600">- Update to version 84.87+git20181106.224b37d:
  * brp-15-strip-debug: deal with libs where file outputs
    more text after "not stripped" (bsc#1114695)</changelog>
  <changelog author="lnussel@suse.de" date="1602504000">- Remove desktop file category check. The check was dropped in
  Factory a while ago already which makes backports of packages
  harder (boo#1074711).</changelog>
  <changelog author="ro@suse.de" date="1618833600">- add patch to implement fipscheck (bsc#1184555)
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch</changelog>
  <changelog author="ro@suse.de" date="1618920000">- revisited bsc#1184555 help generating FIPS hmac files
- drop previous patch
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch
- add brp-50-generate-fips-hmac</changelog>
  <changelog author="ro@suse.de" date="1619784000">- make sure all brp-scripts are actually executable
  (still bsc#1184555)</changelog>
  <changelog author="ro@suse.de" date="1620993600">- add patches to support reproducible builds (bsc#1186049)
  - brp-25-symlink-sort-input.patch
  - normalize input by sorting the list of found symlinks
  - brp-25-symlink-print-all-errors.patch
  - print all errors before exiting
  - brp-75-ar-initial-version.patch
  - sort the content of ar archives using objcopy
  - brp-75-ar-allow-override.patch
  - allow overriding the ar sorting by using NO_BRP_AR</changelog>
</package>
<package pkgid="c8fb8f1354c3ca3c33949bc577c72e7412a4a8d046b7ea10ce4d0e154709d048" name="brp-check-suse" arch="src">
  <version epoch="0" ver="84.87+git20181106.224b37d" rel="3.18.2"/>
  <changelog author="ro@suse.de" date="1404302400">- do not ignore errors just because package has no init script
- allow .local scripts for aaa_base so we can ghost them there
- remove outdated echo line</changelog>
  <changelog author="sleep_walker@suse.cz" date="1406203200">- remove brp-20-check-la, it is broken and la files are mostly
  deleted anyway
- reduction of number of calls used by using more bashism, passing
  more regexp at once, use more double quotes
  brp-15-strip-debug
  brp-45-tcl
  brp-50-check-python
  brp-60-hook</changelog>
  <changelog author="sleep_walker@suse.cz" date="1406203201">- All GTK apps are allowed to assume the presence of the
  Adwaita-icon-theme package; As a result of this, we now accept icons
  in icons/Adwaita on the whitelist (just as hicolor).
  patch by DimStar</changelog>
  <changelog author="sleep_walker@suse.cz" date="1406289600">- massive rewrite of brp-25-symlink to reduce number of calls our
  tests shown speedup from 8,5 mins to 1 min for kernel-default
  (year ago)</changelog>
  <changelog author="sleep_walker@suse.cz" date="1406376000">- brp-25-symlink: fix eating /./ in path</changelog>
  <changelog author="sleep_walker@suse.cz" date="1406462400">- brp-25-symlink: add mising '/etc/alternatives' back to whitelist</changelog>
  <changelog author="sleep_walker@suse.cz" date="1406721600">- correct URL to github repo</changelog>
  <changelog author="dmueller@suse.com" date="1413806400">- Update to version 13.2+git20140829.9539e1d:
  + xdg_menu: use File::Find instead of calling out to find
  + brp-25-symlink: fix missing alternatives
  + brp-25-symlink: fix eating /./ in path
  + brp-25-symlink: massive rewrite to reduce number of calls
  + brp-40-rootfs: reduce number of calls
  + brp-60-hook: add some double quotes
  + brp-50-check-python: add some double quotes, remove commented code
  + Adwaita is a defined icon theme mandatory installed as dependency to GTK3.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1424174400">- Update to version 13.2+git20150217.031533d:
  + - Update applications.menu from desktop-data to accept new
    Categories (bnc#443364), remove PuzzleGame (now LogicGame)
    (thanks sbrabec)</changelog>
  <changelog author="ro@suse.de" date="1428667200">- do not fail over new DefaultLayout element (from adrian)
- brp-25-symlink: handle properly symlinks to root directory
  (fix bnc#781101) (from sleep_walker)</changelog>
  <changelog author="ro@suse.de" date="1452686400">- update tarball to actually include last fixes, new version
  is 13.2+git20150521.971ea2f (bnc#781101)
- change neededforbuild to BuildRequires in output text in
  brp-25-symlink
- do not fail over new DefaultLayout element
- brp-25-symlink: handle properly symlinks to root directory</changelog>
  <changelog author="lnussel@suse.de" date="1473163200">- Update to version 84.87+git20160906.bb0a7d0:
  * brp-25-symlink: handle properly symlinks to root directory
  * - do not fail over new DefaultLayout element
  * neededforbuild -&gt; BuildRequires
  * properly create tarball
  * Hint to the desktop category rules. (#6)</changelog>
  <changelog author="dimstar@opensuse.org" date="1496404800">- Update to version 84.87+git20170602.cec5415:
  * Add missing newline to Category error message
  * brp-25-symlink: do not relink /etc/os-release</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1536408000">- Update to version 84.87+git20180809.3335364:
  * Handle whitespace in symlinks correctly
- Use %license
- Keep brp-65-lib64-linux also on aarch64</changelog>
  <changelog author="ro@suse.de" date="1541505600">- Update to version 84.87+git20181106.224b37d:
  * brp-15-strip-debug: deal with libs where file outputs
    more text after "not stripped" (bsc#1114695)</changelog>
  <changelog author="lnussel@suse.de" date="1602504000">- Remove desktop file category check. The check was dropped in
  Factory a while ago already which makes backports of packages
  harder (boo#1074711).</changelog>
  <changelog author="ro@suse.de" date="1618833600">- add patch to implement fipscheck (bsc#1184555)
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch</changelog>
  <changelog author="ro@suse.de" date="1618920000">- revisited bsc#1184555 help generating FIPS hmac files
- drop previous patch
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch
- add brp-50-generate-fips-hmac</changelog>
  <changelog author="ro@suse.de" date="1619784000">- make sure all brp-scripts are actually executable
  (still bsc#1184555)</changelog>
  <changelog author="ro@suse.de" date="1620993600">- add patches to support reproducible builds (bsc#1186049)
  - brp-25-symlink-sort-input.patch
  - normalize input by sorting the list of found symlinks
  - brp-25-symlink-print-all-errors.patch
  - print all errors before exiting
  - brp-75-ar-initial-version.patch
  - sort the content of ar archives using objcopy
  - brp-75-ar-allow-override.patch
  - allow overriding the ar sorting by using NO_BRP_AR</changelog>
</package>
<package pkgid="ceaa02be1139c488ecedbaf2748c12b84798b7e8e1f3f512dedeffcae2f3227e" name="brp-check-suse" arch="x86_64">
  <version epoch="0" ver="84.87+git20181106.224b37d" rel="3.18.2"/>
  <changelog author="dmueller@suse.com" date="1413806400">- Update to version 13.2+git20140829.9539e1d:
  + xdg_menu: use File::Find instead of calling out to find
  + brp-25-symlink: fix missing alternatives
  + brp-25-symlink: fix eating /./ in path
  + brp-25-symlink: massive rewrite to reduce number of calls
  + brp-40-rootfs: reduce number of calls
  + brp-60-hook: add some double quotes
  + brp-50-check-python: add some double quotes, remove commented code
  + Adwaita is a defined icon theme mandatory installed as dependency to GTK3.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1424174400">- Update to version 13.2+git20150217.031533d:
  + - Update applications.menu from desktop-data to accept new
    Categories (bnc#443364), remove PuzzleGame (now LogicGame)
    (thanks sbrabec)</changelog>
  <changelog author="ro@suse.de" date="1428667200">- do not fail over new DefaultLayout element (from adrian)
- brp-25-symlink: handle properly symlinks to root directory
  (fix bnc#781101) (from sleep_walker)</changelog>
  <changelog author="ro@suse.de" date="1452686400">- update tarball to actually include last fixes, new version
  is 13.2+git20150521.971ea2f (bnc#781101)
- change neededforbuild to BuildRequires in output text in
  brp-25-symlink
- do not fail over new DefaultLayout element
- brp-25-symlink: handle properly symlinks to root directory</changelog>
  <changelog author="lnussel@suse.de" date="1473163200">- Update to version 84.87+git20160906.bb0a7d0:
  * brp-25-symlink: handle properly symlinks to root directory
  * - do not fail over new DefaultLayout element
  * neededforbuild -&gt; BuildRequires
  * properly create tarball
  * Hint to the desktop category rules. (#6)</changelog>
  <changelog author="dimstar@opensuse.org" date="1496404800">- Update to version 84.87+git20170602.cec5415:
  * Add missing newline to Category error message
  * brp-25-symlink: do not relink /etc/os-release</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1536408000">- Update to version 84.87+git20180809.3335364:
  * Handle whitespace in symlinks correctly
- Use %license
- Keep brp-65-lib64-linux also on aarch64</changelog>
  <changelog author="ro@suse.de" date="1541505600">- Update to version 84.87+git20181106.224b37d:
  * brp-15-strip-debug: deal with libs where file outputs
    more text after "not stripped" (bsc#1114695)</changelog>
  <changelog author="lnussel@suse.de" date="1602504000">- Remove desktop file category check. The check was dropped in
  Factory a while ago already which makes backports of packages
  harder (boo#1074711).</changelog>
  <changelog author="ro@suse.de" date="1618833600">- add patch to implement fipscheck (bsc#1184555)
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch</changelog>
  <changelog author="ro@suse.de" date="1618920000">- revisited bsc#1184555 help generating FIPS hmac files
- drop previous patch
  brp-check-suse-bf6495be895f87b65ac358d22e0ae945b0aa3462.patch
- add brp-50-generate-fips-hmac</changelog>
  <changelog author="ro@suse.de" date="1619784000">- make sure all brp-scripts are actually executable
  (still bsc#1184555)</changelog>
  <changelog author="ro@suse.de" date="1620993600">- add patches to support reproducible builds (bsc#1186049)
  - brp-25-symlink-sort-input.patch
  - normalize input by sorting the list of found symlinks
  - brp-25-symlink-print-all-errors.patch
  - print all errors before exiting
  - brp-75-ar-initial-version.patch
  - sort the content of ar archives using objcopy
  - brp-75-ar-allow-override.patch
  - allow overriding the ar sorting by using NO_BRP_AR</changelog>
</package>
<package pkgid="5784788a9c576407de0e2702073e9d2426c268794ac1f4669483837170f807b5" name="btrfsmaintenance" arch="noarch">
  <version epoch="0" ver="0.4.2" rel="3.3.1"/>
  <changelog author="dsterba@suse.cz" date="1457006400">- version 0.2
  - updated documentation
  - support debian-like configuration paths
  - no hardcoded paths to external utilities
  - fixed logger name typos for 'journal' target
  - defrag fixes (sysconfig, find arguments)</changelog>
  <changelog author="dsterba@suse.cz" date="1479124800">- version 0.3
  - add syslog to logging targets
  - add none target (/dev/null)
  - autodetect btrfs filesystems for balance, scrub and trim
  - detect mixed blockgroups and use correct balance filters
  - fix uninstall rules
  - fix capturing entire output to the log
  - fix when cron files are symlinks
  - add generic installation script
  - doc updates: retention policy tuning</changelog>
  <changelog author="dsterba@suse.cz" date="1491480000">- version 0.3.1
  - dist-install: fix installation paths, install functions
  - functions: fix syntax to be compatible with dash
  - spec: install functions file</changelog>
  <changelog author="lnussel@suse.de" date="1499256000">- Require btrfsprogs (bsc#1047226)</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1510056000">- Add btrfsmaintenance-0.3.1-fix-rpm-db-path.patch:
  * Change RPM database path to /usr/lib/sysimage/rpm for
    Tumbleweed.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1510315200">- Fix cron symlinks removal upon package upgrade (boo#904518):
  * The problem was in the preun section (in the old RPM).
  * This means the symlinks are removed by this update, but won't
    be by the next ones.
  * Please run 'systemctl start btrfsmaintenance-refresh' one more
    time to fix your symlinks.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.com" date="1512475200">- Add patch to use systemd timer instead of cron (pull-request-36.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1512561600">- Don't call btrfsmaintenance-refresh-cron.sh in %post, this is
  done already by the systemd macros</changelog>
  <changelog author="kukuk@suse.de" date="1512561601">- pull-request-36.patch: update patch</changelog>
  <changelog author="kukuk@suse.de" date="1513512000">- Switch default of btrfsmaintenance-refresh.service to systemd-timer,
  too (btrfsmaintenance-switch-to-timer.patch) [bsc#1073204]</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1513944000">- Fix systemd timers enabled even if period is set to none:
  * Micro change in pull-request-36.patch (bsc#1075884)
- Clean spec file:
  * Removed support for suse_version &lt;= 1210.
  * Removed call to btrfsmaintenance-refresh-cron.sh upon deletion
    (not needed anymore since we use systemd timers which are
    handled by macros).
  * Ran spec-cleaner.</changelog>
  <changelog author="dsterba@suse.cz" date="1515931200">- update to version 0.4
  - add support for systemd timers and use them by default; the alternative
    cron scripts are still present (#29, #36)
  - add automatic monitoring (via systemd.path) of the config file,
    no manual updates by btrfsmaintenance-refresh.service needed (#38)
  - fix RPM database path detection
  - spec file cleanups
  - documentation updates
- removed patches:
  - btrfsmaintenance-0.3.1-fix-rpm-db-path.patch (upstream)
  - btrfsmaintenance-switch-to-timer.patch (upstream)
  - pull-request-36.patch (upstream)</changelog>
  <changelog author="lpechacek@suse.com" date="1517832000">- Move the defrag plugin over to Python 3. (bsc#1070322)
- Added patch: python3-support-bsc1070322.diff</changelog>
  <changelog author="kukuk@suse.de" date="1520856000">- Add missing btrfsmaintenance-refresh.path [bsc#1084871]
- Use %license [bsc#1082318]</changelog>
  <changelog author="dsterba@suse.cz" date="1521028800">- update to version 0.4.1
  - defrag plugin: python2 and 3 compatibility
  - defrag plugin: target extent size lowered to 32MiB (#43)
  - shell compatibility fixes
  - systemd unit type fixes
- Removed patch: python3-support-bsc1070322.diff (upstream)</changelog>
  <changelog author="lpechacek@suse.com" date="1523620800">- In openSUSE the defrag plugin must explicitly refer to Python 3.
  (bsc#1070322)
- Added patch: python3-support-bsc1070322.diff</changelog>
  <changelog author="dsterba@suse.cz" date="1537790400">- update to version 0.4.2
  - CVE-2018-14722: expand auto mountpoints in a safe way
  - btrfs-defrag: fix missing function to detect btrfs filesystems (#52)
  - btrfs-trim: more verbose fstrim output (#60)
  - dist-install: print information about timer unit installation (#58)</changelog>
  <changelog author="jeffm@suse.com" date="1552392000">- Document and adjust balance thresholds and periods (FATE#325529 jsc#SLE-3188).
  * README: document impact of balance + quota groups
  * sysconfig: reduce default balance usage thresholds
  * sysconfig: document using systemd.time(7) for frequency of operations
  * btrfsmaintenance-refresh-cron.sh: validate periods for cron-based systems
- Remove python dependency (FATE#326736 jsc#SLE-4130).
  * btrfs-defrag-plugin: remove dependency on zypp-plugin-python
- Added patches:
  * 0001-README-document-impact-of-balance-quota-groups.patch
  * 0002-sysconfig-reduce-default-balance-usage-thresholds-fa.patch
  * 0003-sysconfig-document-using-systemd.time-7-for-frequenc.patch
  * 0004-btrfsmaintenance-refresh-cron.sh-validate-periods-fo.patch
  * 0005-btrfs-defrag-plugin-remove-dependency-on-zypp-plugin.patch
- Added source:
  * btrfs-defrag-plugin.sh
- Removed patch:
  * python3-support-bsc1070322.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1605873600">- btrfsmaintenance.service-delete-install-section.patch: Remove [Install]
  section (bsc#1178874)</changelog>
</package>
<package pkgid="9b83f0f73b779e8c4cc2c5019b35e9457bd6259d70cf9364626bb710966e1856" name="btrfsmaintenance" arch="src">
  <version epoch="0" ver="0.4.2" rel="3.3.1"/>
  <changelog author="dsterba@suse.cz" date="1457006400">- version 0.2
  - updated documentation
  - support debian-like configuration paths
  - no hardcoded paths to external utilities
  - fixed logger name typos for 'journal' target
  - defrag fixes (sysconfig, find arguments)</changelog>
  <changelog author="dsterba@suse.cz" date="1479124800">- version 0.3
  - add syslog to logging targets
  - add none target (/dev/null)
  - autodetect btrfs filesystems for balance, scrub and trim
  - detect mixed blockgroups and use correct balance filters
  - fix uninstall rules
  - fix capturing entire output to the log
  - fix when cron files are symlinks
  - add generic installation script
  - doc updates: retention policy tuning</changelog>
  <changelog author="dsterba@suse.cz" date="1491480000">- version 0.3.1
  - dist-install: fix installation paths, install functions
  - functions: fix syntax to be compatible with dash
  - spec: install functions file</changelog>
  <changelog author="lnussel@suse.de" date="1499256000">- Require btrfsprogs (bsc#1047226)</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1510056000">- Add btrfsmaintenance-0.3.1-fix-rpm-db-path.patch:
  * Change RPM database path to /usr/lib/sysimage/rpm for
    Tumbleweed.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1510315200">- Fix cron symlinks removal upon package upgrade (boo#904518):
  * The problem was in the preun section (in the old RPM).
  * This means the symlinks are removed by this update, but won't
    be by the next ones.
  * Please run 'systemctl start btrfsmaintenance-refresh' one more
    time to fix your symlinks.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kukuk@suse.com" date="1512475200">- Add patch to use systemd timer instead of cron (pull-request-36.patch)</changelog>
  <changelog author="kukuk@suse.de" date="1512561600">- Don't call btrfsmaintenance-refresh-cron.sh in %post, this is
  done already by the systemd macros</changelog>
  <changelog author="kukuk@suse.de" date="1512561601">- pull-request-36.patch: update patch</changelog>
  <changelog author="kukuk@suse.de" date="1513512000">- Switch default of btrfsmaintenance-refresh.service to systemd-timer,
  too (btrfsmaintenance-switch-to-timer.patch) [bsc#1073204]</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1513944000">- Fix systemd timers enabled even if period is set to none:
  * Micro change in pull-request-36.patch (bsc#1075884)
- Clean spec file:
  * Removed support for suse_version &lt;= 1210.
  * Removed call to btrfsmaintenance-refresh-cron.sh upon deletion
    (not needed anymore since we use systemd timers which are
    handled by macros).
  * Ran spec-cleaner.</changelog>
  <changelog author="dsterba@suse.cz" date="1515931200">- update to version 0.4
  - add support for systemd timers and use them by default; the alternative
    cron scripts are still present (#29, #36)
  - add automatic monitoring (via systemd.path) of the config file,
    no manual updates by btrfsmaintenance-refresh.service needed (#38)
  - fix RPM database path detection
  - spec file cleanups
  - documentation updates
- removed patches:
  - btrfsmaintenance-0.3.1-fix-rpm-db-path.patch (upstream)
  - btrfsmaintenance-switch-to-timer.patch (upstream)
  - pull-request-36.patch (upstream)</changelog>
  <changelog author="lpechacek@suse.com" date="1517832000">- Move the defrag plugin over to Python 3. (bsc#1070322)
- Added patch: python3-support-bsc1070322.diff</changelog>
  <changelog author="kukuk@suse.de" date="1520856000">- Add missing btrfsmaintenance-refresh.path [bsc#1084871]
- Use %license [bsc#1082318]</changelog>
  <changelog author="dsterba@suse.cz" date="1521028800">- update to version 0.4.1
  - defrag plugin: python2 and 3 compatibility
  - defrag plugin: target extent size lowered to 32MiB (#43)
  - shell compatibility fixes
  - systemd unit type fixes
- Removed patch: python3-support-bsc1070322.diff (upstream)</changelog>
  <changelog author="lpechacek@suse.com" date="1523620800">- In openSUSE the defrag plugin must explicitly refer to Python 3.
  (bsc#1070322)
- Added patch: python3-support-bsc1070322.diff</changelog>
  <changelog author="dsterba@suse.cz" date="1537790400">- update to version 0.4.2
  - CVE-2018-14722: expand auto mountpoints in a safe way
  - btrfs-defrag: fix missing function to detect btrfs filesystems (#52)
  - btrfs-trim: more verbose fstrim output (#60)
  - dist-install: print information about timer unit installation (#58)</changelog>
  <changelog author="jeffm@suse.com" date="1552392000">- Document and adjust balance thresholds and periods (FATE#325529 jsc#SLE-3188).
  * README: document impact of balance + quota groups
  * sysconfig: reduce default balance usage thresholds
  * sysconfig: document using systemd.time(7) for frequency of operations
  * btrfsmaintenance-refresh-cron.sh: validate periods for cron-based systems
- Remove python dependency (FATE#326736 jsc#SLE-4130).
  * btrfs-defrag-plugin: remove dependency on zypp-plugin-python
- Added patches:
  * 0001-README-document-impact-of-balance-quota-groups.patch
  * 0002-sysconfig-reduce-default-balance-usage-thresholds-fa.patch
  * 0003-sysconfig-document-using-systemd.time-7-for-frequenc.patch
  * 0004-btrfsmaintenance-refresh-cron.sh-validate-periods-fo.patch
  * 0005-btrfs-defrag-plugin-remove-dependency-on-zypp-plugin.patch
- Added source:
  * btrfs-defrag-plugin.sh
- Removed patch:
  * python3-support-bsc1070322.diff</changelog>
  <changelog author="rgoldwyn@suse.com" date="1605873600">- btrfsmaintenance.service-delete-install-section.patch: Remove [Install]
  section (bsc#1178874)</changelog>
</package>
<package pkgid="54be2fd46ab31b7107e7aea07c3dc209bd3b7b15447aa03e2a23733d7eef5c4e" name="build" arch="noarch">
  <version epoch="0" ver="20210120" rel="6.1"/>
  <changelog author="adrian@suse.de" date="1562673600">- fail build on preinstall failure
- avoid dependency errors on Fedora 30
- fixes for simpleimage vm build support
- support zstd decompression with old rpms
- license tag fixes</changelog>
  <changelog author="adrian@suse.de" date="1569240000">- build-recipe-dsc: Move all build results, not just *.deb and *.changes
- Mount /sys in chroot build
- vc: Do not open the editor if content is set
- adding leap 15.2 and SLE 15 SP2 configs
- Fix some rpmlint warnings
- return exit status 9 in the genbuildreqs case
- Export SYSTEMD_OFFLINE=1 to avoid failures from systemctl</changelog>
  <changelog author="adrian@suse.de" date="1573732800">- Add Fedora module parser
- Rpmmd parser: set up a dummy ExternEnt handler
- Add support for modules and publish flags
- add zstd to recommends
- Support rpm's new expression expansion syntax</changelog>
  <changelog author="adrian@suse.de" date="1575547200">- qemu vm_type is running qemu system emulator now. Works for:
  * aarch64
  * armv7l
  * ppc64/ppc64le
  * s390/s390x
  * riscv64
  Note: this requires a kernel and initrd in build target via
    kernel-obs-build mechanic
- various --shell improvements
- new --shell-cmd to run commands in chroot/KVM/Qemu/... directly
- raising minimal required memory in qemu mode to 512MB to be able
  to run Linux kernel at least
- Normalize epoch 0 away when reading the module info
- Add systemd-nspawn backend (by Oleg Girko)</changelog>
  <changelog author="adrian@suse.de" date="1578398400">- allow to enter an existing buildroot w/o recipe
- generate milestone files also for pure online media
- fix ccache setup of non-dotted compiler versions</changelog>
  <changelog author="adrian@suse.de" date="1578657600">- Arch Linux zstd format support
- fix testbuild fail with latest rpm in SP2 and Leap 15.2
- do not retry automatically on disk full error</changelog>
  <changelog author="adrian@suse.de" date="1579694400">- fix createrepo existens check for appimager and docker builds
  in chroot
- support to use virt-make-fs for ext3 VM builds</changelog>
  <changelog author="adrian@suse.de" date="1579867200">- Fix crash when using preinstall dependency expansion in OBS
- build-vm-kvm: use /boot/kernel.obs.build and /boot/initrd.obs.build
  as fallback regardless of the platform to have a global fallback
  kernel to use for distros that do not use the "kernel-obs-build"
  package to provide the guests kernel and initrd as the system
  binaries are not reliable for use in a guest system
- use abuild user if $NOROOTFORBUILD is set.</changelog>
  <changelog author="adrian@suse.de" date="1579867201">- fix SLE 15 configurations
- Fix dist autodetection for sle15-sp2</changelog>
  <changelog author="adrian@suse.de" date="1580212800">- support OBS-Milestone comment for kiwi
- switch to preinstall expansion for factory</changelog>
  <changelog author="adrian@suse.de" date="1580299200">- 15.2 config: temporary revert gcrypt preinstall until distro has changed
- factory config: ignore libxtables for iproute2, not needed for ip tool
- Follow upstream rpm changes in regard to logical ops
- Fix macro expansion of lines containing newlines
- add missing header file to avoid compile warnings</changelog>
  <changelog author="adrian@suse.de" date="1580472000">- fix regression in &amp;&amp; operator handling of rpm spec file parser
- Correctly expand macros defined with %global</changelog>
  <changelog author="adrian@suse.de" date="1580904000">- 15.2 config: preinstall gcrypt deps again
- Recommends for Fedora based distros
- support obsgendiff funcationality
- various smaller code cleanups
- additional test cases for spec file parsing
- various fixes for cornercases during spec file parsing</changelog>
  <changelog author="adrian@suse.de" date="1581336000">- Spec parser: add support for %elif, %elifarch, %elifos
- Support rpm's %include statement (EXPERIMENTAL, known limitations)
- Do not do vminstall expansion in expanddeps unless --vm is used</changelog>
  <changelog author="adrian@suse.de" date="1584100800">- Leap 15.2 config update (libzstd1 for rpm)
- handle obscpio extraction error as fatal
- Return correct exit code from systemd-nspawn build
- Spec parser: do not parse included files from end to start
- running disk full check also outside of VM
- run disk full check only for chroot</changelog>
  <changelog author="coolo@suse.com" date="1589716800">- enable sysrq operations on boot
- Set kvm_serial_device to virtio-serial in the fixup
- Split console arg setting code into kvm_add_console_args
- Update for zVM to make container builds work.
- Write to /proc/sys/kernel/hostname if the hostname command is not available
- Use --cgroup-manager=cgroupfs when calling podman
- Also squash by default in podman builds
- Support different interpreters in prein/postin scriptlets
- Use grep -E instead of egrep to check for the needsbinariesforbuild flag
- Use new Build::Intrepo module
- Add new Intrepo module to read/write build's internal repo format
- remove .gz from _ccache archive as it is no longer compressed
- Add support for Arch in build-recipe-kiwi
- Autodetect whether to use --pipe option of systemd-nspawn.
- Split parse_depfile() from readdeps()
- enable compression on ccache
- add bugzilla numbers for s390 workaround
- extend --ccache to generate _ccache.tar.gz and implement --pkg-ccache
- disable transparent_hugepage on s390x guests for now, causes hangs
- set buildflavor also for Build::parse</changelog>
  <changelog author="FSchreiner@suse.com" date="1595505600">- fix dependencies for Fedora 33
- Set $YAML::XS::LoadBlessed = 0 for Appimage/Snapcraft
- add a new variable to track build time needed for ccache eviction
- create folder for ccache archive to be copied before rsync
- also package pkg-config files by default into baselibs. (bsc#1172563 etc)
- Use shorter kernel flag for mitigations
- Ignore, if shutdown behavior changed by build in z/VM
- Control disk-space consumption while creating ccache archive
- cleaning ccache
- create folders before trying to copy ccache.tar
- Generate .packages and .basepackages files for docker builds</changelog>
  <changelog author="adrian@suse.de" date="1597924800">- fix factory version in config file bsc#1170956
- add missing ignores for Leap 15.2 bsc#1174854
- fix sysrq handling for KVM builds
- avoid double removal of obscpio files
- docker:
  * support builds using USER root statements
  * proper error handling when obs-docker-support gets called as
    non-root
  * helm build target support
  * support milestone handling
- support repo files without types set (SLE 15 SP2 zypp)
- add default substitute for system-packages:repo-creation
- Support recursive kiwi profile usage</changelog>
  <changelog author="adrian@suse.de" date="1598616000">- support rpmlint installed in /usr/bin/ as well
- fix local build for armv6hl
- Extract generated chart from the tarball instead of using the recipe</changelog>
  <changelog author="adrian@suse.de" date="1611144000">Features:
- initial flatpak build support added
- ccache support added
- debtransform: Add Debian revision if not present
- allow nodirindex filesystems via BuildFlags: vmfsoptions:nodirindex
- Also do rich dep handling for PreReqs
- kiwi image: configure ndb database if we install the rpm-ndb package
- Implement alternative method to specify build-ignores
  Changes:
- Ignore kiwi-image: deps when expanding image packages
  Fixes:
- Improve autonumbering of source/patch
- init_buildsystem: fix mode of /dev/full
- drop option transparent_hugepages=never on s390x
- Allow --vmdisk-filesystem-options as alias for --vm-disk-filesystem-options
- Do not add a "kiwi-packagemanager:" dependency if no package manager is defined
- debian:
  - Do not leave trailing whitespace while generating .dsc
  - Save modified version into .dsc file
  - Fail `debtransform` test if `debdiff` can't find something
  - return the unmapped arch if it is not found in the mapping hash
  - build-recipe-debootstrap: add fallback for Debian SID distro</changelog>
</package>
<package pkgid="5fe4c5c98d87a240a7a4c39bd05b9c4cf0cebb9944db3c3c6259f57b8cbba9f4" name="build" arch="src">
  <version epoch="0" ver="20210120" rel="6.1"/>
  <changelog author="adrian@suse.de" date="1562673600">- fail build on preinstall failure
- avoid dependency errors on Fedora 30
- fixes for simpleimage vm build support
- support zstd decompression with old rpms
- license tag fixes</changelog>
  <changelog author="adrian@suse.de" date="1569240000">- build-recipe-dsc: Move all build results, not just *.deb and *.changes
- Mount /sys in chroot build
- vc: Do not open the editor if content is set
- adding leap 15.2 and SLE 15 SP2 configs
- Fix some rpmlint warnings
- return exit status 9 in the genbuildreqs case
- Export SYSTEMD_OFFLINE=1 to avoid failures from systemctl</changelog>
  <changelog author="adrian@suse.de" date="1573732800">- Add Fedora module parser
- Rpmmd parser: set up a dummy ExternEnt handler
- Add support for modules and publish flags
- add zstd to recommends
- Support rpm's new expression expansion syntax</changelog>
  <changelog author="adrian@suse.de" date="1575547200">- qemu vm_type is running qemu system emulator now. Works for:
  * aarch64
  * armv7l
  * ppc64/ppc64le
  * s390/s390x
  * riscv64
  Note: this requires a kernel and initrd in build target via
    kernel-obs-build mechanic
- various --shell improvements
- new --shell-cmd to run commands in chroot/KVM/Qemu/... directly
- raising minimal required memory in qemu mode to 512MB to be able
  to run Linux kernel at least
- Normalize epoch 0 away when reading the module info
- Add systemd-nspawn backend (by Oleg Girko)</changelog>
  <changelog author="adrian@suse.de" date="1578398400">- allow to enter an existing buildroot w/o recipe
- generate milestone files also for pure online media
- fix ccache setup of non-dotted compiler versions</changelog>
  <changelog author="adrian@suse.de" date="1578657600">- Arch Linux zstd format support
- fix testbuild fail with latest rpm in SP2 and Leap 15.2
- do not retry automatically on disk full error</changelog>
  <changelog author="adrian@suse.de" date="1579694400">- fix createrepo existens check for appimager and docker builds
  in chroot
- support to use virt-make-fs for ext3 VM builds</changelog>
  <changelog author="adrian@suse.de" date="1579867200">- Fix crash when using preinstall dependency expansion in OBS
- build-vm-kvm: use /boot/kernel.obs.build and /boot/initrd.obs.build
  as fallback regardless of the platform to have a global fallback
  kernel to use for distros that do not use the "kernel-obs-build"
  package to provide the guests kernel and initrd as the system
  binaries are not reliable for use in a guest system
- use abuild user if $NOROOTFORBUILD is set.</changelog>
  <changelog author="adrian@suse.de" date="1579867201">- fix SLE 15 configurations
- Fix dist autodetection for sle15-sp2</changelog>
  <changelog author="adrian@suse.de" date="1580212800">- support OBS-Milestone comment for kiwi
- switch to preinstall expansion for factory</changelog>
  <changelog author="adrian@suse.de" date="1580299200">- 15.2 config: temporary revert gcrypt preinstall until distro has changed
- factory config: ignore libxtables for iproute2, not needed for ip tool
- Follow upstream rpm changes in regard to logical ops
- Fix macro expansion of lines containing newlines
- add missing header file to avoid compile warnings</changelog>
  <changelog author="adrian@suse.de" date="1580472000">- fix regression in &amp;&amp; operator handling of rpm spec file parser
- Correctly expand macros defined with %global</changelog>
  <changelog author="adrian@suse.de" date="1580904000">- 15.2 config: preinstall gcrypt deps again
- Recommends for Fedora based distros
- support obsgendiff funcationality
- various smaller code cleanups
- additional test cases for spec file parsing
- various fixes for cornercases during spec file parsing</changelog>
  <changelog author="adrian@suse.de" date="1581336000">- Spec parser: add support for %elif, %elifarch, %elifos
- Support rpm's %include statement (EXPERIMENTAL, known limitations)
- Do not do vminstall expansion in expanddeps unless --vm is used</changelog>
  <changelog author="adrian@suse.de" date="1584100800">- Leap 15.2 config update (libzstd1 for rpm)
- handle obscpio extraction error as fatal
- Return correct exit code from systemd-nspawn build
- Spec parser: do not parse included files from end to start
- running disk full check also outside of VM
- run disk full check only for chroot</changelog>
  <changelog author="coolo@suse.com" date="1589716800">- enable sysrq operations on boot
- Set kvm_serial_device to virtio-serial in the fixup
- Split console arg setting code into kvm_add_console_args
- Update for zVM to make container builds work.
- Write to /proc/sys/kernel/hostname if the hostname command is not available
- Use --cgroup-manager=cgroupfs when calling podman
- Also squash by default in podman builds
- Support different interpreters in prein/postin scriptlets
- Use grep -E instead of egrep to check for the needsbinariesforbuild flag
- Use new Build::Intrepo module
- Add new Intrepo module to read/write build's internal repo format
- remove .gz from _ccache archive as it is no longer compressed
- Add support for Arch in build-recipe-kiwi
- Autodetect whether to use --pipe option of systemd-nspawn.
- Split parse_depfile() from readdeps()
- enable compression on ccache
- add bugzilla numbers for s390 workaround
- extend --ccache to generate _ccache.tar.gz and implement --pkg-ccache
- disable transparent_hugepage on s390x guests for now, causes hangs
- set buildflavor also for Build::parse</changelog>
  <changelog author="FSchreiner@suse.com" date="1595505600">- fix dependencies for Fedora 33
- Set $YAML::XS::LoadBlessed = 0 for Appimage/Snapcraft
- add a new variable to track build time needed for ccache eviction
- create folder for ccache archive to be copied before rsync
- also package pkg-config files by default into baselibs. (bsc#1172563 etc)
- Use shorter kernel flag for mitigations
- Ignore, if shutdown behavior changed by build in z/VM
- Control disk-space consumption while creating ccache archive
- cleaning ccache
- create folders before trying to copy ccache.tar
- Generate .packages and .basepackages files for docker builds</changelog>
  <changelog author="adrian@suse.de" date="1597924800">- fix factory version in config file bsc#1170956
- add missing ignores for Leap 15.2 bsc#1174854
- fix sysrq handling for KVM builds
- avoid double removal of obscpio files
- docker:
  * support builds using USER root statements
  * proper error handling when obs-docker-support gets called as
    non-root
  * helm build target support
  * support milestone handling
- support repo files without types set (SLE 15 SP2 zypp)
- add default substitute for system-packages:repo-creation
- Support recursive kiwi profile usage</changelog>
  <changelog author="adrian@suse.de" date="1598616000">- support rpmlint installed in /usr/bin/ as well
- fix local build for armv6hl
- Extract generated chart from the tarball instead of using the recipe</changelog>
  <changelog author="adrian@suse.de" date="1611144000">Features:
- initial flatpak build support added
- ccache support added
- debtransform: Add Debian revision if not present
- allow nodirindex filesystems via BuildFlags: vmfsoptions:nodirindex
- Also do rich dep handling for PreReqs
- kiwi image: configure ndb database if we install the rpm-ndb package
- Implement alternative method to specify build-ignores
  Changes:
- Ignore kiwi-image: deps when expanding image packages
  Fixes:
- Improve autonumbering of source/patch
- init_buildsystem: fix mode of /dev/full
- drop option transparent_hugepages=never on s390x
- Allow --vmdisk-filesystem-options as alias for --vm-disk-filesystem-options
- Do not add a "kiwi-packagemanager:" dependency if no package manager is defined
- debian:
  - Do not leave trailing whitespace while generating .dsc
  - Save modified version into .dsc file
  - Fail `debtransform` test if `debdiff` can't find something
  - return the unmapped arch if it is not found in the mapping hash
  - build-recipe-debootstrap: add fallback for Debian SID distro</changelog>
</package>
<package pkgid="e69d25993c37b7e215e8e09390a2f1f111525e1c5364f15e3cfa5bd38d4c1150" name="build-initvm-aarch64" arch="noarch">
  <version epoch="0" ver="20210120" rel="6.1"/>
  <changelog author="adrian@suse.de" date="1562673600">- fail build on preinstall failure
- avoid dependency errors on Fedora 30
- fixes for simpleimage vm build support
- support zstd decompression with old rpms
- license tag fixes</changelog>
  <changelog author="adrian@suse.de" date="1569240000">- build-recipe-dsc: Move all build results, not just *.deb and *.changes
- Mount /sys in chroot build
- vc: Do not open the editor if content is set
- adding leap 15.2 and SLE 15 SP2 configs
- Fix some rpmlint warnings
- return exit status 9 in the genbuildreqs case
- Export SYSTEMD_OFFLINE=1 to avoid failures from systemctl</changelog>
  <changelog author="adrian@suse.de" date="1573732800">- Add Fedora module parser
- Rpmmd parser: set up a dummy ExternEnt handler
- Add support for modules and publish flags
- add zstd to recommends
- Support rpm's new expression expansion syntax</changelog>
  <changelog author="adrian@suse.de" date="1575547200">- qemu vm_type is running qemu system emulator now. Works for:
  * aarch64
  * armv7l
  * ppc64/ppc64le
  * s390/s390x
  * riscv64
  Note: this requires a kernel and initrd in build target via
    kernel-obs-build mechanic
- various --shell improvements
- new --shell-cmd to run commands in chroot/KVM/Qemu/... directly
- raising minimal required memory in qemu mode to 512MB to be able
  to run Linux kernel at least
- Normalize epoch 0 away when reading the module info
- Add systemd-nspawn backend (by Oleg Girko)</changelog>
  <changelog author="adrian@suse.de" date="1578398400">- allow to enter an existing buildroot w/o recipe
- generate milestone files also for pure online media
- fix ccache setup of non-dotted compiler versions</changelog>
  <changelog author="adrian@suse.de" date="1578657600">- Arch Linux zstd format support
- fix testbuild fail with latest rpm in SP2 and Leap 15.2
- do not retry automatically on disk full error</changelog>
  <changelog author="adrian@suse.de" date="1579694400">- fix createrepo existens check for appimager and docker builds
  in chroot
- support to use virt-make-fs for ext3 VM builds</changelog>
  <changelog author="adrian@suse.de" date="1579867200">- Fix crash when using preinstall dependency expansion in OBS
- build-vm-kvm: use /boot/kernel.obs.build and /boot/initrd.obs.build
  as fallback regardless of the platform to have a global fallback
  kernel to use for distros that do not use the "kernel-obs-build"
  package to provide the guests kernel and initrd as the system
  binaries are not reliable for use in a guest system
- use abuild user if $NOROOTFORBUILD is set.</changelog>
  <changelog author="adrian@suse.de" date="1579867201">- fix SLE 15 configurations
- Fix dist autodetection for sle15-sp2</changelog>
  <changelog author="adrian@suse.de" date="1580212800">- support OBS-Milestone comment for kiwi
- switch to preinstall expansion for factory</changelog>
  <changelog author="adrian@suse.de" date="1580299200">- 15.2 config: temporary revert gcrypt preinstall until distro has changed
- factory config: ignore libxtables for iproute2, not needed for ip tool
- Follow upstream rpm changes in regard to logical ops
- Fix macro expansion of lines containing newlines
- add missing header file to avoid compile warnings</changelog>
  <changelog author="adrian@suse.de" date="1580472000">- fix regression in &amp;&amp; operator handling of rpm spec file parser
- Correctly expand macros defined with %global</changelog>
  <changelog author="adrian@suse.de" date="1580904000">- 15.2 config: preinstall gcrypt deps again
- Recommends for Fedora based distros
- support obsgendiff funcationality
- various smaller code cleanups
- additional test cases for spec file parsing
- various fixes for cornercases during spec file parsing</changelog>
  <changelog author="adrian@suse.de" date="1581336000">- Spec parser: add support for %elif, %elifarch, %elifos
- Support rpm's %include statement (EXPERIMENTAL, known limitations)
- Do not do vminstall expansion in expanddeps unless --vm is used</changelog>
  <changelog author="adrian@suse.de" date="1584100800">- Leap 15.2 config update (libzstd1 for rpm)
- handle obscpio extraction error as fatal
- Return correct exit code from systemd-nspawn build
- Spec parser: do not parse included files from end to start
- running disk full check also outside of VM
- run disk full check only for chroot</changelog>
  <changelog author="coolo@suse.com" date="1589716800">- enable sysrq operations on boot
- Set kvm_serial_device to virtio-serial in the fixup
- Split console arg setting code into kvm_add_console_args
- Update for zVM to make container builds work.
- Write to /proc/sys/kernel/hostname if the hostname command is not available
- Use --cgroup-manager=cgroupfs when calling podman
- Also squash by default in podman builds
- Support different interpreters in prein/postin scriptlets
- Use grep -E instead of egrep to check for the needsbinariesforbuild flag
- Use new Build::Intrepo module
- Add new Intrepo module to read/write build's internal repo format
- remove .gz from _ccache archive as it is no longer compressed
- Add support for Arch in build-recipe-kiwi
- Autodetect whether to use --pipe option of systemd-nspawn.
- Split parse_depfile() from readdeps()
- enable compression on ccache
- add bugzilla numbers for s390 workaround
- extend --ccache to generate _ccache.tar.gz and implement --pkg-ccache
- disable transparent_hugepage on s390x guests for now, causes hangs
- set buildflavor also for Build::parse</changelog>
  <changelog author="FSchreiner@suse.com" date="1595505600">- fix dependencies for Fedora 33
- Set $YAML::XS::LoadBlessed = 0 for Appimage/Snapcraft
- add a new variable to track build time needed for ccache eviction
- create folder for ccache archive to be copied before rsync
- also package pkg-config files by default into baselibs. (bsc#1172563 etc)
- Use shorter kernel flag for mitigations
- Ignore, if shutdown behavior changed by build in z/VM
- Control disk-space consumption while creating ccache archive
- cleaning ccache
- create folders before trying to copy ccache.tar
- Generate .packages and .basepackages files for docker builds</changelog>
  <changelog author="adrian@suse.de" date="1597924800">- fix factory version in config file bsc#1170956
- add missing ignores for Leap 15.2 bsc#1174854
- fix sysrq handling for KVM builds
- avoid double removal of obscpio files
- docker:
  * support builds using USER root statements
  * proper error handling when obs-docker-support gets called as
    non-root
  * helm build target support
  * support milestone handling
- support repo files without types set (SLE 15 SP2 zypp)
- add default substitute for system-packages:repo-creation
- Support recursive kiwi profile usage</changelog>
  <changelog author="adrian@suse.de" date="1598616000">- support rpmlint installed in /usr/bin/ as well
- fix local build for armv6hl
- Extract generated chart from the tarball instead of using the recipe</changelog>
  <changelog author="adrian@suse.de" date="1611144000">Features:
- initial flatpak build support added
- ccache support added
- debtransform: Add Debian revision if not present
- allow nodirindex filesystems via BuildFlags: vmfsoptions:nodirindex
- Also do rich dep handling for PreReqs
- kiwi image: configure ndb database if we install the rpm-ndb package
- Implement alternative method to specify build-ignores
  Changes:
- Ignore kiwi-image: deps when expanding image packages
  Fixes:
- Improve autonumbering of source/patch
- init_buildsystem: fix mode of /dev/full
- drop option transparent_hugepages=never on s390x
- Allow --vmdisk-filesystem-options as alias for --vm-disk-filesystem-options
- Do not add a "kiwi-packagemanager:" dependency if no package manager is defined
- debian:
  - Do not leave trailing whitespace while generating .dsc
  - Save modified version into .dsc file
  - Fail `debtransform` test if `debdiff` can't find something
  - return the unmapped arch if it is not found in the mapping hash
  - build-recipe-debootstrap: add fallback for Debian SID distro</changelog>
</package>
<package pkgid="2ed14653003f9a2e1723cb0281fb287e3e0719ab0279f7fffa9b2379f7001877" name="build-initvm-powerpc64le" arch="noarch">
  <version epoch="0" ver="20210120" rel="6.1"/>
  <changelog author="adrian@suse.de" date="1562673600">- fail build on preinstall failure
- avoid dependency errors on Fedora 30
- fixes for simpleimage vm build support
- support zstd decompression with old rpms
- license tag fixes</changelog>
  <changelog author="adrian@suse.de" date="1569240000">- build-recipe-dsc: Move all build results, not just *.deb and *.changes
- Mount /sys in chroot build
- vc: Do not open the editor if content is set
- adding leap 15.2 and SLE 15 SP2 configs
- Fix some rpmlint warnings
- return exit status 9 in the genbuildreqs case
- Export SYSTEMD_OFFLINE=1 to avoid failures from systemctl</changelog>
  <changelog author="adrian@suse.de" date="1573732800">- Add Fedora module parser
- Rpmmd parser: set up a dummy ExternEnt handler
- Add support for modules and publish flags
- add zstd to recommends
- Support rpm's new expression expansion syntax</changelog>
  <changelog author="adrian@suse.de" date="1575547200">- qemu vm_type is running qemu system emulator now. Works for:
  * aarch64
  * armv7l
  * ppc64/ppc64le
  * s390/s390x
  * riscv64
  Note: this requires a kernel and initrd in build target via
    kernel-obs-build mechanic
- various --shell improvements
- new --shell-cmd to run commands in chroot/KVM/Qemu/... directly
- raising minimal required memory in qemu mode to 512MB to be able
  to run Linux kernel at least
- Normalize epoch 0 away when reading the module info
- Add systemd-nspawn backend (by Oleg Girko)</changelog>
  <changelog author="adrian@suse.de" date="1578398400">- allow to enter an existing buildroot w/o recipe
- generate milestone files also for pure online media
- fix ccache setup of non-dotted compiler versions</changelog>
  <changelog author="adrian@suse.de" date="1578657600">- Arch Linux zstd format support
- fix testbuild fail with latest rpm in SP2 and Leap 15.2
- do not retry automatically on disk full error</changelog>
  <changelog author="adrian@suse.de" date="1579694400">- fix createrepo existens check for appimager and docker builds
  in chroot
- support to use virt-make-fs for ext3 VM builds</changelog>
  <changelog author="adrian@suse.de" date="1579867200">- Fix crash when using preinstall dependency expansion in OBS
- build-vm-kvm: use /boot/kernel.obs.build and /boot/initrd.obs.build
  as fallback regardless of the platform to have a global fallback
  kernel to use for distros that do not use the "kernel-obs-build"
  package to provide the guests kernel and initrd as the system
  binaries are not reliable for use in a guest system
- use abuild user if $NOROOTFORBUILD is set.</changelog>
  <changelog author="adrian@suse.de" date="1579867201">- fix SLE 15 configurations
- Fix dist autodetection for sle15-sp2</changelog>
  <changelog author="adrian@suse.de" date="1580212800">- support OBS-Milestone comment for kiwi
- switch to preinstall expansion for factory</changelog>
  <changelog author="adrian@suse.de" date="1580299200">- 15.2 config: temporary revert gcrypt preinstall until distro has changed
- factory config: ignore libxtables for iproute2, not needed for ip tool
- Follow upstream rpm changes in regard to logical ops
- Fix macro expansion of lines containing newlines
- add missing header file to avoid compile warnings</changelog>
  <changelog author="adrian@suse.de" date="1580472000">- fix regression in &amp;&amp; operator handling of rpm spec file parser
- Correctly expand macros defined with %global</changelog>
  <changelog author="adrian@suse.de" date="1580904000">- 15.2 config: preinstall gcrypt deps again
- Recommends for Fedora based distros
- support obsgendiff funcationality
- various smaller code cleanups
- additional test cases for spec file parsing
- various fixes for cornercases during spec file parsing</changelog>
  <changelog author="adrian@suse.de" date="1581336000">- Spec parser: add support for %elif, %elifarch, %elifos
- Support rpm's %include statement (EXPERIMENTAL, known limitations)
- Do not do vminstall expansion in expanddeps unless --vm is used</changelog>
  <changelog author="adrian@suse.de" date="1584100800">- Leap 15.2 config update (libzstd1 for rpm)
- handle obscpio extraction error as fatal
- Return correct exit code from systemd-nspawn build
- Spec parser: do not parse included files from end to start
- running disk full check also outside of VM
- run disk full check only for chroot</changelog>
  <changelog author="coolo@suse.com" date="1589716800">- enable sysrq operations on boot
- Set kvm_serial_device to virtio-serial in the fixup
- Split console arg setting code into kvm_add_console_args
- Update for zVM to make container builds work.
- Write to /proc/sys/kernel/hostname if the hostname command is not available
- Use --cgroup-manager=cgroupfs when calling podman
- Also squash by default in podman builds
- Support different interpreters in prein/postin scriptlets
- Use grep -E instead of egrep to check for the needsbinariesforbuild flag
- Use new Build::Intrepo module
- Add new Intrepo module to read/write build's internal repo format
- remove .gz from _ccache archive as it is no longer compressed
- Add support for Arch in build-recipe-kiwi
- Autodetect whether to use --pipe option of systemd-nspawn.
- Split parse_depfile() from readdeps()
- enable compression on ccache
- add bugzilla numbers for s390 workaround
- extend --ccache to generate _ccache.tar.gz and implement --pkg-ccache
- disable transparent_hugepage on s390x guests for now, causes hangs
- set buildflavor also for Build::parse</changelog>
  <changelog author="FSchreiner@suse.com" date="1595505600">- fix dependencies for Fedora 33
- Set $YAML::XS::LoadBlessed = 0 for Appimage/Snapcraft
- add a new variable to track build time needed for ccache eviction
- create folder for ccache archive to be copied before rsync
- also package pkg-config files by default into baselibs. (bsc#1172563 etc)
- Use shorter kernel flag for mitigations
- Ignore, if shutdown behavior changed by build in z/VM
- Control disk-space consumption while creating ccache archive
- cleaning ccache
- create folders before trying to copy ccache.tar
- Generate .packages and .basepackages files for docker builds</changelog>
  <changelog author="adrian@suse.de" date="1597924800">- fix factory version in config file bsc#1170956
- add missing ignores for Leap 15.2 bsc#1174854
- fix sysrq handling for KVM builds
- avoid double removal of obscpio files
- docker:
  * support builds using USER root statements
  * proper error handling when obs-docker-support gets called as
    non-root
  * helm build target support
  * support milestone handling
- support repo files without types set (SLE 15 SP2 zypp)
- add default substitute for system-packages:repo-creation
- Support recursive kiwi profile usage</changelog>
  <changelog author="adrian@suse.de" date="1598616000">- support rpmlint installed in /usr/bin/ as well
- fix local build for armv6hl
- Extract generated chart from the tarball instead of using the recipe</changelog>
  <changelog author="adrian@suse.de" date="1611144000">Features:
- initial flatpak build support added
- ccache support added
- debtransform: Add Debian revision if not present
- allow nodirindex filesystems via BuildFlags: vmfsoptions:nodirindex
- Also do rich dep handling for PreReqs
- kiwi image: configure ndb database if we install the rpm-ndb package
- Implement alternative method to specify build-ignores
  Changes:
- Ignore kiwi-image: deps when expanding image packages
  Fixes:
- Improve autonumbering of source/patch
- init_buildsystem: fix mode of /dev/full
- drop option transparent_hugepages=never on s390x
- Allow --vmdisk-filesystem-options as alias for --vm-disk-filesystem-options
- Do not add a "kiwi-packagemanager:" dependency if no package manager is defined
- debian:
  - Do not leave trailing whitespace while generating .dsc
  - Save modified version into .dsc file
  - Fail `debtransform` test if `debdiff` can't find something
  - return the unmapped arch if it is not found in the mapping hash
  - build-recipe-debootstrap: add fallback for Debian SID distro</changelog>
</package>
<package pkgid="c48a5dcb783a89f325c7a56cdab7be5fd49721e34a99b4ac7c6f0edea54e744b" name="build-initvm-s390x" arch="noarch">
  <version epoch="0" ver="20210120" rel="6.1"/>
  <changelog author="adrian@suse.de" date="1562673600">- fail build on preinstall failure
- avoid dependency errors on Fedora 30
- fixes for simpleimage vm build support
- support zstd decompression with old rpms
- license tag fixes</changelog>
  <changelog author="adrian@suse.de" date="1569240000">- build-recipe-dsc: Move all build results, not just *.deb and *.changes
- Mount /sys in chroot build
- vc: Do not open the editor if content is set
- adding leap 15.2 and SLE 15 SP2 configs
- Fix some rpmlint warnings
- return exit status 9 in the genbuildreqs case
- Export SYSTEMD_OFFLINE=1 to avoid failures from systemctl</changelog>
  <changelog author="adrian@suse.de" date="1573732800">- Add Fedora module parser
- Rpmmd parser: set up a dummy ExternEnt handler
- Add support for modules and publish flags
- add zstd to recommends
- Support rpm's new expression expansion syntax</changelog>
  <changelog author="adrian@suse.de" date="1575547200">- qemu vm_type is running qemu system emulator now. Works for:
  * aarch64
  * armv7l
  * ppc64/ppc64le
  * s390/s390x
  * riscv64
  Note: this requires a kernel and initrd in build target via
    kernel-obs-build mechanic
- various --shell improvements
- new --shell-cmd to run commands in chroot/KVM/Qemu/... directly
- raising minimal required memory in qemu mode to 512MB to be able
  to run Linux kernel at least
- Normalize epoch 0 away when reading the module info
- Add systemd-nspawn backend (by Oleg Girko)</changelog>
  <changelog author="adrian@suse.de" date="1578398400">- allow to enter an existing buildroot w/o recipe
- generate milestone files also for pure online media
- fix ccache setup of non-dotted compiler versions</changelog>
  <changelog author="adrian@suse.de" date="1578657600">- Arch Linux zstd format support
- fix testbuild fail with latest rpm in SP2 and Leap 15.2
- do not retry automatically on disk full error</changelog>
  <changelog author="adrian@suse.de" date="1579694400">- fix createrepo existens check for appimager and docker builds
  in chroot
- support to use virt-make-fs for ext3 VM builds</changelog>
  <changelog author="adrian@suse.de" date="1579867200">- Fix crash when using preinstall dependency expansion in OBS
- build-vm-kvm: use /boot/kernel.obs.build and /boot/initrd.obs.build
  as fallback regardless of the platform to have a global fallback
  kernel to use for distros that do not use the "kernel-obs-build"
  package to provide the guests kernel and initrd as the system
  binaries are not reliable for use in a guest system
- use abuild user if $NOROOTFORBUILD is set.</changelog>
  <changelog author="adrian@suse.de" date="1579867201">- fix SLE 15 configurations
- Fix dist autodetection for sle15-sp2</changelog>
  <changelog author="adrian@suse.de" date="1580212800">- support OBS-Milestone comment for kiwi
- switch to preinstall expansion for factory</changelog>
  <changelog author="adrian@suse.de" date="1580299200">- 15.2 config: temporary revert gcrypt preinstall until distro has changed
- factory config: ignore libxtables for iproute2, not needed for ip tool
- Follow upstream rpm changes in regard to logical ops
- Fix macro expansion of lines containing newlines
- add missing header file to avoid compile warnings</changelog>
  <changelog author="adrian@suse.de" date="1580472000">- fix regression in &amp;&amp; operator handling of rpm spec file parser
- Correctly expand macros defined with %global</changelog>
  <changelog author="adrian@suse.de" date="1580904000">- 15.2 config: preinstall gcrypt deps again
- Recommends for Fedora based distros
- support obsgendiff funcationality
- various smaller code cleanups
- additional test cases for spec file parsing
- various fixes for cornercases during spec file parsing</changelog>
  <changelog author="adrian@suse.de" date="1581336000">- Spec parser: add support for %elif, %elifarch, %elifos
- Support rpm's %include statement (EXPERIMENTAL, known limitations)
- Do not do vminstall expansion in expanddeps unless --vm is used</changelog>
  <changelog author="adrian@suse.de" date="1584100800">- Leap 15.2 config update (libzstd1 for rpm)
- handle obscpio extraction error as fatal
- Return correct exit code from systemd-nspawn build
- Spec parser: do not parse included files from end to start
- running disk full check also outside of VM
- run disk full check only for chroot</changelog>
  <changelog author="coolo@suse.com" date="1589716800">- enable sysrq operations on boot
- Set kvm_serial_device to virtio-serial in the fixup
- Split console arg setting code into kvm_add_console_args
- Update for zVM to make container builds work.
- Write to /proc/sys/kernel/hostname if the hostname command is not available
- Use --cgroup-manager=cgroupfs when calling podman
- Also squash by default in podman builds
- Support different interpreters in prein/postin scriptlets
- Use grep -E instead of egrep to check for the needsbinariesforbuild flag
- Use new Build::Intrepo module
- Add new Intrepo module to read/write build's internal repo format
- remove .gz from _ccache archive as it is no longer compressed
- Add support for Arch in build-recipe-kiwi
- Autodetect whether to use --pipe option of systemd-nspawn.
- Split parse_depfile() from readdeps()
- enable compression on ccache
- add bugzilla numbers for s390 workaround
- extend --ccache to generate _ccache.tar.gz and implement --pkg-ccache
- disable transparent_hugepage on s390x guests for now, causes hangs
- set buildflavor also for Build::parse</changelog>
  <changelog author="FSchreiner@suse.com" date="1595505600">- fix dependencies for Fedora 33
- Set $YAML::XS::LoadBlessed = 0 for Appimage/Snapcraft
- add a new variable to track build time needed for ccache eviction
- create folder for ccache archive to be copied before rsync
- also package pkg-config files by default into baselibs. (bsc#1172563 etc)
- Use shorter kernel flag for mitigations
- Ignore, if shutdown behavior changed by build in z/VM
- Control disk-space consumption while creating ccache archive
- cleaning ccache
- create folders before trying to copy ccache.tar
- Generate .packages and .basepackages files for docker builds</changelog>
  <changelog author="adrian@suse.de" date="1597924800">- fix factory version in config file bsc#1170956
- add missing ignores for Leap 15.2 bsc#1174854
- fix sysrq handling for KVM builds
- avoid double removal of obscpio files
- docker:
  * support builds using USER root statements
  * proper error handling when obs-docker-support gets called as
    non-root
  * helm build target support
  * support milestone handling
- support repo files without types set (SLE 15 SP2 zypp)
- add default substitute for system-packages:repo-creation
- Support recursive kiwi profile usage</changelog>
  <changelog author="adrian@suse.de" date="1598616000">- support rpmlint installed in /usr/bin/ as well
- fix local build for armv6hl
- Extract generated chart from the tarball instead of using the recipe</changelog>
  <changelog author="adrian@suse.de" date="1611144000">Features:
- initial flatpak build support added
- ccache support added
- debtransform: Add Debian revision if not present
- allow nodirindex filesystems via BuildFlags: vmfsoptions:nodirindex
- Also do rich dep handling for PreReqs
- kiwi image: configure ndb database if we install the rpm-ndb package
- Implement alternative method to specify build-ignores
  Changes:
- Ignore kiwi-image: deps when expanding image packages
  Fixes:
- Improve autonumbering of source/patch
- init_buildsystem: fix mode of /dev/full
- drop option transparent_hugepages=never on s390x
- Allow --vmdisk-filesystem-options as alias for --vm-disk-filesystem-options
- Do not add a "kiwi-packagemanager:" dependency if no package manager is defined
- debian:
  - Do not leave trailing whitespace while generating .dsc
  - Save modified version into .dsc file
  - Fail `debtransform` test if `debdiff` can't find something
  - return the unmapped arch if it is not found in the mapping hash
  - build-recipe-debootstrap: add fallback for Debian SID distro</changelog>
</package>
<package pkgid="0f0db04cd83b46ceadae80033318775d15c1e6686d5406c573f755024cfd918f" name="build-initvm-x86_64" arch="noarch">
  <version epoch="0" ver="20210120" rel="6.1"/>
  <changelog author="adrian@suse.de" date="1562673600">- fail build on preinstall failure
- avoid dependency errors on Fedora 30
- fixes for simpleimage vm build support
- support zstd decompression with old rpms
- license tag fixes</changelog>
  <changelog author="adrian@suse.de" date="1569240000">- build-recipe-dsc: Move all build results, not just *.deb and *.changes
- Mount /sys in chroot build
- vc: Do not open the editor if content is set
- adding leap 15.2 and SLE 15 SP2 configs
- Fix some rpmlint warnings
- return exit status 9 in the genbuildreqs case
- Export SYSTEMD_OFFLINE=1 to avoid failures from systemctl</changelog>
  <changelog author="adrian@suse.de" date="1573732800">- Add Fedora module parser
- Rpmmd parser: set up a dummy ExternEnt handler
- Add support for modules and publish flags
- add zstd to recommends
- Support rpm's new expression expansion syntax</changelog>
  <changelog author="adrian@suse.de" date="1575547200">- qemu vm_type is running qemu system emulator now. Works for:
  * aarch64
  * armv7l
  * ppc64/ppc64le
  * s390/s390x
  * riscv64
  Note: this requires a kernel and initrd in build target via
    kernel-obs-build mechanic
- various --shell improvements
- new --shell-cmd to run commands in chroot/KVM/Qemu/... directly
- raising minimal required memory in qemu mode to 512MB to be able
  to run Linux kernel at least
- Normalize epoch 0 away when reading the module info
- Add systemd-nspawn backend (by Oleg Girko)</changelog>
  <changelog author="adrian@suse.de" date="1578398400">- allow to enter an existing buildroot w/o recipe
- generate milestone files also for pure online media
- fix ccache setup of non-dotted compiler versions</changelog>
  <changelog author="adrian@suse.de" date="1578657600">- Arch Linux zstd format support
- fix testbuild fail with latest rpm in SP2 and Leap 15.2
- do not retry automatically on disk full error</changelog>
  <changelog author="adrian@suse.de" date="1579694400">- fix createrepo existens check for appimager and docker builds
  in chroot
- support to use virt-make-fs for ext3 VM builds</changelog>
  <changelog author="adrian@suse.de" date="1579867200">- Fix crash when using preinstall dependency expansion in OBS
- build-vm-kvm: use /boot/kernel.obs.build and /boot/initrd.obs.build
  as fallback regardless of the platform to have a global fallback
  kernel to use for distros that do not use the "kernel-obs-build"
  package to provide the guests kernel and initrd as the system
  binaries are not reliable for use in a guest system
- use abuild user if $NOROOTFORBUILD is set.</changelog>
  <changelog author="adrian@suse.de" date="1579867201">- fix SLE 15 configurations
- Fix dist autodetection for sle15-sp2</changelog>
  <changelog author="adrian@suse.de" date="1580212800">- support OBS-Milestone comment for kiwi
- switch to preinstall expansion for factory</changelog>
  <changelog author="adrian@suse.de" date="1580299200">- 15.2 config: temporary revert gcrypt preinstall until distro has changed
- factory config: ignore libxtables for iproute2, not needed for ip tool
- Follow upstream rpm changes in regard to logical ops
- Fix macro expansion of lines containing newlines
- add missing header file to avoid compile warnings</changelog>
  <changelog author="adrian@suse.de" date="1580472000">- fix regression in &amp;&amp; operator handling of rpm spec file parser
- Correctly expand macros defined with %global</changelog>
  <changelog author="adrian@suse.de" date="1580904000">- 15.2 config: preinstall gcrypt deps again
- Recommends for Fedora based distros
- support obsgendiff funcationality
- various smaller code cleanups
- additional test cases for spec file parsing
- various fixes for cornercases during spec file parsing</changelog>
  <changelog author="adrian@suse.de" date="1581336000">- Spec parser: add support for %elif, %elifarch, %elifos
- Support rpm's %include statement (EXPERIMENTAL, known limitations)
- Do not do vminstall expansion in expanddeps unless --vm is used</changelog>
  <changelog author="adrian@suse.de" date="1584100800">- Leap 15.2 config update (libzstd1 for rpm)
- handle obscpio extraction error as fatal
- Return correct exit code from systemd-nspawn build
- Spec parser: do not parse included files from end to start
- running disk full check also outside of VM
- run disk full check only for chroot</changelog>
  <changelog author="coolo@suse.com" date="1589716800">- enable sysrq operations on boot
- Set kvm_serial_device to virtio-serial in the fixup
- Split console arg setting code into kvm_add_console_args
- Update for zVM to make container builds work.
- Write to /proc/sys/kernel/hostname if the hostname command is not available
- Use --cgroup-manager=cgroupfs when calling podman
- Also squash by default in podman builds
- Support different interpreters in prein/postin scriptlets
- Use grep -E instead of egrep to check for the needsbinariesforbuild flag
- Use new Build::Intrepo module
- Add new Intrepo module to read/write build's internal repo format
- remove .gz from _ccache archive as it is no longer compressed
- Add support for Arch in build-recipe-kiwi
- Autodetect whether to use --pipe option of systemd-nspawn.
- Split parse_depfile() from readdeps()
- enable compression on ccache
- add bugzilla numbers for s390 workaround
- extend --ccache to generate _ccache.tar.gz and implement --pkg-ccache
- disable transparent_hugepage on s390x guests for now, causes hangs
- set buildflavor also for Build::parse</changelog>
  <changelog author="FSchreiner@suse.com" date="1595505600">- fix dependencies for Fedora 33
- Set $YAML::XS::LoadBlessed = 0 for Appimage/Snapcraft
- add a new variable to track build time needed for ccache eviction
- create folder for ccache archive to be copied before rsync
- also package pkg-config files by default into baselibs. (bsc#1172563 etc)
- Use shorter kernel flag for mitigations
- Ignore, if shutdown behavior changed by build in z/VM
- Control disk-space consumption while creating ccache archive
- cleaning ccache
- create folders before trying to copy ccache.tar
- Generate .packages and .basepackages files for docker builds</changelog>
  <changelog author="adrian@suse.de" date="1597924800">- fix factory version in config file bsc#1170956
- add missing ignores for Leap 15.2 bsc#1174854
- fix sysrq handling for KVM builds
- avoid double removal of obscpio files
- docker:
  * support builds using USER root statements
  * proper error handling when obs-docker-support gets called as
    non-root
  * helm build target support
  * support milestone handling
- support repo files without types set (SLE 15 SP2 zypp)
- add default substitute for system-packages:repo-creation
- Support recursive kiwi profile usage</changelog>
  <changelog author="adrian@suse.de" date="1598616000">- support rpmlint installed in /usr/bin/ as well
- fix local build for armv6hl
- Extract generated chart from the tarball instead of using the recipe</changelog>
  <changelog author="adrian@suse.de" date="1611144000">Features:
- initial flatpak build support added
- ccache support added
- debtransform: Add Debian revision if not present
- allow nodirindex filesystems via BuildFlags: vmfsoptions:nodirindex
- Also do rich dep handling for PreReqs
- kiwi image: configure ndb database if we install the rpm-ndb package
- Implement alternative method to specify build-ignores
  Changes:
- Ignore kiwi-image: deps when expanding image packages
  Fixes:
- Improve autonumbering of source/patch
- init_buildsystem: fix mode of /dev/full
- drop option transparent_hugepages=never on s390x
- Allow --vmdisk-filesystem-options as alias for --vm-disk-filesystem-options
- Do not add a "kiwi-packagemanager:" dependency if no package manager is defined
- debian:
  - Do not leave trailing whitespace while generating .dsc
  - Save modified version into .dsc file
  - Fail `debtransform` test if `debdiff` can't find something
  - return the unmapped arch if it is not found in the mapping hash
  - build-recipe-debootstrap: add fallback for Debian SID distro</changelog>
</package>
<package pkgid="414ac69abe9c5a93f2f47bd50ed43ee740c91744ff45c80305c9775e12628bab" name="build-mkbaselibs" arch="noarch">
  <version epoch="0" ver="20210120" rel="6.1"/>
  <changelog author="adrian@suse.de" date="1562673600">- fail build on preinstall failure
- avoid dependency errors on Fedora 30
- fixes for simpleimage vm build support
- support zstd decompression with old rpms
- license tag fixes</changelog>
  <changelog author="adrian@suse.de" date="1569240000">- build-recipe-dsc: Move all build results, not just *.deb and *.changes
- Mount /sys in chroot build
- vc: Do not open the editor if content is set
- adding leap 15.2 and SLE 15 SP2 configs
- Fix some rpmlint warnings
- return exit status 9 in the genbuildreqs case
- Export SYSTEMD_OFFLINE=1 to avoid failures from systemctl</changelog>
  <changelog author="adrian@suse.de" date="1573732800">- Add Fedora module parser
- Rpmmd parser: set up a dummy ExternEnt handler
- Add support for modules and publish flags
- add zstd to recommends
- Support rpm's new expression expansion syntax</changelog>
  <changelog author="adrian@suse.de" date="1575547200">- qemu vm_type is running qemu system emulator now. Works for:
  * aarch64
  * armv7l
  * ppc64/ppc64le
  * s390/s390x
  * riscv64
  Note: this requires a kernel and initrd in build target via
    kernel-obs-build mechanic
- various --shell improvements
- new --shell-cmd to run commands in chroot/KVM/Qemu/... directly
- raising minimal required memory in qemu mode to 512MB to be able
  to run Linux kernel at least
- Normalize epoch 0 away when reading the module info
- Add systemd-nspawn backend (by Oleg Girko)</changelog>
  <changelog author="adrian@suse.de" date="1578398400">- allow to enter an existing buildroot w/o recipe
- generate milestone files also for pure online media
- fix ccache setup of non-dotted compiler versions</changelog>
  <changelog author="adrian@suse.de" date="1578657600">- Arch Linux zstd format support
- fix testbuild fail with latest rpm in SP2 and Leap 15.2
- do not retry automatically on disk full error</changelog>
  <changelog author="adrian@suse.de" date="1579694400">- fix createrepo existens check for appimager and docker builds
  in chroot
- support to use virt-make-fs for ext3 VM builds</changelog>
  <changelog author="adrian@suse.de" date="1579867200">- Fix crash when using preinstall dependency expansion in OBS
- build-vm-kvm: use /boot/kernel.obs.build and /boot/initrd.obs.build
  as fallback regardless of the platform to have a global fallback
  kernel to use for distros that do not use the "kernel-obs-build"
  package to provide the guests kernel and initrd as the system
  binaries are not reliable for use in a guest system
- use abuild user if $NOROOTFORBUILD is set.</changelog>
  <changelog author="adrian@suse.de" date="1579867201">- fix SLE 15 configurations
- Fix dist autodetection for sle15-sp2</changelog>
  <changelog author="adrian@suse.de" date="1580212800">- support OBS-Milestone comment for kiwi
- switch to preinstall expansion for factory</changelog>
  <changelog author="adrian@suse.de" date="1580299200">- 15.2 config: temporary revert gcrypt preinstall until distro has changed
- factory config: ignore libxtables for iproute2, not needed for ip tool
- Follow upstream rpm changes in regard to logical ops
- Fix macro expansion of lines containing newlines
- add missing header file to avoid compile warnings</changelog>
  <changelog author="adrian@suse.de" date="1580472000">- fix regression in &amp;&amp; operator handling of rpm spec file parser
- Correctly expand macros defined with %global</changelog>
  <changelog author="adrian@suse.de" date="1580904000">- 15.2 config: preinstall gcrypt deps again
- Recommends for Fedora based distros
- support obsgendiff funcationality
- various smaller code cleanups
- additional test cases for spec file parsing
- various fixes for cornercases during spec file parsing</changelog>
  <changelog author="adrian@suse.de" date="1581336000">- Spec parser: add support for %elif, %elifarch, %elifos
- Support rpm's %include statement (EXPERIMENTAL, known limitations)
- Do not do vminstall expansion in expanddeps unless --vm is used</changelog>
  <changelog author="adrian@suse.de" date="1584100800">- Leap 15.2 config update (libzstd1 for rpm)
- handle obscpio extraction error as fatal
- Return correct exit code from systemd-nspawn build
- Spec parser: do not parse included files from end to start
- running disk full check also outside of VM
- run disk full check only for chroot</changelog>
  <changelog author="coolo@suse.com" date="1589716800">- enable sysrq operations on boot
- Set kvm_serial_device to virtio-serial in the fixup
- Split console arg setting code into kvm_add_console_args
- Update for zVM to make container builds work.
- Write to /proc/sys/kernel/hostname if the hostname command is not available
- Use --cgroup-manager=cgroupfs when calling podman
- Also squash by default in podman builds
- Support different interpreters in prein/postin scriptlets
- Use grep -E instead of egrep to check for the needsbinariesforbuild flag
- Use new Build::Intrepo module
- Add new Intrepo module to read/write build's internal repo format
- remove .gz from _ccache archive as it is no longer compressed
- Add support for Arch in build-recipe-kiwi
- Autodetect whether to use --pipe option of systemd-nspawn.
- Split parse_depfile() from readdeps()
- enable compression on ccache
- add bugzilla numbers for s390 workaround
- extend --ccache to generate _ccache.tar.gz and implement --pkg-ccache
- disable transparent_hugepage on s390x guests for now, causes hangs
- set buildflavor also for Build::parse</changelog>
  <changelog author="FSchreiner@suse.com" date="1595505600">- fix dependencies for Fedora 33
- Set $YAML::XS::LoadBlessed = 0 for Appimage/Snapcraft
- add a new variable to track build time needed for ccache eviction
- create folder for ccache archive to be copied before rsync
- also package pkg-config files by default into baselibs. (bsc#1172563 etc)
- Use shorter kernel flag for mitigations
- Ignore, if shutdown behavior changed by build in z/VM
- Control disk-space consumption while creating ccache archive
- cleaning ccache
- create folders before trying to copy ccache.tar
- Generate .packages and .basepackages files for docker builds</changelog>
  <changelog author="adrian@suse.de" date="1597924800">- fix factory version in config file bsc#1170956
- add missing ignores for Leap 15.2 bsc#1174854
- fix sysrq handling for KVM builds
- avoid double removal of obscpio files
- docker:
  * support builds using USER root statements
  * proper error handling when obs-docker-support gets called as
    non-root
  * helm build target support
  * support milestone handling
- support repo files without types set (SLE 15 SP2 zypp)
- add default substitute for system-packages:repo-creation
- Support recursive kiwi profile usage</changelog>
  <changelog author="adrian@suse.de" date="1598616000">- support rpmlint installed in /usr/bin/ as well
- fix local build for armv6hl
- Extract generated chart from the tarball instead of using the recipe</changelog>
  <changelog author="adrian@suse.de" date="1611144000">Features:
- initial flatpak build support added
- ccache support added
- debtransform: Add Debian revision if not present
- allow nodirindex filesystems via BuildFlags: vmfsoptions:nodirindex
- Also do rich dep handling for PreReqs
- kiwi image: configure ndb database if we install the rpm-ndb package
- Implement alternative method to specify build-ignores
  Changes:
- Ignore kiwi-image: deps when expanding image packages
  Fixes:
- Improve autonumbering of source/patch
- init_buildsystem: fix mode of /dev/full
- drop option transparent_hugepages=never on s390x
- Allow --vmdisk-filesystem-options as alias for --vm-disk-filesystem-options
- Do not add a "kiwi-packagemanager:" dependency if no package manager is defined
- debian:
  - Do not leave trailing whitespace while generating .dsc
  - Save modified version into .dsc file
  - Fail `debtransform` test if `debdiff` can't find something
  - return the unmapped arch if it is not found in the mapping hash
  - build-recipe-debootstrap: add fallback for Debian SID distro</changelog>
</package>
<package pkgid="f70972e936b1095ca689dbd0c4bc395446d5bad664e2bf656200fc5a537f278b" name="build-mkdrpms" arch="noarch">
  <version epoch="0" ver="20210120" rel="6.1"/>
  <changelog author="adrian@suse.de" date="1562673600">- fail build on preinstall failure
- avoid dependency errors on Fedora 30
- fixes for simpleimage vm build support
- support zstd decompression with old rpms
- license tag fixes</changelog>
  <changelog author="adrian@suse.de" date="1569240000">- build-recipe-dsc: Move all build results, not just *.deb and *.changes
- Mount /sys in chroot build
- vc: Do not open the editor if content is set
- adding leap 15.2 and SLE 15 SP2 configs
- Fix some rpmlint warnings
- return exit status 9 in the genbuildreqs case
- Export SYSTEMD_OFFLINE=1 to avoid failures from systemctl</changelog>
  <changelog author="adrian@suse.de" date="1573732800">- Add Fedora module parser
- Rpmmd parser: set up a dummy ExternEnt handler
- Add support for modules and publish flags
- add zstd to recommends
- Support rpm's new expression expansion syntax</changelog>
  <changelog author="adrian@suse.de" date="1575547200">- qemu vm_type is running qemu system emulator now. Works for:
  * aarch64
  * armv7l
  * ppc64/ppc64le
  * s390/s390x
  * riscv64
  Note: this requires a kernel and initrd in build target via
    kernel-obs-build mechanic
- various --shell improvements
- new --shell-cmd to run commands in chroot/KVM/Qemu/... directly
- raising minimal required memory in qemu mode to 512MB to be able
  to run Linux kernel at least
- Normalize epoch 0 away when reading the module info
- Add systemd-nspawn backend (by Oleg Girko)</changelog>
  <changelog author="adrian@suse.de" date="1578398400">- allow to enter an existing buildroot w/o recipe
- generate milestone files also for pure online media
- fix ccache setup of non-dotted compiler versions</changelog>
  <changelog author="adrian@suse.de" date="1578657600">- Arch Linux zstd format support
- fix testbuild fail with latest rpm in SP2 and Leap 15.2
- do not retry automatically on disk full error</changelog>
  <changelog author="adrian@suse.de" date="1579694400">- fix createrepo existens check for appimager and docker builds
  in chroot
- support to use virt-make-fs for ext3 VM builds</changelog>
  <changelog author="adrian@suse.de" date="1579867200">- Fix crash when using preinstall dependency expansion in OBS
- build-vm-kvm: use /boot/kernel.obs.build and /boot/initrd.obs.build
  as fallback regardless of the platform to have a global fallback
  kernel to use for distros that do not use the "kernel-obs-build"
  package to provide the guests kernel and initrd as the system
  binaries are not reliable for use in a guest system
- use abuild user if $NOROOTFORBUILD is set.</changelog>
  <changelog author="adrian@suse.de" date="1579867201">- fix SLE 15 configurations
- Fix dist autodetection for sle15-sp2</changelog>
  <changelog author="adrian@suse.de" date="1580212800">- support OBS-Milestone comment for kiwi
- switch to preinstall expansion for factory</changelog>
  <changelog author="adrian@suse.de" date="1580299200">- 15.2 config: temporary revert gcrypt preinstall until distro has changed
- factory config: ignore libxtables for iproute2, not needed for ip tool
- Follow upstream rpm changes in regard to logical ops
- Fix macro expansion of lines containing newlines
- add missing header file to avoid compile warnings</changelog>
  <changelog author="adrian@suse.de" date="1580472000">- fix regression in &amp;&amp; operator handling of rpm spec file parser
- Correctly expand macros defined with %global</changelog>
  <changelog author="adrian@suse.de" date="1580904000">- 15.2 config: preinstall gcrypt deps again
- Recommends for Fedora based distros
- support obsgendiff funcationality
- various smaller code cleanups
- additional test cases for spec file parsing
- various fixes for cornercases during spec file parsing</changelog>
  <changelog author="adrian@suse.de" date="1581336000">- Spec parser: add support for %elif, %elifarch, %elifos
- Support rpm's %include statement (EXPERIMENTAL, known limitations)
- Do not do vminstall expansion in expanddeps unless --vm is used</changelog>
  <changelog author="adrian@suse.de" date="1584100800">- Leap 15.2 config update (libzstd1 for rpm)
- handle obscpio extraction error as fatal
- Return correct exit code from systemd-nspawn build
- Spec parser: do not parse included files from end to start
- running disk full check also outside of VM
- run disk full check only for chroot</changelog>
  <changelog author="coolo@suse.com" date="1589716800">- enable sysrq operations on boot
- Set kvm_serial_device to virtio-serial in the fixup
- Split console arg setting code into kvm_add_console_args
- Update for zVM to make container builds work.
- Write to /proc/sys/kernel/hostname if the hostname command is not available
- Use --cgroup-manager=cgroupfs when calling podman
- Also squash by default in podman builds
- Support different interpreters in prein/postin scriptlets
- Use grep -E instead of egrep to check for the needsbinariesforbuild flag
- Use new Build::Intrepo module
- Add new Intrepo module to read/write build's internal repo format
- remove .gz from _ccache archive as it is no longer compressed
- Add support for Arch in build-recipe-kiwi
- Autodetect whether to use --pipe option of systemd-nspawn.
- Split parse_depfile() from readdeps()
- enable compression on ccache
- add bugzilla numbers for s390 workaround
- extend --ccache to generate _ccache.tar.gz and implement --pkg-ccache
- disable transparent_hugepage on s390x guests for now, causes hangs
- set buildflavor also for Build::parse</changelog>
  <changelog author="FSchreiner@suse.com" date="1595505600">- fix dependencies for Fedora 33
- Set $YAML::XS::LoadBlessed = 0 for Appimage/Snapcraft
- add a new variable to track build time needed for ccache eviction
- create folder for ccache archive to be copied before rsync
- also package pkg-config files by default into baselibs. (bsc#1172563 etc)
- Use shorter kernel flag for mitigations
- Ignore, if shutdown behavior changed by build in z/VM
- Control disk-space consumption while creating ccache archive
- cleaning ccache
- create folders before trying to copy ccache.tar
- Generate .packages and .basepackages files for docker builds</changelog>
  <changelog author="adrian@suse.de" date="1597924800">- fix factory version in config file bsc#1170956
- add missing ignores for Leap 15.2 bsc#1174854
- fix sysrq handling for KVM builds
- avoid double removal of obscpio files
- docker:
  * support builds using USER root statements
  * proper error handling when obs-docker-support gets called as
    non-root
  * helm build target support
  * support milestone handling
- support repo files without types set (SLE 15 SP2 zypp)
- add default substitute for system-packages:repo-creation
- Support recursive kiwi profile usage</changelog>
  <changelog author="adrian@suse.de" date="1598616000">- support rpmlint installed in /usr/bin/ as well
- fix local build for armv6hl
- Extract generated chart from the tarball instead of using the recipe</changelog>
  <changelog author="adrian@suse.de" date="1611144000">Features:
- initial flatpak build support added
- ccache support added
- debtransform: Add Debian revision if not present
- allow nodirindex filesystems via BuildFlags: vmfsoptions:nodirindex
- Also do rich dep handling for PreReqs
- kiwi image: configure ndb database if we install the rpm-ndb package
- Implement alternative method to specify build-ignores
  Changes:
- Ignore kiwi-image: deps when expanding image packages
  Fixes:
- Improve autonumbering of source/patch
- init_buildsystem: fix mode of /dev/full
- drop option transparent_hugepages=never on s390x
- Allow --vmdisk-filesystem-options as alias for --vm-disk-filesystem-options
- Do not add a "kiwi-packagemanager:" dependency if no package manager is defined
- debian:
  - Do not leave trailing whitespace while generating .dsc
  - Save modified version into .dsc file
  - Fail `debtransform` test if `debdiff` can't find something
  - return the unmapped arch if it is not found in the mapping hash
  - build-recipe-debootstrap: add fallback for Debian SID distro</changelog>
</package>
<package pkgid="6510a4840d4495914e04fe6813b2a7bbbfd394088d85ee77dfe0b83f310cc3e9" name="buildah" arch="aarch64">
  <version epoch="0" ver="1.17.0" rel="3.9.1"/>
  <changelog author="sgrunert@suse.com" date="1567425600">- Add patch for CVE-2019-10214. bsc#1144065
  + CVE-2019-10214.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1567684800">- Update to v1.11.0
  * Add --digestfile and Re-add push statement as debug
  * Add --log-level command line option and deprecate --debug
  * Add security-related volume options to validator
  * Allow buildah bud to be called without arguments
  * Allow to override build date with SOURCE_DATE_EPOCH
  * Correctly detect ExitError values from Run()
  * Disable empty logrus timestamps to reduce logger noise
  * Fix directory pull image names
  * Fix handling of /dev/null masked devices
  * Fix possible runtime panic on bud
  * Update bud/from help to contain indicator for --dns=none
  * Update documentation about bud
  * Update shebangs to take env into consideration
  * Use content digests in ADD/COPY history entries
  * add support for cgroupsV2
  * add: add a DryRun flag to AddAndCopyOptions
  * add: handle hard links when copying with .dockerignore
  * add: teach copyFileWithTar() about symlinks and directories
  * imagebuilder: fix detection of referenced stage roots
  * pull/commit/push: pay attention to $BUILD_REGISTRY_SOURCES
  * run_linux: fix mounting /sys in a userns
- Remove hardly set build tags in favor of the Makefile</changelog>
  <changelog author="sgrunert@suse.com" date="1568376000">- Update to v1.11.1
  * Add --devices flag to bud and from
  * Add support for /run/.containerenv
  * Allow mounts.conf entries for equal source and destination paths
  * Fix label and annotation for 1-line Dockerfiles
  * Preserve file and directory mount permissions
  * Replace --debug=false with --log-level=error
  * Set TMPDIR to /var/tmp by default
  * Truncate output of too long image names
  * Ignore EmptyLayer if Squash is set</changelog>
  <changelog author="rbrown@suse.com" date="1569240000">- Update to v1.11.2
  * Add some cleanup code
  * Move devices code to unit specific directory.</changelog>
  <changelog author="sgrunert@suse.com" date="1570449600">- Update to v1.11.3
  * Add cgroups2
  * Add support for retrieving context from stdin "-"
  * Added tutorial on how to include Buildah as library
  * Fix --build-args handling
  * Print build 'STEP' line to stdout, not stderr
  * Use Containerfile by default</changelog>
  <changelog author="sgrunert@suse.com" date="1572350400">- Update to v1.11.4
  * buildah: add a "manifest" command
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1573560000">- Update to v1.11.5
  * buildah: add "manifest" command
  * pkg/supplemented: add a package for grouping images together
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * version: also note the version of containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1575547200">- Update to v1.11.6
  * Handle missing equal sign in --from and --chown flags
    for COPY/ADD
  * bud COPY does not download URL
  * Fix .dockerignore exclude regression
  * commit(docker): always set ContainerID and ContainerConfig
  * Touch up commit man page image parameter
  * Add builder identity annotations.</changelog>
  <changelog author="sgrunert@suse.com" date="1576497600">- Update to v1.12.0
  * Allow ADD to use http src
  * imgtype: reset storage opts if driver overridden
  * Start using containers/common
  * overlay.bats typo: fuse-overlays should be fuse-overlayfs
  * chroot: Unmount with MNT_DETACH instead of UnmountMountpoints()
  * bind: don't complain about missing mountpoints
  * imgtype: check earlier for expected manifest type
  * Add history names support</changelog>
  <changelog author="sgrunert@suse.com" date="1579089600">- Update to v1.13.1
  * copyFileWithTar: close source files at the right time
  * copy: don't digest files that we ignore
  * Check for .dockerignore specifically
  * Don't setup excludes, if their is only one pattern to match
  * set HOME env to /root on chroot-isolation by default
  * docs: fix references to containers-*.5
  * fix bug Add check .dockerignore COPY file
  * buildah bud --volume: run from tmpdir, not source dir
  * Fix imageNamePrefix to give consistent names in buildah-from
  * cpp: use -traditional and -undef flags
  * discard outputs coming from onbuild command on buildah-from --quiet
  * make --format columnizing consistent with buildah images
  * Fix option handling for volumes in build
  * Rework overlay pkg for use with libpod
  * Fix buildahimage builds for buildah
  * Add support for FIPS-Mode backends
  * Set the TMPDIR for pulling/pushing image to $TMPDIR</changelog>
  <changelog author="sgrunert@suse.com" date="1581595200">- Update to v1.14.0
  * getDateAndDigestAndSize(): use manifest.Digest
  * Touch up os/arch doc
  * chroot: handle slightly broken seccomp defaults
  * buildahimage: specify fuse-overlayfs mount options
  * parse: don't complain about not being able to rename something
    to itself
  * Fix build for 32bit platforms
  * Allow users to set OS and architecture on bud
  * Fix COPY in containerfile with envvar
  * Add --sign-by to bud/commit/push, --remove-signatures for
    pull/push
  * Add support for containers.conf
  * manifest push: add --format option</changelog>
  <changelog author="sgrunert@suse.com" date="1583323200">- Update to v1.14.2
  * Search for local runtime per values in containers.conf
  * Set correct ownership on working directory
  * Improve remote manifest retrieval
  * Correct a couple of incorrect format specifiers
  * manifest push --format: force an image type, not a list type
  * run: adjust the order in which elements are added to $
  * getDateAndDigestAndSize(): handle creation time not being set
  * Make the commit id clear like Docker
  * Show error on copied file above context directory in build
  * pull/from/commit/push: retry on most failures
  * Repair buildah so it can use containers.conf on the server side
  * Fixing formatting &amp; build instructions
  * Fix XDG_RUNTIME_DIR for authfile
  * Show validation command-line</changelog>
  <changelog author="sgrunert@suse.com" date="1585310400">- Update to v1.14.4
  * Update unshare man page to fix script example
  * Fix compilation errors on non linux platforms
  * Preserve volume uid and gid through subsequent commands
  * Fix potential CVE in tarfile w/ symlink
  * Fix .dockerignore with globs and ! commands</changelog>
  <changelog author="sgrunert@suse.com" date="1585569600">- Update to v1.14.5
  * Revert FIPS mode change</changelog>
  <changelog author="sgrunert@suse.com" date="1586174400">- Update to v1.14.6
  * Make image history work correctly with new args handling
  * Don't add args to the RUN environment from the Builder</changelog>
  <changelog author="rhafer@suse.com" date="1593000000">- Update to v1.15.0
  * Add CVE-2020-10696 to CHANGELOG.md and changelog.txt
  * fix lighttpd example
  * remove dependency on openshift struct
  * Warn on unset build arguments
  * vendor: update seccomp/containers-golang to v0.4.1
  * Updated docs
  * clean up comments
  * update exit code for tests
  * Implement commit for encryption
  * implementation of encrypt/decrypt push/pull/bud/from
  * fix resolve docker image name as transport
  * Add preliminary profiling support to the CLI
  * Evaluate symlinks in build context directory
  * fix error info about get signatures for containerImageSource
  * Add Security Policy
  * Cirrus: Fixes from review feedback
  * imagebuildah: stages shouldn't count as their base images
  * Update containers/common v0.10.0
  * Add registry to buildahimage Dockerfiles
  * Cirrus: Use pre-installed VM packages + F32
  * Cirrus: Re-enable all distro versions
  * Cirrus: Update to F31 + Use cache images
  * golangci-lint: Disable gosimple
  * Lower number of golangci-lint threads
  * Fix permissions on containers.conf
  * Don't force tests to use runc
  * Return exit code from failed containers
  * cgroup_manager should be under [engine]
  * Use c/common/pkg/auth in login/logout
  * Cirrus: Temporarily disable Ubuntu 19 testing
  * Add containers.conf to stablebyhand build
  * Update gitignore to exclude test Dockerfiles
  * Remove warning for systemd inside of container</changelog>
  <changelog author="sgrunert@suse.com" date="1596456000">- Update to v1.15.1
  * Mask over the /sys/fs/selinux in mask branch
  * chroot: do not use setgroups if it is blocked
  * chroot, run: not fail on bind mounts from /sys
  * Allow "readonly" as alias to "ro" in mount options
  * Add VFS additional image store to container
  * vendor golang.org/x/text@v0.3.3
  * Make imagebuildah.BuildOptions.Architecture/OS optional</changelog>
  <changelog author="fcastelli@suse.com" date="1601467200">- Update to v1.16.2
  * fix build on 32bit arches
  * containerImageRef.NewImageSource(): don't always force timestamps
  * Add fuse module warning to image readme
  * Heed our retry delay option values when retrying commit/pull/push
  * Switch to containers/common for seccomp
  * Use --timestamp rather then --omit-timestamp
  * docs: remove outdated notice
  * docs: remove outdated notice
  * build-using-dockerfile: add a hidden --log-rusage flag
  * build(deps): bump github.com/containers/image/v5 from 5.5.1 to 5.5.2
  * Discard ReportWriter if user sets options.Quiet
  * build(deps): bump github.com/containers/common from 0.19.0 to 0.20.3
  * Fix ownership of content copied using COPY --from
  * newTarDigester: zero out timestamps in tar headers
  * Update nix pin with `make nixpkgs`
  * bud.bats: correct .dockerignore integration tests
  * Use pipes for copying
  * run: include stdout in error message
  * run: use the correct error for errors.Wrapf
  * copier: un-export internal types
  * copier: add Mkdir()
  * in_podman: don't get tripped up by $CIRRUS_CHANGE_TITLE
  * docs/buildah-commit.md: tweak some wording, add a --rm example
  * imagebuildah: don?t blank out destination names when COPYing
  * Replace retry functions with common/pkg/retry
  * StageExecutor.historyMatches: compare timestamps using .Equal
  * Update vendor of containers/common
  * Fix errors found in coverity scan
  * Change namespace handling flags to better match podman commands
  * conformance testing: ignore buildah.BuilderIdentityAnnotation labels
  * Vendor in containers/storage v1.23.0
  * Add buildah.IsContainer interface
  * Avoid feeding run_buildah to pipe
  * fix(buildahimage): add xz dependency in buildah image
  * Bump github.com/containers/common from 0.15.2 to 0.18.0
  * Howto for rootless image building from OpenShift
  * Add --omit-timestamp flag to buildah bud
  * Update nix pin with `make nixpkgs`
  * Shutdown storage on failures
  * Handle COPY --from when an argument is used
  * Bump github.com/seccomp/containers-golang from 0.5.0 to 0.6.0
  * Cirrus: Use newly built VM images
  * Bump github.com/opencontainers/runc from 1.0.0-rc91 to 1.0.0-rc92
  * Enhance the .dockerignore man pages
  * conformance: add a test for COPY from subdirectory
  * fix  bug manifest inspct
  * Add documentation for .dockerignore
  * Add BuilderIdentityAnnotation to identify buildah version
  * DOC: Add quay.io/containers/buildah image to README.md
  * Update buildahimages readme
  * fix spelling mistake in "info" command result display
  * Don't bind /etc/host and /etc/resolv.conf if network is not present
  * blobcache: avoid an unnecessary NewImage()
  * Build static binary with `buildGoModule`
  * copier: split StripSetidBits into StripSetuidBit/StripSetgidBit/StripStickyBit
  * tarFilterer: handle multiple archives
  * Fix a race we hit during conformance tests
  * Rework conformance testing
  * Update 02-registries-repositories.md
  * test-unit: invoke cmd/buildah tests with --flags
  * parse: fix a type mismatch in a test
  * Fix compilation of tests/testreport/testreport
  * build.sh: log the version of Go that we're using
  * test-unit: increase the test timeout to 40/45 minutes
  * Add the "copier" package
  * Fix &amp; add notes regarding problematic language in codebase
  * Add dependency on github.com/stretchr/testify/require
  * CompositeDigester: add the ability to filter tar streams
  * BATS tests: make more robust
  * vendor golang.org/x/text@v0.3.3
  * Switch golang 1.12 to golang 1.13
  * imagebuildah: wait for stages that might not have even started yet
  * chroot, run: not fail on bind mounts from /sys
  * chroot: do not use setgroups if it is blocked
  * Set engine env from containers.conf
  * imagebuildah: return the right stage's image as the "final" image
  * Fix a help string
  * Deduplicate environment variables
  * switch containers/libpod to containers/podman
  * Bump github.com/containers/ocicrypt from 1.0.2 to 1.0.3
  * Bump github.com/opencontainers/selinux from 1.5.2 to 1.6.0
  * Mask out /sys/dev to prevent information leak
  * linux: skip errors from the runtime kill
  * Mask over the /sys/fs/selinux in mask branch
  * Add VFS additional image store to container
  * tests: add auth tests
  * Allow "readonly" as alias to "ro" in mount options
  * Ignore OS X specific consistency mount option
  * Bump github.com/onsi/ginkgo from 1.13.0 to 1.14.0
  * Bump github.com/containers/common from 0.14.0 to 0.15.2
  * Rootless Buildah should default to IsolationOCIRootless
  * imagebuildah: fix inheriting multi-stage builds
  * Make imagebuildah.BuildOptions.Architecture/OS optional
  * Make imagebuildah.BuildOptions.Jobs optional
  * Resolve a possible race in imagebuildah.Executor.startStage()
  * Switch scripts to use containers.conf
  * Bump openshift/imagebuilder to v1.1.6
  * Bump go.etcd.io/bbolt from 1.3.4 to 1.3.5
  * buildah, bud: support --jobs=N for parallel execution
  * executor: refactor build code inside new function
  * Add bud regression tests
  * Cirrus: Fix missing htpasswd in registry img
  * docs: clarify the 'triples' format
  * CHANGELOG.md: Fix markdown formatting
  * Add nix derivation for static builds
  * Bump to v1.16.0-dev</changelog>
  <changelog author="rhafer@suse.com" date="1604404800">- Update to v1.17.0 (bsc#1165184)
  * Handle cases where other tools mount/unmount containers
  * overlay.MountReadOnly: support RO overlay mounts
  * overlay: use fusermount for rootless umounts
  * overlay: fix umount
  * Switch default log level of Buildah to Warn. Users need to see these messages
  * Drop error messages about OCI/Docker format to Warning level
  * build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2
  * tests/testreport: adjust for API break in storage v1.23.6
  * build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7
  * build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6
  * copier: put: ignore Typeflag="g"
  * Use curl to get repo file (fix #2714)
  * build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0
  * build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1
  * Remove docs that refer to bors, since we're not using it
  * Buildah bud should not use stdin by default
  * bump containerd, docker, and golang.org/x/sys
  * Makefile: cross: remove windows.386 target
  * copier.copierHandlerPut: don't check length when there are errors
  * Stop excessive wrapping
  * CI: require that conformance tests pass
  * bump(github.com/openshift/imagebuilder) to v1.1.8
  * Skip tlsVerify insecure BUILD_REGISTRY_SOURCES
  * Fix build path wrong containers/podman#7993
  * refactor pullpolicy to avoid deps
  * build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0
  * CI: run gating tasks with a lot more memory
  * ADD and COPY: descend into excluded directories, sometimes
  * copier: add more context to a couple of error messages
  * copier: check an error earlier
  * copier: log stderr output as debug on success
  * Update nix pin with make nixpkgs
  * Set directory ownership when copied with ID mapping
  * build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0
  * build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0
  * Cirrus: Remove bors artifacts
  * Sort build flag definitions alphabetically
  * ADD: only expand archives at the right time
  * Remove configuration for bors
  * Shell Completion for podman build flags
  * Bump c/common to v0.24.0
  * New CI check: xref --help vs man pages
  * CI: re-enable several linters
  * Move --userns-uid-map/--userns-gid-map description into buildah man page
  * add: preserve ownerships and permissions on ADDed archives
  * Makefile: tweak the cross-compile target
  * Bump containers/common to v0.23.0
  * chroot: create bind mount targets 0755 instead of 0700
  * Change call to Split() to safer SplitN()
  * chroot: fix handling of errno seccomp rules
  * build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0
  * Add In Progress section to contributing
  * integration tests: make sure tests run in ${topdir}/tests
  * Run(): ignore containers.conf's environment configuration
  * Warn when setting healthcheck in OCI format
  * Cirrus: Skip git-validate on branches
  * tools: update git-validation to the latest commit
  * tools: update golangci-lint to v1.18.0
  * Add a few tests of push command
  * Add(): fix handling of relative paths with no ContextDir
  * build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0
  * Lint: Use same linters as podman
  * Validate: reference HEAD
  * Fix buildah mount to display container names not ids
  * Update nix pin with make nixpkgs
  * Add missing --format option in buildah from man page
  * Fix up code based on codespell
  * build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7
  * build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5
  * Improve buildah completions
  * Cirrus: Fix validate commit epoch
  * Fix bash completion of manifest flags
  * Uniform some man pages
  * Update Buildah Tutorial to address BZ1867426
  * Update bash completion of manifest add sub command
  * copier.Get(): hard link targets shouldn't be relative paths
  * build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2
  * Pass timestamp down to history lines
  * Timestamp gets updated everytime you inspect an image
  * bud.bats: use absolute paths in newly-added tests
  * contrib/cirrus/lib.sh: don't use CN for the hostname
  * tests: Add some tests
  * Update manifest add man page
  * Extend flags of manifest add
  * build(deps): bump github.com/containers/storage from 1.23.3 to 1.23.4
  * build(deps): bump github.com/onsi/ginkgo from 1.14.0 to 1.14.1
  * Bump to v1.17.0-dev
  * CI: expand cross-compile checks
- SLE: Remove unneeded patch: CVE-2019-10214.patch</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- buildah required cni (bsc#1187812)</changelog>
</package>
<package pkgid="f69373bcc52b5c9f75587e5f5b28a8d5a1dc0edbd92d32ddb8518693ff0d1293" name="buildah" arch="ppc64le">
  <version epoch="0" ver="1.17.0" rel="3.9.1"/>
  <changelog author="sgrunert@suse.com" date="1567425600">- Add patch for CVE-2019-10214. bsc#1144065
  + CVE-2019-10214.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1567684800">- Update to v1.11.0
  * Add --digestfile and Re-add push statement as debug
  * Add --log-level command line option and deprecate --debug
  * Add security-related volume options to validator
  * Allow buildah bud to be called without arguments
  * Allow to override build date with SOURCE_DATE_EPOCH
  * Correctly detect ExitError values from Run()
  * Disable empty logrus timestamps to reduce logger noise
  * Fix directory pull image names
  * Fix handling of /dev/null masked devices
  * Fix possible runtime panic on bud
  * Update bud/from help to contain indicator for --dns=none
  * Update documentation about bud
  * Update shebangs to take env into consideration
  * Use content digests in ADD/COPY history entries
  * add support for cgroupsV2
  * add: add a DryRun flag to AddAndCopyOptions
  * add: handle hard links when copying with .dockerignore
  * add: teach copyFileWithTar() about symlinks and directories
  * imagebuilder: fix detection of referenced stage roots
  * pull/commit/push: pay attention to $BUILD_REGISTRY_SOURCES
  * run_linux: fix mounting /sys in a userns
- Remove hardly set build tags in favor of the Makefile</changelog>
  <changelog author="sgrunert@suse.com" date="1568376000">- Update to v1.11.1
  * Add --devices flag to bud and from
  * Add support for /run/.containerenv
  * Allow mounts.conf entries for equal source and destination paths
  * Fix label and annotation for 1-line Dockerfiles
  * Preserve file and directory mount permissions
  * Replace --debug=false with --log-level=error
  * Set TMPDIR to /var/tmp by default
  * Truncate output of too long image names
  * Ignore EmptyLayer if Squash is set</changelog>
  <changelog author="rbrown@suse.com" date="1569240000">- Update to v1.11.2
  * Add some cleanup code
  * Move devices code to unit specific directory.</changelog>
  <changelog author="sgrunert@suse.com" date="1570449600">- Update to v1.11.3
  * Add cgroups2
  * Add support for retrieving context from stdin "-"
  * Added tutorial on how to include Buildah as library
  * Fix --build-args handling
  * Print build 'STEP' line to stdout, not stderr
  * Use Containerfile by default</changelog>
  <changelog author="sgrunert@suse.com" date="1572350400">- Update to v1.11.4
  * buildah: add a "manifest" command
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1573560000">- Update to v1.11.5
  * buildah: add "manifest" command
  * pkg/supplemented: add a package for grouping images together
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * version: also note the version of containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1575547200">- Update to v1.11.6
  * Handle missing equal sign in --from and --chown flags
    for COPY/ADD
  * bud COPY does not download URL
  * Fix .dockerignore exclude regression
  * commit(docker): always set ContainerID and ContainerConfig
  * Touch up commit man page image parameter
  * Add builder identity annotations.</changelog>
  <changelog author="sgrunert@suse.com" date="1576497600">- Update to v1.12.0
  * Allow ADD to use http src
  * imgtype: reset storage opts if driver overridden
  * Start using containers/common
  * overlay.bats typo: fuse-overlays should be fuse-overlayfs
  * chroot: Unmount with MNT_DETACH instead of UnmountMountpoints()
  * bind: don't complain about missing mountpoints
  * imgtype: check earlier for expected manifest type
  * Add history names support</changelog>
  <changelog author="sgrunert@suse.com" date="1579089600">- Update to v1.13.1
  * copyFileWithTar: close source files at the right time
  * copy: don't digest files that we ignore
  * Check for .dockerignore specifically
  * Don't setup excludes, if their is only one pattern to match
  * set HOME env to /root on chroot-isolation by default
  * docs: fix references to containers-*.5
  * fix bug Add check .dockerignore COPY file
  * buildah bud --volume: run from tmpdir, not source dir
  * Fix imageNamePrefix to give consistent names in buildah-from
  * cpp: use -traditional and -undef flags
  * discard outputs coming from onbuild command on buildah-from --quiet
  * make --format columnizing consistent with buildah images
  * Fix option handling for volumes in build
  * Rework overlay pkg for use with libpod
  * Fix buildahimage builds for buildah
  * Add support for FIPS-Mode backends
  * Set the TMPDIR for pulling/pushing image to $TMPDIR</changelog>
  <changelog author="sgrunert@suse.com" date="1581595200">- Update to v1.14.0
  * getDateAndDigestAndSize(): use manifest.Digest
  * Touch up os/arch doc
  * chroot: handle slightly broken seccomp defaults
  * buildahimage: specify fuse-overlayfs mount options
  * parse: don't complain about not being able to rename something
    to itself
  * Fix build for 32bit platforms
  * Allow users to set OS and architecture on bud
  * Fix COPY in containerfile with envvar
  * Add --sign-by to bud/commit/push, --remove-signatures for
    pull/push
  * Add support for containers.conf
  * manifest push: add --format option</changelog>
  <changelog author="sgrunert@suse.com" date="1583323200">- Update to v1.14.2
  * Search for local runtime per values in containers.conf
  * Set correct ownership on working directory
  * Improve remote manifest retrieval
  * Correct a couple of incorrect format specifiers
  * manifest push --format: force an image type, not a list type
  * run: adjust the order in which elements are added to $
  * getDateAndDigestAndSize(): handle creation time not being set
  * Make the commit id clear like Docker
  * Show error on copied file above context directory in build
  * pull/from/commit/push: retry on most failures
  * Repair buildah so it can use containers.conf on the server side
  * Fixing formatting &amp; build instructions
  * Fix XDG_RUNTIME_DIR for authfile
  * Show validation command-line</changelog>
  <changelog author="sgrunert@suse.com" date="1585310400">- Update to v1.14.4
  * Update unshare man page to fix script example
  * Fix compilation errors on non linux platforms
  * Preserve volume uid and gid through subsequent commands
  * Fix potential CVE in tarfile w/ symlink
  * Fix .dockerignore with globs and ! commands</changelog>
  <changelog author="sgrunert@suse.com" date="1585569600">- Update to v1.14.5
  * Revert FIPS mode change</changelog>
  <changelog author="sgrunert@suse.com" date="1586174400">- Update to v1.14.6
  * Make image history work correctly with new args handling
  * Don't add args to the RUN environment from the Builder</changelog>
  <changelog author="rhafer@suse.com" date="1593000000">- Update to v1.15.0
  * Add CVE-2020-10696 to CHANGELOG.md and changelog.txt
  * fix lighttpd example
  * remove dependency on openshift struct
  * Warn on unset build arguments
  * vendor: update seccomp/containers-golang to v0.4.1
  * Updated docs
  * clean up comments
  * update exit code for tests
  * Implement commit for encryption
  * implementation of encrypt/decrypt push/pull/bud/from
  * fix resolve docker image name as transport
  * Add preliminary profiling support to the CLI
  * Evaluate symlinks in build context directory
  * fix error info about get signatures for containerImageSource
  * Add Security Policy
  * Cirrus: Fixes from review feedback
  * imagebuildah: stages shouldn't count as their base images
  * Update containers/common v0.10.0
  * Add registry to buildahimage Dockerfiles
  * Cirrus: Use pre-installed VM packages + F32
  * Cirrus: Re-enable all distro versions
  * Cirrus: Update to F31 + Use cache images
  * golangci-lint: Disable gosimple
  * Lower number of golangci-lint threads
  * Fix permissions on containers.conf
  * Don't force tests to use runc
  * Return exit code from failed containers
  * cgroup_manager should be under [engine]
  * Use c/common/pkg/auth in login/logout
  * Cirrus: Temporarily disable Ubuntu 19 testing
  * Add containers.conf to stablebyhand build
  * Update gitignore to exclude test Dockerfiles
  * Remove warning for systemd inside of container</changelog>
  <changelog author="sgrunert@suse.com" date="1596456000">- Update to v1.15.1
  * Mask over the /sys/fs/selinux in mask branch
  * chroot: do not use setgroups if it is blocked
  * chroot, run: not fail on bind mounts from /sys
  * Allow "readonly" as alias to "ro" in mount options
  * Add VFS additional image store to container
  * vendor golang.org/x/text@v0.3.3
  * Make imagebuildah.BuildOptions.Architecture/OS optional</changelog>
  <changelog author="fcastelli@suse.com" date="1601467200">- Update to v1.16.2
  * fix build on 32bit arches
  * containerImageRef.NewImageSource(): don't always force timestamps
  * Add fuse module warning to image readme
  * Heed our retry delay option values when retrying commit/pull/push
  * Switch to containers/common for seccomp
  * Use --timestamp rather then --omit-timestamp
  * docs: remove outdated notice
  * docs: remove outdated notice
  * build-using-dockerfile: add a hidden --log-rusage flag
  * build(deps): bump github.com/containers/image/v5 from 5.5.1 to 5.5.2
  * Discard ReportWriter if user sets options.Quiet
  * build(deps): bump github.com/containers/common from 0.19.0 to 0.20.3
  * Fix ownership of content copied using COPY --from
  * newTarDigester: zero out timestamps in tar headers
  * Update nix pin with `make nixpkgs`
  * bud.bats: correct .dockerignore integration tests
  * Use pipes for copying
  * run: include stdout in error message
  * run: use the correct error for errors.Wrapf
  * copier: un-export internal types
  * copier: add Mkdir()
  * in_podman: don't get tripped up by $CIRRUS_CHANGE_TITLE
  * docs/buildah-commit.md: tweak some wording, add a --rm example
  * imagebuildah: don?t blank out destination names when COPYing
  * Replace retry functions with common/pkg/retry
  * StageExecutor.historyMatches: compare timestamps using .Equal
  * Update vendor of containers/common
  * Fix errors found in coverity scan
  * Change namespace handling flags to better match podman commands
  * conformance testing: ignore buildah.BuilderIdentityAnnotation labels
  * Vendor in containers/storage v1.23.0
  * Add buildah.IsContainer interface
  * Avoid feeding run_buildah to pipe
  * fix(buildahimage): add xz dependency in buildah image
  * Bump github.com/containers/common from 0.15.2 to 0.18.0
  * Howto for rootless image building from OpenShift
  * Add --omit-timestamp flag to buildah bud
  * Update nix pin with `make nixpkgs`
  * Shutdown storage on failures
  * Handle COPY --from when an argument is used
  * Bump github.com/seccomp/containers-golang from 0.5.0 to 0.6.0
  * Cirrus: Use newly built VM images
  * Bump github.com/opencontainers/runc from 1.0.0-rc91 to 1.0.0-rc92
  * Enhance the .dockerignore man pages
  * conformance: add a test for COPY from subdirectory
  * fix  bug manifest inspct
  * Add documentation for .dockerignore
  * Add BuilderIdentityAnnotation to identify buildah version
  * DOC: Add quay.io/containers/buildah image to README.md
  * Update buildahimages readme
  * fix spelling mistake in "info" command result display
  * Don't bind /etc/host and /etc/resolv.conf if network is not present
  * blobcache: avoid an unnecessary NewImage()
  * Build static binary with `buildGoModule`
  * copier: split StripSetidBits into StripSetuidBit/StripSetgidBit/StripStickyBit
  * tarFilterer: handle multiple archives
  * Fix a race we hit during conformance tests
  * Rework conformance testing
  * Update 02-registries-repositories.md
  * test-unit: invoke cmd/buildah tests with --flags
  * parse: fix a type mismatch in a test
  * Fix compilation of tests/testreport/testreport
  * build.sh: log the version of Go that we're using
  * test-unit: increase the test timeout to 40/45 minutes
  * Add the "copier" package
  * Fix &amp; add notes regarding problematic language in codebase
  * Add dependency on github.com/stretchr/testify/require
  * CompositeDigester: add the ability to filter tar streams
  * BATS tests: make more robust
  * vendor golang.org/x/text@v0.3.3
  * Switch golang 1.12 to golang 1.13
  * imagebuildah: wait for stages that might not have even started yet
  * chroot, run: not fail on bind mounts from /sys
  * chroot: do not use setgroups if it is blocked
  * Set engine env from containers.conf
  * imagebuildah: return the right stage's image as the "final" image
  * Fix a help string
  * Deduplicate environment variables
  * switch containers/libpod to containers/podman
  * Bump github.com/containers/ocicrypt from 1.0.2 to 1.0.3
  * Bump github.com/opencontainers/selinux from 1.5.2 to 1.6.0
  * Mask out /sys/dev to prevent information leak
  * linux: skip errors from the runtime kill
  * Mask over the /sys/fs/selinux in mask branch
  * Add VFS additional image store to container
  * tests: add auth tests
  * Allow "readonly" as alias to "ro" in mount options
  * Ignore OS X specific consistency mount option
  * Bump github.com/onsi/ginkgo from 1.13.0 to 1.14.0
  * Bump github.com/containers/common from 0.14.0 to 0.15.2
  * Rootless Buildah should default to IsolationOCIRootless
  * imagebuildah: fix inheriting multi-stage builds
  * Make imagebuildah.BuildOptions.Architecture/OS optional
  * Make imagebuildah.BuildOptions.Jobs optional
  * Resolve a possible race in imagebuildah.Executor.startStage()
  * Switch scripts to use containers.conf
  * Bump openshift/imagebuilder to v1.1.6
  * Bump go.etcd.io/bbolt from 1.3.4 to 1.3.5
  * buildah, bud: support --jobs=N for parallel execution
  * executor: refactor build code inside new function
  * Add bud regression tests
  * Cirrus: Fix missing htpasswd in registry img
  * docs: clarify the 'triples' format
  * CHANGELOG.md: Fix markdown formatting
  * Add nix derivation for static builds
  * Bump to v1.16.0-dev</changelog>
  <changelog author="rhafer@suse.com" date="1604404800">- Update to v1.17.0 (bsc#1165184)
  * Handle cases where other tools mount/unmount containers
  * overlay.MountReadOnly: support RO overlay mounts
  * overlay: use fusermount for rootless umounts
  * overlay: fix umount
  * Switch default log level of Buildah to Warn. Users need to see these messages
  * Drop error messages about OCI/Docker format to Warning level
  * build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2
  * tests/testreport: adjust for API break in storage v1.23.6
  * build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7
  * build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6
  * copier: put: ignore Typeflag="g"
  * Use curl to get repo file (fix #2714)
  * build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0
  * build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1
  * Remove docs that refer to bors, since we're not using it
  * Buildah bud should not use stdin by default
  * bump containerd, docker, and golang.org/x/sys
  * Makefile: cross: remove windows.386 target
  * copier.copierHandlerPut: don't check length when there are errors
  * Stop excessive wrapping
  * CI: require that conformance tests pass
  * bump(github.com/openshift/imagebuilder) to v1.1.8
  * Skip tlsVerify insecure BUILD_REGISTRY_SOURCES
  * Fix build path wrong containers/podman#7993
  * refactor pullpolicy to avoid deps
  * build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0
  * CI: run gating tasks with a lot more memory
  * ADD and COPY: descend into excluded directories, sometimes
  * copier: add more context to a couple of error messages
  * copier: check an error earlier
  * copier: log stderr output as debug on success
  * Update nix pin with make nixpkgs
  * Set directory ownership when copied with ID mapping
  * build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0
  * build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0
  * Cirrus: Remove bors artifacts
  * Sort build flag definitions alphabetically
  * ADD: only expand archives at the right time
  * Remove configuration for bors
  * Shell Completion for podman build flags
  * Bump c/common to v0.24.0
  * New CI check: xref --help vs man pages
  * CI: re-enable several linters
  * Move --userns-uid-map/--userns-gid-map description into buildah man page
  * add: preserve ownerships and permissions on ADDed archives
  * Makefile: tweak the cross-compile target
  * Bump containers/common to v0.23.0
  * chroot: create bind mount targets 0755 instead of 0700
  * Change call to Split() to safer SplitN()
  * chroot: fix handling of errno seccomp rules
  * build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0
  * Add In Progress section to contributing
  * integration tests: make sure tests run in ${topdir}/tests
  * Run(): ignore containers.conf's environment configuration
  * Warn when setting healthcheck in OCI format
  * Cirrus: Skip git-validate on branches
  * tools: update git-validation to the latest commit
  * tools: update golangci-lint to v1.18.0
  * Add a few tests of push command
  * Add(): fix handling of relative paths with no ContextDir
  * build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0
  * Lint: Use same linters as podman
  * Validate: reference HEAD
  * Fix buildah mount to display container names not ids
  * Update nix pin with make nixpkgs
  * Add missing --format option in buildah from man page
  * Fix up code based on codespell
  * build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7
  * build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5
  * Improve buildah completions
  * Cirrus: Fix validate commit epoch
  * Fix bash completion of manifest flags
  * Uniform some man pages
  * Update Buildah Tutorial to address BZ1867426
  * Update bash completion of manifest add sub command
  * copier.Get(): hard link targets shouldn't be relative paths
  * build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2
  * Pass timestamp down to history lines
  * Timestamp gets updated everytime you inspect an image
  * bud.bats: use absolute paths in newly-added tests
  * contrib/cirrus/lib.sh: don't use CN for the hostname
  * tests: Add some tests
  * Update manifest add man page
  * Extend flags of manifest add
  * build(deps): bump github.com/containers/storage from 1.23.3 to 1.23.4
  * build(deps): bump github.com/onsi/ginkgo from 1.14.0 to 1.14.1
  * Bump to v1.17.0-dev
  * CI: expand cross-compile checks
- SLE: Remove unneeded patch: CVE-2019-10214.patch</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- buildah required cni (bsc#1187812)</changelog>
</package>
<package pkgid="1b7a4aef786465b5823231322e227b1c28e82526c04f927aac097aaf32e3e925" name="buildah" arch="s390x">
  <version epoch="0" ver="1.17.0" rel="3.9.1"/>
  <changelog author="sgrunert@suse.com" date="1567425600">- Add patch for CVE-2019-10214. bsc#1144065
  + CVE-2019-10214.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1567684800">- Update to v1.11.0
  * Add --digestfile and Re-add push statement as debug
  * Add --log-level command line option and deprecate --debug
  * Add security-related volume options to validator
  * Allow buildah bud to be called without arguments
  * Allow to override build date with SOURCE_DATE_EPOCH
  * Correctly detect ExitError values from Run()
  * Disable empty logrus timestamps to reduce logger noise
  * Fix directory pull image names
  * Fix handling of /dev/null masked devices
  * Fix possible runtime panic on bud
  * Update bud/from help to contain indicator for --dns=none
  * Update documentation about bud
  * Update shebangs to take env into consideration
  * Use content digests in ADD/COPY history entries
  * add support for cgroupsV2
  * add: add a DryRun flag to AddAndCopyOptions
  * add: handle hard links when copying with .dockerignore
  * add: teach copyFileWithTar() about symlinks and directories
  * imagebuilder: fix detection of referenced stage roots
  * pull/commit/push: pay attention to $BUILD_REGISTRY_SOURCES
  * run_linux: fix mounting /sys in a userns
- Remove hardly set build tags in favor of the Makefile</changelog>
  <changelog author="sgrunert@suse.com" date="1568376000">- Update to v1.11.1
  * Add --devices flag to bud and from
  * Add support for /run/.containerenv
  * Allow mounts.conf entries for equal source and destination paths
  * Fix label and annotation for 1-line Dockerfiles
  * Preserve file and directory mount permissions
  * Replace --debug=false with --log-level=error
  * Set TMPDIR to /var/tmp by default
  * Truncate output of too long image names
  * Ignore EmptyLayer if Squash is set</changelog>
  <changelog author="rbrown@suse.com" date="1569240000">- Update to v1.11.2
  * Add some cleanup code
  * Move devices code to unit specific directory.</changelog>
  <changelog author="sgrunert@suse.com" date="1570449600">- Update to v1.11.3
  * Add cgroups2
  * Add support for retrieving context from stdin "-"
  * Added tutorial on how to include Buildah as library
  * Fix --build-args handling
  * Print build 'STEP' line to stdout, not stderr
  * Use Containerfile by default</changelog>
  <changelog author="sgrunert@suse.com" date="1572350400">- Update to v1.11.4
  * buildah: add a "manifest" command
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1573560000">- Update to v1.11.5
  * buildah: add "manifest" command
  * pkg/supplemented: add a package for grouping images together
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * version: also note the version of containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1575547200">- Update to v1.11.6
  * Handle missing equal sign in --from and --chown flags
    for COPY/ADD
  * bud COPY does not download URL
  * Fix .dockerignore exclude regression
  * commit(docker): always set ContainerID and ContainerConfig
  * Touch up commit man page image parameter
  * Add builder identity annotations.</changelog>
  <changelog author="sgrunert@suse.com" date="1576497600">- Update to v1.12.0
  * Allow ADD to use http src
  * imgtype: reset storage opts if driver overridden
  * Start using containers/common
  * overlay.bats typo: fuse-overlays should be fuse-overlayfs
  * chroot: Unmount with MNT_DETACH instead of UnmountMountpoints()
  * bind: don't complain about missing mountpoints
  * imgtype: check earlier for expected manifest type
  * Add history names support</changelog>
  <changelog author="sgrunert@suse.com" date="1579089600">- Update to v1.13.1
  * copyFileWithTar: close source files at the right time
  * copy: don't digest files that we ignore
  * Check for .dockerignore specifically
  * Don't setup excludes, if their is only one pattern to match
  * set HOME env to /root on chroot-isolation by default
  * docs: fix references to containers-*.5
  * fix bug Add check .dockerignore COPY file
  * buildah bud --volume: run from tmpdir, not source dir
  * Fix imageNamePrefix to give consistent names in buildah-from
  * cpp: use -traditional and -undef flags
  * discard outputs coming from onbuild command on buildah-from --quiet
  * make --format columnizing consistent with buildah images
  * Fix option handling for volumes in build
  * Rework overlay pkg for use with libpod
  * Fix buildahimage builds for buildah
  * Add support for FIPS-Mode backends
  * Set the TMPDIR for pulling/pushing image to $TMPDIR</changelog>
  <changelog author="sgrunert@suse.com" date="1581595200">- Update to v1.14.0
  * getDateAndDigestAndSize(): use manifest.Digest
  * Touch up os/arch doc
  * chroot: handle slightly broken seccomp defaults
  * buildahimage: specify fuse-overlayfs mount options
  * parse: don't complain about not being able to rename something
    to itself
  * Fix build for 32bit platforms
  * Allow users to set OS and architecture on bud
  * Fix COPY in containerfile with envvar
  * Add --sign-by to bud/commit/push, --remove-signatures for
    pull/push
  * Add support for containers.conf
  * manifest push: add --format option</changelog>
  <changelog author="sgrunert@suse.com" date="1583323200">- Update to v1.14.2
  * Search for local runtime per values in containers.conf
  * Set correct ownership on working directory
  * Improve remote manifest retrieval
  * Correct a couple of incorrect format specifiers
  * manifest push --format: force an image type, not a list type
  * run: adjust the order in which elements are added to $
  * getDateAndDigestAndSize(): handle creation time not being set
  * Make the commit id clear like Docker
  * Show error on copied file above context directory in build
  * pull/from/commit/push: retry on most failures
  * Repair buildah so it can use containers.conf on the server side
  * Fixing formatting &amp; build instructions
  * Fix XDG_RUNTIME_DIR for authfile
  * Show validation command-line</changelog>
  <changelog author="sgrunert@suse.com" date="1585310400">- Update to v1.14.4
  * Update unshare man page to fix script example
  * Fix compilation errors on non linux platforms
  * Preserve volume uid and gid through subsequent commands
  * Fix potential CVE in tarfile w/ symlink
  * Fix .dockerignore with globs and ! commands</changelog>
  <changelog author="sgrunert@suse.com" date="1585569600">- Update to v1.14.5
  * Revert FIPS mode change</changelog>
  <changelog author="sgrunert@suse.com" date="1586174400">- Update to v1.14.6
  * Make image history work correctly with new args handling
  * Don't add args to the RUN environment from the Builder</changelog>
  <changelog author="rhafer@suse.com" date="1593000000">- Update to v1.15.0
  * Add CVE-2020-10696 to CHANGELOG.md and changelog.txt
  * fix lighttpd example
  * remove dependency on openshift struct
  * Warn on unset build arguments
  * vendor: update seccomp/containers-golang to v0.4.1
  * Updated docs
  * clean up comments
  * update exit code for tests
  * Implement commit for encryption
  * implementation of encrypt/decrypt push/pull/bud/from
  * fix resolve docker image name as transport
  * Add preliminary profiling support to the CLI
  * Evaluate symlinks in build context directory
  * fix error info about get signatures for containerImageSource
  * Add Security Policy
  * Cirrus: Fixes from review feedback
  * imagebuildah: stages shouldn't count as their base images
  * Update containers/common v0.10.0
  * Add registry to buildahimage Dockerfiles
  * Cirrus: Use pre-installed VM packages + F32
  * Cirrus: Re-enable all distro versions
  * Cirrus: Update to F31 + Use cache images
  * golangci-lint: Disable gosimple
  * Lower number of golangci-lint threads
  * Fix permissions on containers.conf
  * Don't force tests to use runc
  * Return exit code from failed containers
  * cgroup_manager should be under [engine]
  * Use c/common/pkg/auth in login/logout
  * Cirrus: Temporarily disable Ubuntu 19 testing
  * Add containers.conf to stablebyhand build
  * Update gitignore to exclude test Dockerfiles
  * Remove warning for systemd inside of container</changelog>
  <changelog author="sgrunert@suse.com" date="1596456000">- Update to v1.15.1
  * Mask over the /sys/fs/selinux in mask branch
  * chroot: do not use setgroups if it is blocked
  * chroot, run: not fail on bind mounts from /sys
  * Allow "readonly" as alias to "ro" in mount options
  * Add VFS additional image store to container
  * vendor golang.org/x/text@v0.3.3
  * Make imagebuildah.BuildOptions.Architecture/OS optional</changelog>
  <changelog author="fcastelli@suse.com" date="1601467200">- Update to v1.16.2
  * fix build on 32bit arches
  * containerImageRef.NewImageSource(): don't always force timestamps
  * Add fuse module warning to image readme
  * Heed our retry delay option values when retrying commit/pull/push
  * Switch to containers/common for seccomp
  * Use --timestamp rather then --omit-timestamp
  * docs: remove outdated notice
  * docs: remove outdated notice
  * build-using-dockerfile: add a hidden --log-rusage flag
  * build(deps): bump github.com/containers/image/v5 from 5.5.1 to 5.5.2
  * Discard ReportWriter if user sets options.Quiet
  * build(deps): bump github.com/containers/common from 0.19.0 to 0.20.3
  * Fix ownership of content copied using COPY --from
  * newTarDigester: zero out timestamps in tar headers
  * Update nix pin with `make nixpkgs`
  * bud.bats: correct .dockerignore integration tests
  * Use pipes for copying
  * run: include stdout in error message
  * run: use the correct error for errors.Wrapf
  * copier: un-export internal types
  * copier: add Mkdir()
  * in_podman: don't get tripped up by $CIRRUS_CHANGE_TITLE
  * docs/buildah-commit.md: tweak some wording, add a --rm example
  * imagebuildah: don?t blank out destination names when COPYing
  * Replace retry functions with common/pkg/retry
  * StageExecutor.historyMatches: compare timestamps using .Equal
  * Update vendor of containers/common
  * Fix errors found in coverity scan
  * Change namespace handling flags to better match podman commands
  * conformance testing: ignore buildah.BuilderIdentityAnnotation labels
  * Vendor in containers/storage v1.23.0
  * Add buildah.IsContainer interface
  * Avoid feeding run_buildah to pipe
  * fix(buildahimage): add xz dependency in buildah image
  * Bump github.com/containers/common from 0.15.2 to 0.18.0
  * Howto for rootless image building from OpenShift
  * Add --omit-timestamp flag to buildah bud
  * Update nix pin with `make nixpkgs`
  * Shutdown storage on failures
  * Handle COPY --from when an argument is used
  * Bump github.com/seccomp/containers-golang from 0.5.0 to 0.6.0
  * Cirrus: Use newly built VM images
  * Bump github.com/opencontainers/runc from 1.0.0-rc91 to 1.0.0-rc92
  * Enhance the .dockerignore man pages
  * conformance: add a test for COPY from subdirectory
  * fix  bug manifest inspct
  * Add documentation for .dockerignore
  * Add BuilderIdentityAnnotation to identify buildah version
  * DOC: Add quay.io/containers/buildah image to README.md
  * Update buildahimages readme
  * fix spelling mistake in "info" command result display
  * Don't bind /etc/host and /etc/resolv.conf if network is not present
  * blobcache: avoid an unnecessary NewImage()
  * Build static binary with `buildGoModule`
  * copier: split StripSetidBits into StripSetuidBit/StripSetgidBit/StripStickyBit
  * tarFilterer: handle multiple archives
  * Fix a race we hit during conformance tests
  * Rework conformance testing
  * Update 02-registries-repositories.md
  * test-unit: invoke cmd/buildah tests with --flags
  * parse: fix a type mismatch in a test
  * Fix compilation of tests/testreport/testreport
  * build.sh: log the version of Go that we're using
  * test-unit: increase the test timeout to 40/45 minutes
  * Add the "copier" package
  * Fix &amp; add notes regarding problematic language in codebase
  * Add dependency on github.com/stretchr/testify/require
  * CompositeDigester: add the ability to filter tar streams
  * BATS tests: make more robust
  * vendor golang.org/x/text@v0.3.3
  * Switch golang 1.12 to golang 1.13
  * imagebuildah: wait for stages that might not have even started yet
  * chroot, run: not fail on bind mounts from /sys
  * chroot: do not use setgroups if it is blocked
  * Set engine env from containers.conf
  * imagebuildah: return the right stage's image as the "final" image
  * Fix a help string
  * Deduplicate environment variables
  * switch containers/libpod to containers/podman
  * Bump github.com/containers/ocicrypt from 1.0.2 to 1.0.3
  * Bump github.com/opencontainers/selinux from 1.5.2 to 1.6.0
  * Mask out /sys/dev to prevent information leak
  * linux: skip errors from the runtime kill
  * Mask over the /sys/fs/selinux in mask branch
  * Add VFS additional image store to container
  * tests: add auth tests
  * Allow "readonly" as alias to "ro" in mount options
  * Ignore OS X specific consistency mount option
  * Bump github.com/onsi/ginkgo from 1.13.0 to 1.14.0
  * Bump github.com/containers/common from 0.14.0 to 0.15.2
  * Rootless Buildah should default to IsolationOCIRootless
  * imagebuildah: fix inheriting multi-stage builds
  * Make imagebuildah.BuildOptions.Architecture/OS optional
  * Make imagebuildah.BuildOptions.Jobs optional
  * Resolve a possible race in imagebuildah.Executor.startStage()
  * Switch scripts to use containers.conf
  * Bump openshift/imagebuilder to v1.1.6
  * Bump go.etcd.io/bbolt from 1.3.4 to 1.3.5
  * buildah, bud: support --jobs=N for parallel execution
  * executor: refactor build code inside new function
  * Add bud regression tests
  * Cirrus: Fix missing htpasswd in registry img
  * docs: clarify the 'triples' format
  * CHANGELOG.md: Fix markdown formatting
  * Add nix derivation for static builds
  * Bump to v1.16.0-dev</changelog>
  <changelog author="rhafer@suse.com" date="1604404800">- Update to v1.17.0 (bsc#1165184)
  * Handle cases where other tools mount/unmount containers
  * overlay.MountReadOnly: support RO overlay mounts
  * overlay: use fusermount for rootless umounts
  * overlay: fix umount
  * Switch default log level of Buildah to Warn. Users need to see these messages
  * Drop error messages about OCI/Docker format to Warning level
  * build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2
  * tests/testreport: adjust for API break in storage v1.23.6
  * build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7
  * build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6
  * copier: put: ignore Typeflag="g"
  * Use curl to get repo file (fix #2714)
  * build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0
  * build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1
  * Remove docs that refer to bors, since we're not using it
  * Buildah bud should not use stdin by default
  * bump containerd, docker, and golang.org/x/sys
  * Makefile: cross: remove windows.386 target
  * copier.copierHandlerPut: don't check length when there are errors
  * Stop excessive wrapping
  * CI: require that conformance tests pass
  * bump(github.com/openshift/imagebuilder) to v1.1.8
  * Skip tlsVerify insecure BUILD_REGISTRY_SOURCES
  * Fix build path wrong containers/podman#7993
  * refactor pullpolicy to avoid deps
  * build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0
  * CI: run gating tasks with a lot more memory
  * ADD and COPY: descend into excluded directories, sometimes
  * copier: add more context to a couple of error messages
  * copier: check an error earlier
  * copier: log stderr output as debug on success
  * Update nix pin with make nixpkgs
  * Set directory ownership when copied with ID mapping
  * build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0
  * build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0
  * Cirrus: Remove bors artifacts
  * Sort build flag definitions alphabetically
  * ADD: only expand archives at the right time
  * Remove configuration for bors
  * Shell Completion for podman build flags
  * Bump c/common to v0.24.0
  * New CI check: xref --help vs man pages
  * CI: re-enable several linters
  * Move --userns-uid-map/--userns-gid-map description into buildah man page
  * add: preserve ownerships and permissions on ADDed archives
  * Makefile: tweak the cross-compile target
  * Bump containers/common to v0.23.0
  * chroot: create bind mount targets 0755 instead of 0700
  * Change call to Split() to safer SplitN()
  * chroot: fix handling of errno seccomp rules
  * build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0
  * Add In Progress section to contributing
  * integration tests: make sure tests run in ${topdir}/tests
  * Run(): ignore containers.conf's environment configuration
  * Warn when setting healthcheck in OCI format
  * Cirrus: Skip git-validate on branches
  * tools: update git-validation to the latest commit
  * tools: update golangci-lint to v1.18.0
  * Add a few tests of push command
  * Add(): fix handling of relative paths with no ContextDir
  * build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0
  * Lint: Use same linters as podman
  * Validate: reference HEAD
  * Fix buildah mount to display container names not ids
  * Update nix pin with make nixpkgs
  * Add missing --format option in buildah from man page
  * Fix up code based on codespell
  * build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7
  * build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5
  * Improve buildah completions
  * Cirrus: Fix validate commit epoch
  * Fix bash completion of manifest flags
  * Uniform some man pages
  * Update Buildah Tutorial to address BZ1867426
  * Update bash completion of manifest add sub command
  * copier.Get(): hard link targets shouldn't be relative paths
  * build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2
  * Pass timestamp down to history lines
  * Timestamp gets updated everytime you inspect an image
  * bud.bats: use absolute paths in newly-added tests
  * contrib/cirrus/lib.sh: don't use CN for the hostname
  * tests: Add some tests
  * Update manifest add man page
  * Extend flags of manifest add
  * build(deps): bump github.com/containers/storage from 1.23.3 to 1.23.4
  * build(deps): bump github.com/onsi/ginkgo from 1.14.0 to 1.14.1
  * Bump to v1.17.0-dev
  * CI: expand cross-compile checks
- SLE: Remove unneeded patch: CVE-2019-10214.patch</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- buildah required cni (bsc#1187812)</changelog>
</package>
<package pkgid="d2270bfb4c5548fcdad6e224c569096e8f40ebd58d5572f867f2726d02c8d79f" name="buildah" arch="src">
  <version epoch="0" ver="1.17.0" rel="3.9.1"/>
  <changelog author="sgrunert@suse.com" date="1567425600">- Add patch for CVE-2019-10214. bsc#1144065
  + CVE-2019-10214.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1567684800">- Update to v1.11.0
  * Add --digestfile and Re-add push statement as debug
  * Add --log-level command line option and deprecate --debug
  * Add security-related volume options to validator
  * Allow buildah bud to be called without arguments
  * Allow to override build date with SOURCE_DATE_EPOCH
  * Correctly detect ExitError values from Run()
  * Disable empty logrus timestamps to reduce logger noise
  * Fix directory pull image names
  * Fix handling of /dev/null masked devices
  * Fix possible runtime panic on bud
  * Update bud/from help to contain indicator for --dns=none
  * Update documentation about bud
  * Update shebangs to take env into consideration
  * Use content digests in ADD/COPY history entries
  * add support for cgroupsV2
  * add: add a DryRun flag to AddAndCopyOptions
  * add: handle hard links when copying with .dockerignore
  * add: teach copyFileWithTar() about symlinks and directories
  * imagebuilder: fix detection of referenced stage roots
  * pull/commit/push: pay attention to $BUILD_REGISTRY_SOURCES
  * run_linux: fix mounting /sys in a userns
- Remove hardly set build tags in favor of the Makefile</changelog>
  <changelog author="sgrunert@suse.com" date="1568376000">- Update to v1.11.1
  * Add --devices flag to bud and from
  * Add support for /run/.containerenv
  * Allow mounts.conf entries for equal source and destination paths
  * Fix label and annotation for 1-line Dockerfiles
  * Preserve file and directory mount permissions
  * Replace --debug=false with --log-level=error
  * Set TMPDIR to /var/tmp by default
  * Truncate output of too long image names
  * Ignore EmptyLayer if Squash is set</changelog>
  <changelog author="rbrown@suse.com" date="1569240000">- Update to v1.11.2
  * Add some cleanup code
  * Move devices code to unit specific directory.</changelog>
  <changelog author="sgrunert@suse.com" date="1570449600">- Update to v1.11.3
  * Add cgroups2
  * Add support for retrieving context from stdin "-"
  * Added tutorial on how to include Buildah as library
  * Fix --build-args handling
  * Print build 'STEP' line to stdout, not stderr
  * Use Containerfile by default</changelog>
  <changelog author="sgrunert@suse.com" date="1572350400">- Update to v1.11.4
  * buildah: add a "manifest" command
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1573560000">- Update to v1.11.5
  * buildah: add "manifest" command
  * pkg/supplemented: add a package for grouping images together
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * version: also note the version of containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1575547200">- Update to v1.11.6
  * Handle missing equal sign in --from and --chown flags
    for COPY/ADD
  * bud COPY does not download URL
  * Fix .dockerignore exclude regression
  * commit(docker): always set ContainerID and ContainerConfig
  * Touch up commit man page image parameter
  * Add builder identity annotations.</changelog>
  <changelog author="sgrunert@suse.com" date="1576497600">- Update to v1.12.0
  * Allow ADD to use http src
  * imgtype: reset storage opts if driver overridden
  * Start using containers/common
  * overlay.bats typo: fuse-overlays should be fuse-overlayfs
  * chroot: Unmount with MNT_DETACH instead of UnmountMountpoints()
  * bind: don't complain about missing mountpoints
  * imgtype: check earlier for expected manifest type
  * Add history names support</changelog>
  <changelog author="sgrunert@suse.com" date="1579089600">- Update to v1.13.1
  * copyFileWithTar: close source files at the right time
  * copy: don't digest files that we ignore
  * Check for .dockerignore specifically
  * Don't setup excludes, if their is only one pattern to match
  * set HOME env to /root on chroot-isolation by default
  * docs: fix references to containers-*.5
  * fix bug Add check .dockerignore COPY file
  * buildah bud --volume: run from tmpdir, not source dir
  * Fix imageNamePrefix to give consistent names in buildah-from
  * cpp: use -traditional and -undef flags
  * discard outputs coming from onbuild command on buildah-from --quiet
  * make --format columnizing consistent with buildah images
  * Fix option handling for volumes in build
  * Rework overlay pkg for use with libpod
  * Fix buildahimage builds for buildah
  * Add support for FIPS-Mode backends
  * Set the TMPDIR for pulling/pushing image to $TMPDIR</changelog>
  <changelog author="sgrunert@suse.com" date="1581595200">- Update to v1.14.0
  * getDateAndDigestAndSize(): use manifest.Digest
  * Touch up os/arch doc
  * chroot: handle slightly broken seccomp defaults
  * buildahimage: specify fuse-overlayfs mount options
  * parse: don't complain about not being able to rename something
    to itself
  * Fix build for 32bit platforms
  * Allow users to set OS and architecture on bud
  * Fix COPY in containerfile with envvar
  * Add --sign-by to bud/commit/push, --remove-signatures for
    pull/push
  * Add support for containers.conf
  * manifest push: add --format option</changelog>
  <changelog author="sgrunert@suse.com" date="1583323200">- Update to v1.14.2
  * Search for local runtime per values in containers.conf
  * Set correct ownership on working directory
  * Improve remote manifest retrieval
  * Correct a couple of incorrect format specifiers
  * manifest push --format: force an image type, not a list type
  * run: adjust the order in which elements are added to $
  * getDateAndDigestAndSize(): handle creation time not being set
  * Make the commit id clear like Docker
  * Show error on copied file above context directory in build
  * pull/from/commit/push: retry on most failures
  * Repair buildah so it can use containers.conf on the server side
  * Fixing formatting &amp; build instructions
  * Fix XDG_RUNTIME_DIR for authfile
  * Show validation command-line</changelog>
  <changelog author="sgrunert@suse.com" date="1585310400">- Update to v1.14.4
  * Update unshare man page to fix script example
  * Fix compilation errors on non linux platforms
  * Preserve volume uid and gid through subsequent commands
  * Fix potential CVE in tarfile w/ symlink
  * Fix .dockerignore with globs and ! commands</changelog>
  <changelog author="sgrunert@suse.com" date="1585569600">- Update to v1.14.5
  * Revert FIPS mode change</changelog>
  <changelog author="sgrunert@suse.com" date="1586174400">- Update to v1.14.6
  * Make image history work correctly with new args handling
  * Don't add args to the RUN environment from the Builder</changelog>
  <changelog author="rhafer@suse.com" date="1593000000">- Update to v1.15.0
  * Add CVE-2020-10696 to CHANGELOG.md and changelog.txt
  * fix lighttpd example
  * remove dependency on openshift struct
  * Warn on unset build arguments
  * vendor: update seccomp/containers-golang to v0.4.1
  * Updated docs
  * clean up comments
  * update exit code for tests
  * Implement commit for encryption
  * implementation of encrypt/decrypt push/pull/bud/from
  * fix resolve docker image name as transport
  * Add preliminary profiling support to the CLI
  * Evaluate symlinks in build context directory
  * fix error info about get signatures for containerImageSource
  * Add Security Policy
  * Cirrus: Fixes from review feedback
  * imagebuildah: stages shouldn't count as their base images
  * Update containers/common v0.10.0
  * Add registry to buildahimage Dockerfiles
  * Cirrus: Use pre-installed VM packages + F32
  * Cirrus: Re-enable all distro versions
  * Cirrus: Update to F31 + Use cache images
  * golangci-lint: Disable gosimple
  * Lower number of golangci-lint threads
  * Fix permissions on containers.conf
  * Don't force tests to use runc
  * Return exit code from failed containers
  * cgroup_manager should be under [engine]
  * Use c/common/pkg/auth in login/logout
  * Cirrus: Temporarily disable Ubuntu 19 testing
  * Add containers.conf to stablebyhand build
  * Update gitignore to exclude test Dockerfiles
  * Remove warning for systemd inside of container</changelog>
  <changelog author="sgrunert@suse.com" date="1596456000">- Update to v1.15.1
  * Mask over the /sys/fs/selinux in mask branch
  * chroot: do not use setgroups if it is blocked
  * chroot, run: not fail on bind mounts from /sys
  * Allow "readonly" as alias to "ro" in mount options
  * Add VFS additional image store to container
  * vendor golang.org/x/text@v0.3.3
  * Make imagebuildah.BuildOptions.Architecture/OS optional</changelog>
  <changelog author="fcastelli@suse.com" date="1601467200">- Update to v1.16.2
  * fix build on 32bit arches
  * containerImageRef.NewImageSource(): don't always force timestamps
  * Add fuse module warning to image readme
  * Heed our retry delay option values when retrying commit/pull/push
  * Switch to containers/common for seccomp
  * Use --timestamp rather then --omit-timestamp
  * docs: remove outdated notice
  * docs: remove outdated notice
  * build-using-dockerfile: add a hidden --log-rusage flag
  * build(deps): bump github.com/containers/image/v5 from 5.5.1 to 5.5.2
  * Discard ReportWriter if user sets options.Quiet
  * build(deps): bump github.com/containers/common from 0.19.0 to 0.20.3
  * Fix ownership of content copied using COPY --from
  * newTarDigester: zero out timestamps in tar headers
  * Update nix pin with `make nixpkgs`
  * bud.bats: correct .dockerignore integration tests
  * Use pipes for copying
  * run: include stdout in error message
  * run: use the correct error for errors.Wrapf
  * copier: un-export internal types
  * copier: add Mkdir()
  * in_podman: don't get tripped up by $CIRRUS_CHANGE_TITLE
  * docs/buildah-commit.md: tweak some wording, add a --rm example
  * imagebuildah: don?t blank out destination names when COPYing
  * Replace retry functions with common/pkg/retry
  * StageExecutor.historyMatches: compare timestamps using .Equal
  * Update vendor of containers/common
  * Fix errors found in coverity scan
  * Change namespace handling flags to better match podman commands
  * conformance testing: ignore buildah.BuilderIdentityAnnotation labels
  * Vendor in containers/storage v1.23.0
  * Add buildah.IsContainer interface
  * Avoid feeding run_buildah to pipe
  * fix(buildahimage): add xz dependency in buildah image
  * Bump github.com/containers/common from 0.15.2 to 0.18.0
  * Howto for rootless image building from OpenShift
  * Add --omit-timestamp flag to buildah bud
  * Update nix pin with `make nixpkgs`
  * Shutdown storage on failures
  * Handle COPY --from when an argument is used
  * Bump github.com/seccomp/containers-golang from 0.5.0 to 0.6.0
  * Cirrus: Use newly built VM images
  * Bump github.com/opencontainers/runc from 1.0.0-rc91 to 1.0.0-rc92
  * Enhance the .dockerignore man pages
  * conformance: add a test for COPY from subdirectory
  * fix  bug manifest inspct
  * Add documentation for .dockerignore
  * Add BuilderIdentityAnnotation to identify buildah version
  * DOC: Add quay.io/containers/buildah image to README.md
  * Update buildahimages readme
  * fix spelling mistake in "info" command result display
  * Don't bind /etc/host and /etc/resolv.conf if network is not present
  * blobcache: avoid an unnecessary NewImage()
  * Build static binary with `buildGoModule`
  * copier: split StripSetidBits into StripSetuidBit/StripSetgidBit/StripStickyBit
  * tarFilterer: handle multiple archives
  * Fix a race we hit during conformance tests
  * Rework conformance testing
  * Update 02-registries-repositories.md
  * test-unit: invoke cmd/buildah tests with --flags
  * parse: fix a type mismatch in a test
  * Fix compilation of tests/testreport/testreport
  * build.sh: log the version of Go that we're using
  * test-unit: increase the test timeout to 40/45 minutes
  * Add the "copier" package
  * Fix &amp; add notes regarding problematic language in codebase
  * Add dependency on github.com/stretchr/testify/require
  * CompositeDigester: add the ability to filter tar streams
  * BATS tests: make more robust
  * vendor golang.org/x/text@v0.3.3
  * Switch golang 1.12 to golang 1.13
  * imagebuildah: wait for stages that might not have even started yet
  * chroot, run: not fail on bind mounts from /sys
  * chroot: do not use setgroups if it is blocked
  * Set engine env from containers.conf
  * imagebuildah: return the right stage's image as the "final" image
  * Fix a help string
  * Deduplicate environment variables
  * switch containers/libpod to containers/podman
  * Bump github.com/containers/ocicrypt from 1.0.2 to 1.0.3
  * Bump github.com/opencontainers/selinux from 1.5.2 to 1.6.0
  * Mask out /sys/dev to prevent information leak
  * linux: skip errors from the runtime kill
  * Mask over the /sys/fs/selinux in mask branch
  * Add VFS additional image store to container
  * tests: add auth tests
  * Allow "readonly" as alias to "ro" in mount options
  * Ignore OS X specific consistency mount option
  * Bump github.com/onsi/ginkgo from 1.13.0 to 1.14.0
  * Bump github.com/containers/common from 0.14.0 to 0.15.2
  * Rootless Buildah should default to IsolationOCIRootless
  * imagebuildah: fix inheriting multi-stage builds
  * Make imagebuildah.BuildOptions.Architecture/OS optional
  * Make imagebuildah.BuildOptions.Jobs optional
  * Resolve a possible race in imagebuildah.Executor.startStage()
  * Switch scripts to use containers.conf
  * Bump openshift/imagebuilder to v1.1.6
  * Bump go.etcd.io/bbolt from 1.3.4 to 1.3.5
  * buildah, bud: support --jobs=N for parallel execution
  * executor: refactor build code inside new function
  * Add bud regression tests
  * Cirrus: Fix missing htpasswd in registry img
  * docs: clarify the 'triples' format
  * CHANGELOG.md: Fix markdown formatting
  * Add nix derivation for static builds
  * Bump to v1.16.0-dev</changelog>
  <changelog author="rhafer@suse.com" date="1604404800">- Update to v1.17.0 (bsc#1165184)
  * Handle cases where other tools mount/unmount containers
  * overlay.MountReadOnly: support RO overlay mounts
  * overlay: use fusermount for rootless umounts
  * overlay: fix umount
  * Switch default log level of Buildah to Warn. Users need to see these messages
  * Drop error messages about OCI/Docker format to Warning level
  * build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2
  * tests/testreport: adjust for API break in storage v1.23.6
  * build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7
  * build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6
  * copier: put: ignore Typeflag="g"
  * Use curl to get repo file (fix #2714)
  * build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0
  * build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1
  * Remove docs that refer to bors, since we're not using it
  * Buildah bud should not use stdin by default
  * bump containerd, docker, and golang.org/x/sys
  * Makefile: cross: remove windows.386 target
  * copier.copierHandlerPut: don't check length when there are errors
  * Stop excessive wrapping
  * CI: require that conformance tests pass
  * bump(github.com/openshift/imagebuilder) to v1.1.8
  * Skip tlsVerify insecure BUILD_REGISTRY_SOURCES
  * Fix build path wrong containers/podman#7993
  * refactor pullpolicy to avoid deps
  * build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0
  * CI: run gating tasks with a lot more memory
  * ADD and COPY: descend into excluded directories, sometimes
  * copier: add more context to a couple of error messages
  * copier: check an error earlier
  * copier: log stderr output as debug on success
  * Update nix pin with make nixpkgs
  * Set directory ownership when copied with ID mapping
  * build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0
  * build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0
  * Cirrus: Remove bors artifacts
  * Sort build flag definitions alphabetically
  * ADD: only expand archives at the right time
  * Remove configuration for bors
  * Shell Completion for podman build flags
  * Bump c/common to v0.24.0
  * New CI check: xref --help vs man pages
  * CI: re-enable several linters
  * Move --userns-uid-map/--userns-gid-map description into buildah man page
  * add: preserve ownerships and permissions on ADDed archives
  * Makefile: tweak the cross-compile target
  * Bump containers/common to v0.23.0
  * chroot: create bind mount targets 0755 instead of 0700
  * Change call to Split() to safer SplitN()
  * chroot: fix handling of errno seccomp rules
  * build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0
  * Add In Progress section to contributing
  * integration tests: make sure tests run in ${topdir}/tests
  * Run(): ignore containers.conf's environment configuration
  * Warn when setting healthcheck in OCI format
  * Cirrus: Skip git-validate on branches
  * tools: update git-validation to the latest commit
  * tools: update golangci-lint to v1.18.0
  * Add a few tests of push command
  * Add(): fix handling of relative paths with no ContextDir
  * build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0
  * Lint: Use same linters as podman
  * Validate: reference HEAD
  * Fix buildah mount to display container names not ids
  * Update nix pin with make nixpkgs
  * Add missing --format option in buildah from man page
  * Fix up code based on codespell
  * build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7
  * build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5
  * Improve buildah completions
  * Cirrus: Fix validate commit epoch
  * Fix bash completion of manifest flags
  * Uniform some man pages
  * Update Buildah Tutorial to address BZ1867426
  * Update bash completion of manifest add sub command
  * copier.Get(): hard link targets shouldn't be relative paths
  * build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2
  * Pass timestamp down to history lines
  * Timestamp gets updated everytime you inspect an image
  * bud.bats: use absolute paths in newly-added tests
  * contrib/cirrus/lib.sh: don't use CN for the hostname
  * tests: Add some tests
  * Update manifest add man page
  * Extend flags of manifest add
  * build(deps): bump github.com/containers/storage from 1.23.3 to 1.23.4
  * build(deps): bump github.com/onsi/ginkgo from 1.14.0 to 1.14.1
  * Bump to v1.17.0-dev
  * CI: expand cross-compile checks
- SLE: Remove unneeded patch: CVE-2019-10214.patch</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- buildah required cni (bsc#1187812)</changelog>
</package>
<package pkgid="2c3a6506ab177c7149810fcd66ac507d6ec50cb22eeb69026f6c07d7090fefdd" name="buildah" arch="x86_64">
  <version epoch="0" ver="1.17.0" rel="3.9.1"/>
  <changelog author="sgrunert@suse.com" date="1567425600">- Add patch for CVE-2019-10214. bsc#1144065
  + CVE-2019-10214.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1567684800">- Update to v1.11.0
  * Add --digestfile and Re-add push statement as debug
  * Add --log-level command line option and deprecate --debug
  * Add security-related volume options to validator
  * Allow buildah bud to be called without arguments
  * Allow to override build date with SOURCE_DATE_EPOCH
  * Correctly detect ExitError values from Run()
  * Disable empty logrus timestamps to reduce logger noise
  * Fix directory pull image names
  * Fix handling of /dev/null masked devices
  * Fix possible runtime panic on bud
  * Update bud/from help to contain indicator for --dns=none
  * Update documentation about bud
  * Update shebangs to take env into consideration
  * Use content digests in ADD/COPY history entries
  * add support for cgroupsV2
  * add: add a DryRun flag to AddAndCopyOptions
  * add: handle hard links when copying with .dockerignore
  * add: teach copyFileWithTar() about symlinks and directories
  * imagebuilder: fix detection of referenced stage roots
  * pull/commit/push: pay attention to $BUILD_REGISTRY_SOURCES
  * run_linux: fix mounting /sys in a userns
- Remove hardly set build tags in favor of the Makefile</changelog>
  <changelog author="sgrunert@suse.com" date="1568376000">- Update to v1.11.1
  * Add --devices flag to bud and from
  * Add support for /run/.containerenv
  * Allow mounts.conf entries for equal source and destination paths
  * Fix label and annotation for 1-line Dockerfiles
  * Preserve file and directory mount permissions
  * Replace --debug=false with --log-level=error
  * Set TMPDIR to /var/tmp by default
  * Truncate output of too long image names
  * Ignore EmptyLayer if Squash is set</changelog>
  <changelog author="rbrown@suse.com" date="1569240000">- Update to v1.11.2
  * Add some cleanup code
  * Move devices code to unit specific directory.</changelog>
  <changelog author="sgrunert@suse.com" date="1570449600">- Update to v1.11.3
  * Add cgroups2
  * Add support for retrieving context from stdin "-"
  * Added tutorial on how to include Buildah as library
  * Fix --build-args handling
  * Print build 'STEP' line to stdout, not stderr
  * Use Containerfile by default</changelog>
  <changelog author="sgrunert@suse.com" date="1572350400">- Update to v1.11.4
  * buildah: add a "manifest" command
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1573560000">- Update to v1.11.5
  * buildah: add "manifest" command
  * pkg/supplemented: add a package for grouping images together
  * pkg/manifests: add a manifest list build/manipulation API
  * Update for ErrUnauthorizedForCredentials API change in containers/image
  * Update for manifest-lists API changes in containers/image
  * version: also note the version of containers/image
  * Move to containers/image v5.0.0
  * Enable --device directory as src device
  * Add clarification to the Tutorial for new users
  * Silence "using cache" to ensure -q is fully quiet
  * Move runtime flag to bud from common
  * Commit: check for storage.ErrImageUnknown using errors.Cause()
  * Fix crash when invalid COPY --from flag is specified.</changelog>
  <changelog author="sgrunert@suse.com" date="1575547200">- Update to v1.11.6
  * Handle missing equal sign in --from and --chown flags
    for COPY/ADD
  * bud COPY does not download URL
  * Fix .dockerignore exclude regression
  * commit(docker): always set ContainerID and ContainerConfig
  * Touch up commit man page image parameter
  * Add builder identity annotations.</changelog>
  <changelog author="sgrunert@suse.com" date="1576497600">- Update to v1.12.0
  * Allow ADD to use http src
  * imgtype: reset storage opts if driver overridden
  * Start using containers/common
  * overlay.bats typo: fuse-overlays should be fuse-overlayfs
  * chroot: Unmount with MNT_DETACH instead of UnmountMountpoints()
  * bind: don't complain about missing mountpoints
  * imgtype: check earlier for expected manifest type
  * Add history names support</changelog>
  <changelog author="sgrunert@suse.com" date="1579089600">- Update to v1.13.1
  * copyFileWithTar: close source files at the right time
  * copy: don't digest files that we ignore
  * Check for .dockerignore specifically
  * Don't setup excludes, if their is only one pattern to match
  * set HOME env to /root on chroot-isolation by default
  * docs: fix references to containers-*.5
  * fix bug Add check .dockerignore COPY file
  * buildah bud --volume: run from tmpdir, not source dir
  * Fix imageNamePrefix to give consistent names in buildah-from
  * cpp: use -traditional and -undef flags
  * discard outputs coming from onbuild command on buildah-from --quiet
  * make --format columnizing consistent with buildah images
  * Fix option handling for volumes in build
  * Rework overlay pkg for use with libpod
  * Fix buildahimage builds for buildah
  * Add support for FIPS-Mode backends
  * Set the TMPDIR for pulling/pushing image to $TMPDIR</changelog>
  <changelog author="sgrunert@suse.com" date="1581595200">- Update to v1.14.0
  * getDateAndDigestAndSize(): use manifest.Digest
  * Touch up os/arch doc
  * chroot: handle slightly broken seccomp defaults
  * buildahimage: specify fuse-overlayfs mount options
  * parse: don't complain about not being able to rename something
    to itself
  * Fix build for 32bit platforms
  * Allow users to set OS and architecture on bud
  * Fix COPY in containerfile with envvar
  * Add --sign-by to bud/commit/push, --remove-signatures for
    pull/push
  * Add support for containers.conf
  * manifest push: add --format option</changelog>
  <changelog author="sgrunert@suse.com" date="1583323200">- Update to v1.14.2
  * Search for local runtime per values in containers.conf
  * Set correct ownership on working directory
  * Improve remote manifest retrieval
  * Correct a couple of incorrect format specifiers
  * manifest push --format: force an image type, not a list type
  * run: adjust the order in which elements are added to $
  * getDateAndDigestAndSize(): handle creation time not being set
  * Make the commit id clear like Docker
  * Show error on copied file above context directory in build
  * pull/from/commit/push: retry on most failures
  * Repair buildah so it can use containers.conf on the server side
  * Fixing formatting &amp; build instructions
  * Fix XDG_RUNTIME_DIR for authfile
  * Show validation command-line</changelog>
  <changelog author="sgrunert@suse.com" date="1585310400">- Update to v1.14.4
  * Update unshare man page to fix script example
  * Fix compilation errors on non linux platforms
  * Preserve volume uid and gid through subsequent commands
  * Fix potential CVE in tarfile w/ symlink
  * Fix .dockerignore with globs and ! commands</changelog>
  <changelog author="sgrunert@suse.com" date="1585569600">- Update to v1.14.5
  * Revert FIPS mode change</changelog>
  <changelog author="sgrunert@suse.com" date="1586174400">- Update to v1.14.6
  * Make image history work correctly with new args handling
  * Don't add args to the RUN environment from the Builder</changelog>
  <changelog author="rhafer@suse.com" date="1593000000">- Update to v1.15.0
  * Add CVE-2020-10696 to CHANGELOG.md and changelog.txt
  * fix lighttpd example
  * remove dependency on openshift struct
  * Warn on unset build arguments
  * vendor: update seccomp/containers-golang to v0.4.1
  * Updated docs
  * clean up comments
  * update exit code for tests
  * Implement commit for encryption
  * implementation of encrypt/decrypt push/pull/bud/from
  * fix resolve docker image name as transport
  * Add preliminary profiling support to the CLI
  * Evaluate symlinks in build context directory
  * fix error info about get signatures for containerImageSource
  * Add Security Policy
  * Cirrus: Fixes from review feedback
  * imagebuildah: stages shouldn't count as their base images
  * Update containers/common v0.10.0
  * Add registry to buildahimage Dockerfiles
  * Cirrus: Use pre-installed VM packages + F32
  * Cirrus: Re-enable all distro versions
  * Cirrus: Update to F31 + Use cache images
  * golangci-lint: Disable gosimple
  * Lower number of golangci-lint threads
  * Fix permissions on containers.conf
  * Don't force tests to use runc
  * Return exit code from failed containers
  * cgroup_manager should be under [engine]
  * Use c/common/pkg/auth in login/logout
  * Cirrus: Temporarily disable Ubuntu 19 testing
  * Add containers.conf to stablebyhand build
  * Update gitignore to exclude test Dockerfiles
  * Remove warning for systemd inside of container</changelog>
  <changelog author="sgrunert@suse.com" date="1596456000">- Update to v1.15.1
  * Mask over the /sys/fs/selinux in mask branch
  * chroot: do not use setgroups if it is blocked
  * chroot, run: not fail on bind mounts from /sys
  * Allow "readonly" as alias to "ro" in mount options
  * Add VFS additional image store to container
  * vendor golang.org/x/text@v0.3.3
  * Make imagebuildah.BuildOptions.Architecture/OS optional</changelog>
  <changelog author="fcastelli@suse.com" date="1601467200">- Update to v1.16.2
  * fix build on 32bit arches
  * containerImageRef.NewImageSource(): don't always force timestamps
  * Add fuse module warning to image readme
  * Heed our retry delay option values when retrying commit/pull/push
  * Switch to containers/common for seccomp
  * Use --timestamp rather then --omit-timestamp
  * docs: remove outdated notice
  * docs: remove outdated notice
  * build-using-dockerfile: add a hidden --log-rusage flag
  * build(deps): bump github.com/containers/image/v5 from 5.5.1 to 5.5.2
  * Discard ReportWriter if user sets options.Quiet
  * build(deps): bump github.com/containers/common from 0.19.0 to 0.20.3
  * Fix ownership of content copied using COPY --from
  * newTarDigester: zero out timestamps in tar headers
  * Update nix pin with `make nixpkgs`
  * bud.bats: correct .dockerignore integration tests
  * Use pipes for copying
  * run: include stdout in error message
  * run: use the correct error for errors.Wrapf
  * copier: un-export internal types
  * copier: add Mkdir()
  * in_podman: don't get tripped up by $CIRRUS_CHANGE_TITLE
  * docs/buildah-commit.md: tweak some wording, add a --rm example
  * imagebuildah: don?t blank out destination names when COPYing
  * Replace retry functions with common/pkg/retry
  * StageExecutor.historyMatches: compare timestamps using .Equal
  * Update vendor of containers/common
  * Fix errors found in coverity scan
  * Change namespace handling flags to better match podman commands
  * conformance testing: ignore buildah.BuilderIdentityAnnotation labels
  * Vendor in containers/storage v1.23.0
  * Add buildah.IsContainer interface
  * Avoid feeding run_buildah to pipe
  * fix(buildahimage): add xz dependency in buildah image
  * Bump github.com/containers/common from 0.15.2 to 0.18.0
  * Howto for rootless image building from OpenShift
  * Add --omit-timestamp flag to buildah bud
  * Update nix pin with `make nixpkgs`
  * Shutdown storage on failures
  * Handle COPY --from when an argument is used
  * Bump github.com/seccomp/containers-golang from 0.5.0 to 0.6.0
  * Cirrus: Use newly built VM images
  * Bump github.com/opencontainers/runc from 1.0.0-rc91 to 1.0.0-rc92
  * Enhance the .dockerignore man pages
  * conformance: add a test for COPY from subdirectory
  * fix  bug manifest inspct
  * Add documentation for .dockerignore
  * Add BuilderIdentityAnnotation to identify buildah version
  * DOC: Add quay.io/containers/buildah image to README.md
  * Update buildahimages readme
  * fix spelling mistake in "info" command result display
  * Don't bind /etc/host and /etc/resolv.conf if network is not present
  * blobcache: avoid an unnecessary NewImage()
  * Build static binary with `buildGoModule`
  * copier: split StripSetidBits into StripSetuidBit/StripSetgidBit/StripStickyBit
  * tarFilterer: handle multiple archives
  * Fix a race we hit during conformance tests
  * Rework conformance testing
  * Update 02-registries-repositories.md
  * test-unit: invoke cmd/buildah tests with --flags
  * parse: fix a type mismatch in a test
  * Fix compilation of tests/testreport/testreport
  * build.sh: log the version of Go that we're using
  * test-unit: increase the test timeout to 40/45 minutes
  * Add the "copier" package
  * Fix &amp; add notes regarding problematic language in codebase
  * Add dependency on github.com/stretchr/testify/require
  * CompositeDigester: add the ability to filter tar streams
  * BATS tests: make more robust
  * vendor golang.org/x/text@v0.3.3
  * Switch golang 1.12 to golang 1.13
  * imagebuildah: wait for stages that might not have even started yet
  * chroot, run: not fail on bind mounts from /sys
  * chroot: do not use setgroups if it is blocked
  * Set engine env from containers.conf
  * imagebuildah: return the right stage's image as the "final" image
  * Fix a help string
  * Deduplicate environment variables
  * switch containers/libpod to containers/podman
  * Bump github.com/containers/ocicrypt from 1.0.2 to 1.0.3
  * Bump github.com/opencontainers/selinux from 1.5.2 to 1.6.0
  * Mask out /sys/dev to prevent information leak
  * linux: skip errors from the runtime kill
  * Mask over the /sys/fs/selinux in mask branch
  * Add VFS additional image store to container
  * tests: add auth tests
  * Allow "readonly" as alias to "ro" in mount options
  * Ignore OS X specific consistency mount option
  * Bump github.com/onsi/ginkgo from 1.13.0 to 1.14.0
  * Bump github.com/containers/common from 0.14.0 to 0.15.2
  * Rootless Buildah should default to IsolationOCIRootless
  * imagebuildah: fix inheriting multi-stage builds
  * Make imagebuildah.BuildOptions.Architecture/OS optional
  * Make imagebuildah.BuildOptions.Jobs optional
  * Resolve a possible race in imagebuildah.Executor.startStage()
  * Switch scripts to use containers.conf
  * Bump openshift/imagebuilder to v1.1.6
  * Bump go.etcd.io/bbolt from 1.3.4 to 1.3.5
  * buildah, bud: support --jobs=N for parallel execution
  * executor: refactor build code inside new function
  * Add bud regression tests
  * Cirrus: Fix missing htpasswd in registry img
  * docs: clarify the 'triples' format
  * CHANGELOG.md: Fix markdown formatting
  * Add nix derivation for static builds
  * Bump to v1.16.0-dev</changelog>
  <changelog author="rhafer@suse.com" date="1604404800">- Update to v1.17.0 (bsc#1165184)
  * Handle cases where other tools mount/unmount containers
  * overlay.MountReadOnly: support RO overlay mounts
  * overlay: use fusermount for rootless umounts
  * overlay: fix umount
  * Switch default log level of Buildah to Warn. Users need to see these messages
  * Drop error messages about OCI/Docker format to Warning level
  * build(deps): bump github.com/containers/common from 0.26.0 to 0.26.2
  * tests/testreport: adjust for API break in storage v1.23.6
  * build(deps): bump github.com/containers/storage from 1.23.5 to 1.23.7
  * build(deps): bump github.com/fsouza/go-dockerclient from 1.6.5 to 1.6.6
  * copier: put: ignore Typeflag="g"
  * Use curl to get repo file (fix #2714)
  * build(deps): bump github.com/containers/common from 0.25.0 to 0.26.0
  * build(deps): bump github.com/spf13/cobra from 1.0.0 to 1.1.1
  * Remove docs that refer to bors, since we're not using it
  * Buildah bud should not use stdin by default
  * bump containerd, docker, and golang.org/x/sys
  * Makefile: cross: remove windows.386 target
  * copier.copierHandlerPut: don't check length when there are errors
  * Stop excessive wrapping
  * CI: require that conformance tests pass
  * bump(github.com/openshift/imagebuilder) to v1.1.8
  * Skip tlsVerify insecure BUILD_REGISTRY_SOURCES
  * Fix build path wrong containers/podman#7993
  * refactor pullpolicy to avoid deps
  * build(deps): bump github.com/containers/common from 0.24.0 to 0.25.0
  * CI: run gating tasks with a lot more memory
  * ADD and COPY: descend into excluded directories, sometimes
  * copier: add more context to a couple of error messages
  * copier: check an error earlier
  * copier: log stderr output as debug on success
  * Update nix pin with make nixpkgs
  * Set directory ownership when copied with ID mapping
  * build(deps): bump github.com/sirupsen/logrus from 1.6.0 to 1.7.0
  * build(deps): bump github.com/containers/common from 0.23.0 to 0.24.0
  * Cirrus: Remove bors artifacts
  * Sort build flag definitions alphabetically
  * ADD: only expand archives at the right time
  * Remove configuration for bors
  * Shell Completion for podman build flags
  * Bump c/common to v0.24.0
  * New CI check: xref --help vs man pages
  * CI: re-enable several linters
  * Move --userns-uid-map/--userns-gid-map description into buildah man page
  * add: preserve ownerships and permissions on ADDed archives
  * Makefile: tweak the cross-compile target
  * Bump containers/common to v0.23.0
  * chroot: create bind mount targets 0755 instead of 0700
  * Change call to Split() to safer SplitN()
  * chroot: fix handling of errno seccomp rules
  * build(deps): bump github.com/containers/image/v5 from 5.5.2 to 5.6.0
  * Add In Progress section to contributing
  * integration tests: make sure tests run in ${topdir}/tests
  * Run(): ignore containers.conf's environment configuration
  * Warn when setting healthcheck in OCI format
  * Cirrus: Skip git-validate on branches
  * tools: update git-validation to the latest commit
  * tools: update golangci-lint to v1.18.0
  * Add a few tests of push command
  * Add(): fix handling of relative paths with no ContextDir
  * build(deps): bump github.com/containers/common from 0.21.0 to 0.22.0
  * Lint: Use same linters as podman
  * Validate: reference HEAD
  * Fix buildah mount to display container names not ids
  * Update nix pin with make nixpkgs
  * Add missing --format option in buildah from man page
  * Fix up code based on codespell
  * build(deps): bump github.com/openshift/imagebuilder from 1.1.6 to 1.1.7
  * build(deps): bump github.com/containers/storage from 1.23.4 to 1.23.5
  * Improve buildah completions
  * Cirrus: Fix validate commit epoch
  * Fix bash completion of manifest flags
  * Uniform some man pages
  * Update Buildah Tutorial to address BZ1867426
  * Update bash completion of manifest add sub command
  * copier.Get(): hard link targets shouldn't be relative paths
  * build(deps): bump github.com/onsi/gomega from 1.10.1 to 1.10.2
  * Pass timestamp down to history lines
  * Timestamp gets updated everytime you inspect an image
  * bud.bats: use absolute paths in newly-added tests
  * contrib/cirrus/lib.sh: don't use CN for the hostname
  * tests: Add some tests
  * Update manifest add man page
  * Extend flags of manifest add
  * build(deps): bump github.com/containers/storage from 1.23.3 to 1.23.4
  * build(deps): bump github.com/onsi/ginkgo from 1.14.0 to 1.14.1
  * Bump to v1.17.0-dev
  * CI: expand cross-compile checks
- SLE: Remove unneeded patch: CVE-2019-10214.patch</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- buildah required cni (bsc#1187812)</changelog>
</package>
<package pkgid="ba49e58e261017ac937eb018118d1211ab4def9822e7a0b6bc4c709210ed18e3" name="busybox" arch="aarch64">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="olaf@aepfle.de" date="1412856000">- Remove mkinitrd scripts</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Build against libtirpc in preparation of deprecating sunrpc from
  glibc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="5bed9e3d64059c3650cbc3bfe298e96031ce9b8f2a9f3ed2a0384477b233ef4d" name="busybox" arch="ppc64le">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="olaf@aepfle.de" date="1412856000">- Remove mkinitrd scripts</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Build against libtirpc in preparation of deprecating sunrpc from
  glibc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="6dc638e9652eabe7e13a81eede209bf7871687ccfb3c5d0bd8e95e38167528a0" name="busybox" arch="s390x">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="olaf@aepfle.de" date="1412856000">- Remove mkinitrd scripts</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Build against libtirpc in preparation of deprecating sunrpc from
  glibc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="cbc80d8e22838d449333df00ab952719cb82685a44070f107e3318cc3828aa3a" name="busybox" arch="src">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile</changelog>
  <changelog author="uli@suse.com" date="1317384000">- cross-build fix: use %__cc macro, set HOSTCC</changelog>
  <changelog author="ro@suse.de" date="1334059200">- update to 1.19.4
  - fix getty, mdev, modinfo and wget
- update to 1.19.3
  - fix chpasswd, crond, inetd, syslogd, tail, tftp
- update to 1.19.2
  - fix ash/hush, cttyhack, find, grep, less, patch, sed, top,
    uncompress
- update to 1.19.0:
  - countless fixes in all utility programs, please see
    http://www.busybox.net/ for details
- remove obsolete patches previously marked as upstreamed</changelog>
  <changelog author="ro@suse.de" date="1334059201">- busybox-1.19.4-typedef_umode_t.patch:
  fix compile as umode_t is only defined with KERNEL and is
  used in header linux/linux/ext2_fs.h</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1338984000">- busybox-1.19.4-ext2fs_h.diff:
  more complete fix for latest ext2_fs.h breakage from busybox git,
  drop busybox-1.19.4-typedef_umode_t.patch</changelog>
  <changelog author="aj@suse.de" date="1342612800">- Add missing sys/resource include (glibc 2.16)</changelog>
  <changelog author="lnussel@suse.de" date="1343822400">- fix path in busybox.install (bnc#680153)</changelog>
  <changelog author="p.drouand@gmail.com" date="1355054400">- Update to 1.20.2 (Bug fix release):
  * fix for variable expansion in redirection
  * fix for "pre-up" and "pre-down" handling
  * fixes for compressed man pages handling
  * important fix! due to misplaced s_mkfs_time field, ext4 driver
    couldn't mount our images
  * fix for getting uptime on non-Linux platforms
  * fix base-256 decoding
- Remove busybox-1.19.4-ext2fs_h.diff: fixed on upstream release</changelog>
  <changelog author="p.drouand@gmail.com" date="1386849600">- Update to version 1.21.1
  + fixes for ntfs detection (big-endian fix)
  + xz decompression of concatenated streams
  + mdev acquired a [ENV=regex;] extension instead of undocumented
    subsystem match hack it used to have prior to 1.21.x.
- Changes from 1.21.0
  + udhcpc: gracefully handle packets with CHECKSUM_PARTIAL
  + ifupdown: improve compatibility with Debian
  + get_linux_version_code: don't fail on Linux version strings
    like "3.0-foo"
  + build system: fix build failure when only gunzip is selected
  + CONFIG_PID_FILE_PATH: new configuration option for pidfile paths
  + declare strings with ALIGN1, as appropriate
  + nanddump: use the right operator of logic AND
  + nanddump: skip bad blocks when instructed to do so
  + nanddump: invert the meaning of the -o parameter to match upstream
  + mount: fix -o user=foo mishandling, fix unc= generation, add prefixpath=
  + build system: fix build of kconfig on Darwin
  + tar: support -J, --xz explicit compression option
  + simplify copyright/license notice that appears in the binary
  + mdev: tell kernel that we didn't find the firmware
  + lineedit: fix Alt-D when cursor==0
  + lineedit: histfile can get emptied when CONFIG_FEATURE_EDITING_SAVE_ON_EXIT=y
  + build system: stop .eh_frame generation
  + build system: fix build failure when compressed help is selected, but bz2 compression is not
  + scripts/kconfig/mconf: work on systems w/o SIGWINCH
  + platform.h: disable ALIGNn macros for s390[x]
  + adduser: install to /usr, not /, like all other similar tools
  + ash: fix "read -s" + ^C. Closes 5504
  + ash: fix a bug in &gt;${varexp} handling. Closes 5282
  + ash: implement export -n
  + ash: revert wrong "fix" for an apparent memory leak. Closes 5822
  + awk: fix FS assignment behavior. Closes 5108
  + awk: make -F STR interpret escape sequences. Closes 5126
  + brctl: fix build failure by s/strtotimeval/bb_strtotimeval/ (android has strtotimeval)
  + busybox: tweak help text and copyright year
  + decompress_uncompress: comment out debug printout on corrupted data
  + decompress_uncompress: move 'code' variable into loop - sole user
  + dhcpd: write lease file on exit
  + dpkg: fix creation of .list files (were empty since b768aeb). Closes 5324
  + du: document incompatibility with standard tool
  + examples/mdev_fat.conf: small addition
  + find: if DESKTOP=y, support -wholename (synonym for -path)
  + find: make -mindepth N -xdev correctly stop on mountpoints
  + ftpd: fix MDTM's month value. Closes 5336
  + ftpd: free allocated string on error path
  + getty: fix for NOCTTY killing us with SIGHUP
  + grep: fix grep -Fw not respecting the -w option. Closes 5792
  + ifconfig: do not accept "ifconfig eth0 up 1.2.3.4/17" (ip with mask). Closes 5786
  + libbb: correctness/size tweaks in signal-related helpers
  + lineedit: in !EDITING config, return -1 on fgets error
  + login: increase login name size limit from 32 to 64
  + lpr: don't send 0-byte print jobs (compat)
  + man: fix handling of gzipped manpages
  + mdev: add support for $DEVNAME and /dev/mdev.log debug aid
  + mdev: fix mode of dir1 in =dir1/dir2/file rule
  + mdev: remove undocumented subsystem/devname matching hack
  + mdev: when found, print major,minor into mdev.log
  + modprobe_small: make rmmod to NOT remove dependencies. Closes 5162
  + mount: do not pass "comment=ANYTHING" option to kernel. Closes 5240
  + mount: fix the wrongly stored fs creation time
  + mount: set up RO loop device if mount -o ro. Closes 4784
  + mount: support strictatime option. Closes 5240
  + ntpd: on time step, kill all outstanding replies from other peers
  + sed: fix handling of s/// which has empty matches
  + sed: fix zero chars match/replace
  + sha3: make size/speed optimization decision configurable
  + syslogd: do not segfault on parse error when using default config. Closes 5762
  + telnet: convert CR -&gt; CR LF, not CR -&gt; CR NUL when sending data to server
  + telnet: convert Enter -&gt; CR LF in line mode too
  + tftpd: fix -u USER to work with chroot. Closes 5348
  + top/ps: argv0:"gdm-session-worker [pam/gdm-password]" == comm:"gdm-session-wor"
  + top: do not touch stdin if -b
  + top: fix "last CPU" parsing
  + top: implement scrolling up/down (_very_ useful)
  + udhcp[cd]: fix binding to network aliases. Closes 5432, 5438
  + udhcpc: make -O &lt;numeric_opt&gt; work. Closes 5402
  + udhcpc[6]: show select timeout in log
  + unzip: make options parsing more robust on getopt w/o gnu extensions
  + vi: do not set autoindent by default
  + vi: nuke FEATURE_VI_OPTIMIZE_CURSOR
  + vi: save/restore screen upon invocation
  + volume_id/ext: detect ext4 too
  + wget: correctly handle failure to -c (continue)
  + wget: make -c _not_ truncate the file
  + wget: reorder fread and poll: poll only if fread returns EAGAIN. Closes 5426
  + wget: try reading after poll timeout - stdio may have buffered data. Closes 5426
  + acpid: add missing lid switch definition
  + tar: fix 256-bit encoded number decoding
  + udhcpc[6]: allow discover_retries == 0 (infinite)
  + ash: fix a memory leak
  + sysctl: implement -q
  + powertop: fix error message
  + sha3sum: new applet
  + fbset: respect rgba configuration lines in fb.modes
  + fbsplash: support non-RGB565 pixels in 16-bit mode
  + flashcp: remove unused variable opts
  + mount: add unc option to CIFS mount (needed for Linux 3.4+)
  + nanddump: make dumping read-only partitions work
  + ps: use separate get_uptime() and make it work on non-linux too
  + declare strings with ALIGN1, as appropriate
  + udhcpc6: depend on ipv6
  + include sys/resource.h where needed
  + disable format security warnings
  + build system: use pkg-config to look up selinux libs
  + ifenslave: fix missing close paren
  + sed: allow 'w' cmd to use two address form
  + tar: implement --no-recursion
  + unzip: ignore chmod errors
  + brctl: fix description and usage
  + su: do not change to home dir unless -l
  + ntpd: fix incorrect m_status field in outgoing packets. Closes 5120
  + dmesg: handle multi-char log levels
  + klogd: handle multi-char log levels
  + syslogd: add option to log to Linux kernel printk buffer
  + syslogd: convert dummy functions to statics and get rid of IF_FEATURE_* checks
  + config: do not refer to HTTPS for wget
  + sendmail: use host rather than NIS domain name for HELO
  + mktemp: fix mktemp -u temp.XXXXXX returning garbage when TMPDIR is set
  + blkid: show filesystem when both label and UUID are missing, but type is known
  + volume_id: add exFAT detection
  + ln: support -T and -v
  + sed: support long opts and -iSFX
  + mkdir,rmdir: accept and ignore -v, --verbose
  + mv: accept but ignore -v
  + blkid: add type display for btrfs
  + blkid: add support for nilfs2
  + blkid: add type display for hfsplus
  + volume_id: display hfs[+] 128-bit UUID properly
  + volume_id: uuid_format small code shrink
  + volume_id: add squashfs detection
  + testsuite: some more awk tests related to conditions
  + modinfo: match more standard module fields and fix version field
  + inetd: fix build failure in Android
  + android: fix 'stat', ifdef S_TYPEIS* in coreutiles/stat.c
  + platform.h: Android tweaks: ioprio defines, BB_ADDITIONAL_PATH
  + android: some sensible defconfig changes
  + libbb: add missing_syscalls.c: for now, only Android syscalls
  + fbsplash: fix regression from e4fa7b7
  + adduser: make it accept "adduser USER GROUP" form
  + wget: add dummy --no-cache
  + testsuite: make mkfs.minix test not fail spuriously on big endian
  + refactor correct_password.c to avoid one if</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1409832000">- update to 1.22.1:
  Many updates and fixes for most included tools, see
  see http://www.busybox.net/news.html
- adjust busybox-resource.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1412856000">- Remove mkinitrd scripts</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Build against libtirpc in preparation of deprecating sunrpc from
  glibc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="f751701a45160c4bb6c52cf700172ffb6194cd7750b9091c346967462dda105c" name="busybox" arch="x86_64">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="olaf@aepfle.de" date="1412856000">- Remove mkinitrd scripts</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Build against libtirpc in preparation of deprecating sunrpc from
  glibc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="d88b9661cc1044d75fa01f8485953d192fbb8d1a89a1e344a5147d9750c946ac" name="busybox-static" arch="aarch64">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1409832000">- update to 1.22.1:
  Many updates and fixes for most included tools, see
  see http://www.busybox.net/news.html
- adjust busybox-resource.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Disable RPC/NFS, we don't have a static libtirpc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="216b7081028ded14dc7aecc2924ca7505657b9cada0e174b71f2c02d69d9b992" name="busybox-static" arch="ppc64le">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1409832000">- update to 1.22.1:
  Many updates and fixes for most included tools, see
  see http://www.busybox.net/news.html
- adjust busybox-resource.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Disable RPC/NFS, we don't have a static libtirpc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="8ba5f4d67bebd847b782157232162bd5a0bf63bdb46937562493399293df403c" name="busybox-static" arch="s390x">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1409832000">- update to 1.22.1:
  Many updates and fixes for most included tools, see
  see http://www.busybox.net/news.html
- adjust busybox-resource.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Disable RPC/NFS, we don't have a static libtirpc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="d20a651d3abc840da71f7fc2bdb33326da49c2b1d68dbb6c5bd1b99d0e84d75d" name="busybox-static" arch="src">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="chris@computersalat.de" date="1299931200">- update to 1.18.13
  see http://www.busybox.net/ for full changelog
- add upstream patches
  o buildsys.patch
  o cksum.patch
  o klogd.patch
  o menuconfig.patch
  o modutils24.patch
  o wget.patch
- rework libunarchive-array patch
  o -&gt; libarchive patch
- remove .gitignore files
- added missing BusyBox.1 as S:1
- added export CFLAGS="{optflags} -fno-strict-aliasing"</changelog>
  <changelog author="jengelh@medozas.de" date="1316260800">- Remove redundant tags/sections from specfile
- Remove unexplained ExcludeArch directive</changelog>
  <changelog author="uli@suse.com" date="1317384000">- cross-build fix: use %__cc macro, set HOSTCC</changelog>
  <changelog author="ro@suse.de" date="1334059200">- update to 1.19.4
  - fix getty, mdev, modinfo and wget
- update to 1.19.3
  - fix chpasswd, crond, inetd, syslogd, tail, tftp
- update to 1.19.2
  - fix ash/hush, cttyhack, find, grep, less, patch, sed, top,
    uncompress
- update to 1.19.0:
  - countless fixes in all utility programs, please see
    http://www.busybox.net/ for details
- remove obsolete patches previously marked as upstreamed</changelog>
  <changelog author="ro@suse.de" date="1334059201">- busybox-1.19.4-typedef_umode_t.patch:
  fix compile as umode_t is only defined with KERNEL and is
  used in header linux/linux/ext2_fs.h</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1338984000">- busybox-1.19.4-ext2fs_h.diff:
  more complete fix for latest ext2_fs.h breakage from busybox git,
  drop busybox-1.19.4-typedef_umode_t.patch</changelog>
  <changelog author="aj@suse.de" date="1342612800">- Add missing sys/resource include (glibc 2.16)</changelog>
  <changelog author="p.drouand@gmail.com" date="1355054400">- Update to 1.20.2 (Bug fix release):
  * fix for variable expansion in redirection
  * fix for "pre-up" and "pre-down" handling
  * fixes for compressed man pages handling
  * important fix! due to misplaced s_mkfs_time field, ext4 driver
    couldn't mount our images
  * fix for getting uptime on non-Linux platforms
  * fix base-256 decoding
- Remove busybox-1.19.4-ext2fs_h.diff: fixed on upstream release</changelog>
  <changelog author="ddiss@suse.com" date="1370520000">- Build against glibc-devel-static to work around uClibc segfault;
  (bnc#758843).
  * Remove uClibc specific busybox.uClibc-build-fix.patch.
  * Add busybox-static.SuSE.config, which specifies CONFIG_STATIC=y.</changelog>
  <changelog author="p.drouand@gmail.com" date="1386849600">- Update to version 1.21.1
  + fixes for ntfs detection (big-endian fix)
  + xz decompression of concatenated streams
  + mdev acquired a [ENV=regex;] extension instead of undocumented
    subsystem match hack it used to have prior to 1.21.x.
- Changes from 1.21.0
  + udhcpc: gracefully handle packets with CHECKSUM_PARTIAL
  + ifupdown: improve compatibility with Debian
  + get_linux_version_code: don't fail on Linux version strings
    like "3.0-foo"
  + build system: fix build failure when only gunzip is selected
  + CONFIG_PID_FILE_PATH: new configuration option for pidfile paths
  + declare strings with ALIGN1, as appropriate
  + nanddump: use the right operator of logic AND
  + nanddump: skip bad blocks when instructed to do so
  + nanddump: invert the meaning of the -o parameter to match upstream
  + mount: fix -o user=foo mishandling, fix unc= generation, add prefixpath=
  + build system: fix build of kconfig on Darwin
  + tar: support -J, --xz explicit compression option
  + simplify copyright/license notice that appears in the binary
  + mdev: tell kernel that we didn't find the firmware
  + lineedit: fix Alt-D when cursor==0
  + lineedit: histfile can get emptied when CONFIG_FEATURE_EDITING_SAVE_ON_EXIT=y
  + build system: stop .eh_frame generation
  + build system: fix build failure when compressed help is selected, but bz2 compression is not
  + scripts/kconfig/mconf: work on systems w/o SIGWINCH
  + platform.h: disable ALIGNn macros for s390[x]
  + adduser: install to /usr, not /, like all other similar tools
  + ash: fix "read -s" + ^C. Closes 5504
  + ash: fix a bug in &gt;${varexp} handling. Closes 5282
  + ash: implement export -n
  + ash: revert wrong "fix" for an apparent memory leak. Closes 5822
  + awk: fix FS assignment behavior. Closes 5108
  + awk: make -F STR interpret escape sequences. Closes 5126
  + brctl: fix build failure by s/strtotimeval/bb_strtotimeval/ (android has strtotimeval)
  + busybox: tweak help text and copyright year
  + decompress_uncompress: comment out debug printout on corrupted data
  + decompress_uncompress: move 'code' variable into loop - sole user
  + dhcpd: write lease file on exit
  + dpkg: fix creation of .list files (were empty since b768aeb). Closes 5324
  + du: document incompatibility with standard tool
  + examples/mdev_fat.conf: small addition
  + find: if DESKTOP=y, support -wholename (synonym for -path)
  + find: make -mindepth N -xdev correctly stop on mountpoints
  + ftpd: fix MDTM's month value. Closes 5336
  + ftpd: free allocated string on error path
  + getty: fix for NOCTTY killing us with SIGHUP
  + grep: fix grep -Fw not respecting the -w option. Closes 5792
  + ifconfig: do not accept "ifconfig eth0 up 1.2.3.4/17" (ip with mask). Closes 5786
  + libbb: correctness/size tweaks in signal-related helpers
  + lineedit: in !EDITING config, return -1 on fgets error
  + login: increase login name size limit from 32 to 64
  + lpr: don't send 0-byte print jobs (compat)
  + man: fix handling of gzipped manpages
  + mdev: add support for $DEVNAME and /dev/mdev.log debug aid
  + mdev: fix mode of dir1 in =dir1/dir2/file rule
  + mdev: remove undocumented subsystem/devname matching hack
  + mdev: when found, print major,minor into mdev.log
  + modprobe_small: make rmmod to NOT remove dependencies. Closes 5162
  + mount: do not pass "comment=ANYTHING" option to kernel. Closes 5240
  + mount: fix the wrongly stored fs creation time
  + mount: set up RO loop device if mount -o ro. Closes 4784
  + mount: support strictatime option. Closes 5240
  + ntpd: on time step, kill all outstanding replies from other peers
  + sed: fix handling of s/// which has empty matches
  + sed: fix zero chars match/replace
  + sha3: make size/speed optimization decision configurable
  + syslogd: do not segfault on parse error when using default config. Closes 5762
  + telnet: convert CR -&gt; CR LF, not CR -&gt; CR NUL when sending data to server
  + telnet: convert Enter -&gt; CR LF in line mode too
  + tftpd: fix -u USER to work with chroot. Closes 5348
  + top/ps: argv0:"gdm-session-worker [pam/gdm-password]" == comm:"gdm-session-wor"
  + top: do not touch stdin if -b
  + top: fix "last CPU" parsing
  + top: implement scrolling up/down (_very_ useful)
  + udhcp[cd]: fix binding to network aliases. Closes 5432, 5438
  + udhcpc: make -O &lt;numeric_opt&gt; work. Closes 5402
  + udhcpc[6]: show select timeout in log
  + unzip: make options parsing more robust on getopt w/o gnu extensions
  + vi: do not set autoindent by default
  + vi: nuke FEATURE_VI_OPTIMIZE_CURSOR
  + vi: save/restore screen upon invocation
  + volume_id/ext: detect ext4 too
  + wget: correctly handle failure to -c (continue)
  + wget: make -c _not_ truncate the file
  + wget: reorder fread and poll: poll only if fread returns EAGAIN. Closes 5426
  + wget: try reading after poll timeout - stdio may have buffered data. Closes 5426
  + acpid: add missing lid switch definition
  + tar: fix 256-bit encoded number decoding
  + udhcpc[6]: allow discover_retries == 0 (infinite)
  + ash: fix a memory leak
  + sysctl: implement -q
  + powertop: fix error message
  + sha3sum: new applet
  + fbset: respect rgba configuration lines in fb.modes
  + fbsplash: support non-RGB565 pixels in 16-bit mode
  + flashcp: remove unused variable opts
  + mount: add unc option to CIFS mount (needed for Linux 3.4+)
  + nanddump: make dumping read-only partitions work
  + ps: use separate get_uptime() and make it work on non-linux too
  + declare strings with ALIGN1, as appropriate
  + udhcpc6: depend on ipv6
  + include sys/resource.h where needed
  + disable format security warnings
  + build system: use pkg-config to look up selinux libs
  + ifenslave: fix missing close paren
  + sed: allow 'w' cmd to use two address form
  + tar: implement --no-recursion
  + unzip: ignore chmod errors
  + brctl: fix description and usage
  + su: do not change to home dir unless -l
  + ntpd: fix incorrect m_status field in outgoing packets. Closes 5120
  + dmesg: handle multi-char log levels
  + klogd: handle multi-char log levels
  + syslogd: add option to log to Linux kernel printk buffer
  + syslogd: convert dummy functions to statics and get rid of IF_FEATURE_* checks
  + config: do not refer to HTTPS for wget
  + sendmail: use host rather than NIS domain name for HELO
  + mktemp: fix mktemp -u temp.XXXXXX returning garbage when TMPDIR is set
  + blkid: show filesystem when both label and UUID are missing, but type is known
  + volume_id: add exFAT detection
  + ln: support -T and -v
  + sed: support long opts and -iSFX
  + mkdir,rmdir: accept and ignore -v, --verbose
  + mv: accept but ignore -v
  + blkid: add type display for btrfs
  + blkid: add support for nilfs2
  + blkid: add type display for hfsplus
  + volume_id: display hfs[+] 128-bit UUID properly
  + volume_id: uuid_format small code shrink
  + volume_id: add squashfs detection
  + testsuite: some more awk tests related to conditions
  + modinfo: match more standard module fields and fix version field
  + inetd: fix build failure in Android
  + android: fix 'stat', ifdef S_TYPEIS* in coreutiles/stat.c
  + platform.h: Android tweaks: ioprio defines, BB_ADDITIONAL_PATH
  + android: some sensible defconfig changes
  + libbb: add missing_syscalls.c: for now, only Android syscalls
  + fbsplash: fix regression from e4fa7b7
  + adduser: make it accept "adduser USER GROUP" form
  + wget: add dummy --no-cache
  + testsuite: make mkfs.minix test not fail spuriously on big endian
  + refactor correct_password.c to avoid one if</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1409832000">- update to 1.22.1:
  Many updates and fixes for most included tools, see
  see http://www.busybox.net/news.html
- adjust busybox-resource.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Disable RPC/NFS, we don't have a static libtirpc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="8ffa5b0e845feaa1bda731905621ebebdc46ae006615b0547a5838e2bc2591f2" name="busybox-static" arch="x86_64">
  <version epoch="0" ver="1.26.2" rel="4.5.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1409832000">- update to 1.22.1:
  Many updates and fixes for most included tools, see
  see http://www.busybox.net/news.html
- adjust busybox-resource.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1429531200">- Update to 1.23.2
  * for a full list of changes see http://www.busybox.net/news.html
- Cleaned up spec file with spec-cleaner
- Refreshed patches</changelog>
  <changelog author="p.drouand@gmail.com" date="1451822400">- Update to version 1.24.1
  * for a full list of changes see http://www.busybox.net/news.html
- Refresh busybox.install.patch</changelog>
  <changelog author="olaf@aepfle.de" date="1457006400">- Disable build timestamp</changelog>
  <changelog author="astieger@suse.com" date="1478001600">- update to 1.25.1:
  * fixes for hush, gunzip, ip route, ntpd
- includes changes from 1.25.0:
  * many added and expanded implementations of command options
- includes changes from 1.24.2:
  * fixes for build system (static build with glibc fixed),
    truncate, gunzip and unzip.</changelog>
  <changelog author="astieger@suse.com" date="1498996800">- update to 1.26.2:
  * many updates and fixes to individual tools</changelog>
  <changelog author="kukuk@suse.de" date="1510315200">- Disable RPC/NFS, we don't have a static libtirpc</changelog>
  <changelog author="jjolly@suse.com" date="1534939200">- Enabled functionality within busybox for warewulf compatibility
  * CONFIG_FEATURE_REMOTE_LOG
  * CONFIG_DEPMOD
  * CONFIG_TAC</changelog>
  <changelog author="sflees@suse.de" date="1621598400">- stime has been removed from glibc https://bugs.gentoo.org/708350
  * fix-stime-usage.patch</changelog>
  <changelog author="eich@suse.com" date="1634040000">- CVE-2021-28831 (bsc#1184522) Add:
  * gunzip-fix-from-gzip-1.3.12-for-gzip-file-with-all-zero-length-codes.patch
  * gzip-code-shrink-1.patch
  * gzip-code-shrink-3.patch
  * gunzip-fix-incorrect-decoding-of-fixed-inflate-blocks.patch
  decompress_gunzip-Fix-DoS-if-gzip-is-corrupt.patch
- CVE-2018-20679 (bsc#1121426) Add:
  * udhcpc-check-that-4-byte-options-are-indeed-4-byte-closes-11506.patch
  * udhcpc-when-decoding-DHCP_SUBNET-ensure-it-is-4-bytes-long.patch
- CVE-2018-1000517 (bsc#1099260) Add:
  * wget-add-support-for-S-server-response.patch
  * wget-more-thorough-sanitization-of-other-side-s-data.patch
  * wget-check-chunk-length-for-overflowing-off_t.patch
- CVE-2011-5325 (bsc#951562) Add:
  * tar-postpone-creation-of-symlinks-with-suspicious-targets.-Closes-8411.patch
  * unzip-properly-use-CDF-to-find-compressed-files.-Closes-9536.patch
  * unzip-remove-now-pointless-lseek-which-returns-current-position.patch
  * unzip-do-not-use-CDF.extra_len-read-local-file-header.-Closes-9536.patch
  * unzip-optional-support-for-bzip2-and-lzma.patch
  * unzip-match-Defl-display-with-info-zip-cosmetic-code-shuffling.patch
  * unzip-support-symlinks.-Closes-10031.patch
  * libarchive-do-not-extract-unsafe-symlinks-unless-EXTRACT_UNSAFE_SYMLINKS-1.patch
  * unzip-robustify-overwrite-checks.patch
  * unzip-implement-j-closes-9126.patch
  * tar-unzip-postpone-creation-of-symlinks-with-suspicious-targets.patch
- CVE-2018-1000500 (bsc#1099263) Add:
  * wget-emit-a-message-that-certificate-verification-is-not-implemented.patch
  * wget-implement-TLS-verification-with-ENABLE_FEATURE_WGET_OPENSSL.patch</changelog>
</package>
<package pkgid="11c73abffd1be565992b1df6f2f3bea38f572268b1d62c736eb9615ad399de71" name="c-ares" arch="src">
  <version epoch="0" ver="1.17.1+20200724" rel="3.14.1"/>
  <changelog author="astieger@suse.com" date="1465473600">- update to 1.11.0:
  * Allow multiple -s options to the ahost command
  * api: Expose the ares_library_initialized() function
  * api: Add ares_set_sortlist(3) entrypoint
  * api: Add entrypoints to allow use of per-server ports
  * api: introduce `ares_parse_txt_reply_ext`
  * api: Add ares_set_socket_configure_callback()
  * Add -t u option to ahost
  * collection of bug fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
</package>
<package pkgid="ee61a6cafea3ae145645ac0aa0df114ef66a9048ab07d604cf5a8727a355b4ff" name="c-ares" arch="src">
  <version epoch="0" ver="1.17.1+20200724" rel="3.17.1"/>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
</package>
<package pkgid="4e12c8fbd40bdb7b3d833679447542c79cc5289bd8410b198455eb1b20468a4a" name="c-ares-devel" arch="aarch64">
  <version epoch="0" ver="1.17.1+20200724" rel="3.14.1"/>
  <changelog author="astieger@suse.com" date="1465473600">- update to 1.11.0:
  * Allow multiple -s options to the ahost command
  * api: Expose the ares_library_initialized() function
  * api: Add ares_set_sortlist(3) entrypoint
  * api: Add entrypoints to allow use of per-server ports
  * api: introduce `ares_parse_txt_reply_ext`
  * api: Add ares_set_socket_configure_callback()
  * Add -t u option to ahost
  * collection of bug fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
</package>
<package pkgid="3c15e79fb83c6f375be76045410dfc584c97ef1ea1cd6094ca0110ed417700d5" name="c-ares-devel" arch="ppc64le">
  <version epoch="0" ver="1.17.1+20200724" rel="3.14.1"/>
  <changelog author="astieger@suse.com" date="1465473600">- update to 1.11.0:
  * Allow multiple -s options to the ahost command
  * api: Expose the ares_library_initialized() function
  * api: Add ares_set_sortlist(3) entrypoint
  * api: Add entrypoints to allow use of per-server ports
  * api: introduce `ares_parse_txt_reply_ext`
  * api: Add ares_set_socket_configure_callback()
  * Add -t u option to ahost
  * collection of bug fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
</package>
<package pkgid="d01754c35a83483096d32b1862ed283e3e1acd75cc44ebf799b4fe084b84442c" name="c-ares-devel" arch="s390x">
  <version epoch="0" ver="1.17.1+20200724" rel="3.14.1"/>
  <changelog author="astieger@suse.com" date="1465473600">- update to 1.11.0:
  * Allow multiple -s options to the ahost command
  * api: Expose the ares_library_initialized() function
  * api: Add ares_set_sortlist(3) entrypoint
  * api: Add entrypoints to allow use of per-server ports
  * api: introduce `ares_parse_txt_reply_ext`
  * api: Add ares_set_socket_configure_callback()
  * Add -t u option to ahost
  * collection of bug fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
</package>
<package pkgid="8e2f2bf0102c9e2565d9c1aa5e044088738477f25a81696bf0c3c070b6712553" name="c-ares-devel" arch="x86_64">
  <version epoch="0" ver="1.17.1+20200724" rel="3.14.1"/>
  <changelog author="astieger@suse.com" date="1465473600">- update to 1.11.0:
  * Allow multiple -s options to the ahost command
  * api: Expose the ares_library_initialized() function
  * api: Add ares_set_sortlist(3) entrypoint
  * api: Add entrypoints to allow use of per-server ports
  * api: introduce `ares_parse_txt_reply_ext`
  * api: Add ares_set_socket_configure_callback()
  * Add -t u option to ahost
  * collection of bug fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
</package>
<package pkgid="c749a31ec15238d963a4fd73c23534515cd74ffcf8f51ce341f09e98c56dedbb" name="c-ares-devel" arch="aarch64">
  <version epoch="0" ver="1.17.1+20200724" rel="3.17.1"/>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
</package>
<package pkgid="2ea825d45701a25c8345e0ac28757490c908903a94351dbb9f90571d7a8e88af" name="c-ares-devel" arch="ppc64le">
  <version epoch="0" ver="1.17.1+20200724" rel="3.17.1"/>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
</package>
<package pkgid="83af7d3b1758aefecb0fa723097f83d2ed4d391dd7956124aa58128b8fbab69c" name="c-ares-devel" arch="s390x">
  <version epoch="0" ver="1.17.1+20200724" rel="3.17.1"/>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
</package>
<package pkgid="59a6b05149574f535a096624686c12b3f5a603c6fd12b5b785345ea33f1b241f" name="c-ares-devel" arch="x86_64">
  <version epoch="0" ver="1.17.1+20200724" rel="3.17.1"/>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
</package>
<package pkgid="8c53ba8b2788aa0ed25250b4bbd07492e8a7ae0a4edb0dcd9fa83289d3601601" name="c-ares-utils" arch="aarch64">
  <version epoch="0" ver="1.17.1+20200724" rel="3.14.1"/>
  <changelog author="astieger@suse.com" date="1465473600">- update to 1.11.0:
  * Allow multiple -s options to the ahost command
  * api: Expose the ares_library_initialized() function
  * api: Add ares_set_sortlist(3) entrypoint
  * api: Add entrypoints to allow use of per-server ports
  * api: introduce `ares_parse_txt_reply_ext`
  * api: Add ares_set_socket_configure_callback()
  * Add -t u option to ahost
  * collection of bug fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
</package>
<package pkgid="a84d263f65f7696a97eaffc6a641ca24bb4bb25b38805f7c10e316012dd890ea" name="c-ares-utils" arch="ppc64le">
  <version epoch="0" ver="1.17.1+20200724" rel="3.14.1"/>
  <changelog author="astieger@suse.com" date="1465473600">- update to 1.11.0:
  * Allow multiple -s options to the ahost command
  * api: Expose the ares_library_initialized() function
  * api: Add ares_set_sortlist(3) entrypoint
  * api: Add entrypoints to allow use of per-server ports
  * api: introduce `ares_parse_txt_reply_ext`
  * api: Add ares_set_socket_configure_callback()
  * Add -t u option to ahost
  * collection of bug fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
</package>
<package pkgid="1a101fc69b16fc3ba6745ec469b8aab1b159035000e2380dbd113e2d2c2d1af7" name="c-ares-utils" arch="s390x">
  <version epoch="0" ver="1.17.1+20200724" rel="3.14.1"/>
  <changelog author="astieger@suse.com" date="1465473600">- update to 1.11.0:
  * Allow multiple -s options to the ahost command
  * api: Expose the ares_library_initialized() function
  * api: Add ares_set_sortlist(3) entrypoint
  * api: Add entrypoints to allow use of per-server ports
  * api: introduce `ares_parse_txt_reply_ext`
  * api: Add ares_set_socket_configure_callback()
  * Add -t u option to ahost
  * collection of bug fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
</package>
<package pkgid="10b3e577a21c4e292dec5abc97f4808e5b87fa99f9fea7a6d6d035ade96ec376" name="c-ares-utils" arch="x86_64">
  <version epoch="0" ver="1.17.1+20200724" rel="3.14.1"/>
  <changelog author="astieger@suse.com" date="1465473600">- update to 1.11.0:
  * Allow multiple -s options to the ahost command
  * api: Expose the ares_library_initialized() function
  * api: Add ares_set_sortlist(3) entrypoint
  * api: Add entrypoints to allow use of per-server ports
  * api: introduce `ares_parse_txt_reply_ext`
  * api: Add ares_set_socket_configure_callback()
  * Add -t u option to ahost
  * collection of bug fixes</changelog>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
</package>
<package pkgid="d6a77804a4a7fdec46b8f5ec6d79100456a28218cef49818b0ff188db55b7c75" name="c-ares-utils" arch="aarch64">
  <version epoch="0" ver="1.17.1+20200724" rel="3.17.1"/>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
</package>
<package pkgid="4a2d67703c20bd8df188c194965bdf6d7888878e8fdc89adc9d939c8d1ea82ad" name="c-ares-utils" arch="ppc64le">
  <version epoch="0" ver="1.17.1+20200724" rel="3.17.1"/>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
</package>
<package pkgid="67d53cf481010a9d2a7e9b3b7ca892cbf97050ad1671f5edaf7bd99bdb062f20" name="c-ares-utils" arch="s390x">
  <version epoch="0" ver="1.17.1+20200724" rel="3.17.1"/>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
</package>
<package pkgid="c43a677505c6a845dbad05112a00c8de85fed3abc9491c51ae005910eed032b0" name="c-ares-utils" arch="x86_64">
  <version epoch="0" ver="1.17.1+20200724" rel="3.17.1"/>
  <changelog author="tchvatal@suse.com" date="1477915200">- Version update to 1.12.0:
  * Fixes bsc#1007728 CVE-2016-5180
  * api: add ARES_OPT_NOROTATE optmask value
  * Collection of bugfixes</changelog>
  <changelog author="tchvatal@suse.com" date="1497960000">- Version update to 1.13.0:
  * Fixes bsc#1044946 CVE-2017-1000381
  * Bunch of bugfixes
- Drop cares-1.9.1-ocloexec.patch as it broke again and it is
  not really worth all the fwdporting
- Drop check phase there is only return 0</changelog>
  <changelog author="tchvatal@suse.com" date="1519128000">- Rename everything to c-ares</changelog>
  <changelog author="tchvatal@suse.com" date="1519128001">- Version update to 1.14.0:
  * Fix patch for CVE-2017-1000381 to not be overly aggressive
  * gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel is called
  * ares_gethostbyname.3: fix callback status values
  * docs: Document WSAStartup requirement
  * Fix a typo in init_by_resolv_conf</changelog>
  <changelog author="jengelh@inai.de" date="1519128002">- Remove ineffective --with-pic.</changelog>
  <changelog author="adam.majer@suse.de" date="1550059200">- Version update to 1.15.0:
  * Add ares_init_options() configurability for path to resolv.conf file
  * Ability to exclude building of tools (adig, ahost, acountry) in CMake
  * Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    (bsc#1125306)
  * Apply the IPv6 server blacklist to all nameserver sources
  * Prevent changing name servers while queries are outstanding
  * ares_set_servers_csv() on failure should not leave channel in a
    bad state
- enable unit tests
- disable-live-tests.patch: disable tests to live servers
- onion-crash.patch: backport fix for a crash affecting .onion TLD</changelog>
  <changelog author="mrostecki@opensuse.org" date="1571832000">- Add upstream patches with the ares_getaddrinfo function:
  * 0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  * 0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  * 0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  * 0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  * 0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  * 0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  * 0007-getaddrinfo-enhancements-257.patch
  * 0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  * 0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
- Add a patch which disables test failing on OBS (but passing in
  local environment):
  * 0010-Disable-failing-test.patch</changelog>
  <changelog author="adam.majer@suse.de" date="1573214400">- Update to upstream snapshot 20191108
  * getaddrinfo - avoid infinite loop in case of NXDOMAIN
  * ares_getenv - return NULL in all cases
  * implement ares_getaddrinfo
- onion-crash.patch: removed, upstreamed.
- removed upstream patches that are part of the snapshot:
  0001-Add-initial-implementation-for-ares_getaddrinfo-112.patch
  0002-Remaining-queries-counter-fix-additional-unit-tests-.patch
  0003-Bugfix-for-ares_getaddrinfo-and-additional-unit-test.patch
  0004-Add-ares__sortaddrinfo-to-support-getaddrinfo-sorted.patch
  0005-getaddrinfo-avoid-infinite-loop-in-case-of-NXDOMAIN-.patch
  0006-getaddrinfo-callback-must-be-called-on-bad-domain-24.patch
  0007-getaddrinfo-enhancements-257.patch
  0008-Add-missing-limits.h-include-from-ares_getaddrinfo.c.patch
  0009-Increase-portability-of-ares-test-mock-ai.cc-235.patch
  0010-Disable-failing-test.patch
- disable-live-tests.patch - updated</changelog>
  <changelog author="tchvatal@suse.com" date="1573819200">- Fix version number of the snapshot to not be downgrade:
  bsc#1156601</changelog>
  <changelog author="toddrme2178@gmail.com" date="1578312000">- Switch to cmake-based build.
  Some packages need the cmake build files.</changelog>
  <changelog author="mrostecki@opensuse.org" date="1580212800">- Add netcfg as the build requirement and runtime requirement.
  ares_getaddrinfo function uses the getservbyport_r function which
  requires the /etc/services file to function properly. That config
  file is provided by the netcfg package. Unit tests rely on it
  too, hence it has to be a build dependency as well.</changelog>
  <changelog author="adam.majer@suse.de" date="1580731200">- Upgrade to latest snapshot from 2020-01-17
- disable-live-tests.patch: refreshed
- regression.patch: fix a regression in DNS results that contain
  both A and AAAA answers.</changelog>
  <changelog author="elimat@opensuse.org" date="1594209600">- Version update to 1.16.1
  Security:
  * Prevent possible use-after-free and double-free in ares_getaddrinfo() if
    ares_destroy() is called prior to ares_getaddrinfo() completing.
  Reported by Jann Horn at Google Project Zero.
  Changes:
  * Allow TXT records on CHAOS qclass. Used for retriving things like
    version.bind, version.server, authoris.bind, hostname.bind, and id.server. [3]
  Bug fixes:
  * Fix Windows Unicode incompatibilities with ares_getaddrinfo() [1]
  * Silence false cast-align compiler warnings due to valid casts of struct
    sockaddr to struct sockaddr_in and struct sockaddr_in6.
  * MacOS should use libresolv for retrieving DNS servers, like iOS
  * CMake build system should populate the INCLUDE_DIRECTORIES property of
    installed targets [2]
  * Correct macros in use for the ares_getaddrinfo.3 man page
- Changes in version 1.16.0
  Changes:
  * Introduction of ares_getaddrinfo() API which provides similar output
    (including proper sorting as per RFC 6724) to the system native API, but
  utilizes different data structures in order to provide additional
  information such as TTLs and all aliases. Please reference the respective
  man pages for usage details.
  * Parse SOA records from ns_t_any response
  * CMake: Provide c-ares version in package export file
  * CMake: Add CPACK functionality for DEB and RPM
  * CMake: Generate PDB files during build
  * CMake: Support manpage installation
  Bug fixes:
  * Fix bad expectation in IPv6 localhost test.
  * AutoTools: use XC_CHECK_BUILD_FLAGS instead of XC_CHECK_USER_FLAGS to
    prevent complaints about CPPFLAGS in CFLAGS.
  * Fix .onion handling
  * Command line usage was out of date for adig and ahost.
  * Typos in manpages
  * If ares_getenv is defined, it must return a value on all platforms
  * If /etc/resolv.conf has invalid lookup values, use the defaults.
  * Tests: Separate live tests from SetServers* tests as only live tests
    should require internet access.
  * ares_gethostbyname() should return ENODATA if no valid A or AAAA record
    is found, but a CNAME was found.
  * CMake: Rework library function checking to prevent unintended linking
    with system libraries that aren't needed.
  * Due to use of inet_addr() it was not possible to return 255.255.255.255
    from ares_gethostbyname().
  * CMake: Fix building of tests on Windows
- Drop regression.patch which have been fixed upstream
- Refresh disable-live-tests.patch
- Remove static lib since its required when doing tests and we dont want it
  included in package
- Run spec-cleaner</changelog>
  <changelog author="badshah400@gmail.com" date="1599739200">- Implement multibuild specfile to split out tests into its own
  flavor; this way we can build and run tests, which require
  static lib, as well as avoid packaging the latter without issues
  with the installed cmake file..</changelog>
  <changelog author="tchvatal@suse.com" date="1599825600">- simplify conditions bit to make it tad more readable</changelog>
  <changelog author="adam.majer@suse.de" date="1605614400">- Version update to 1.17.0
  Security:
  * avoid read-heap-buffer-overflow in ares_parse_soa_reply found during
    fuzzing
  * Avoid theoretical buffer overflow in RC4 loop comparison
  * Empty hquery-&gt;name could lead to invalid memory access
  * ares_parse_{a,aaaa}_reply() could return a larger *naddrttls than was
    passed in (bsc#1178882, CVE-2020-8277)
  Changes:
  * Update help information for adig, acountry, and ahost
  * Test Suite now uses dynamic system-assigned ports rather than hardcoded
    ports to prevent failures in containers
  * Detect remote DNS server does not support EDNS using rules from RFC 6891
  * Source tree has been reorganized to use a more modern layout
  * Allow parsing of CAA Resource Record
  Bug fixes:
  * readaddrinfo bad sizeof()
  * Test cases should honor HAVE_WRITEV flag, not depend on WIN32
  * FQDN with trailing period should be queried first
  * ares_getaddrinfo() was returning members of the struct as garbage values if
    unset, and was not honoring ai_socktype and ai_protocol hints.
  * ares_gethostbyname() with AF_UNSPEC and an ip address would fail
  * Properly document ares_set_local_ip4() uses host byte order
  For details, see https://c-ares.haxx.se/changelog.html
- add missing upstream sources, to be removed for next release
- remove unnecessary BuildRequires
- fix building on SLE12 systems</changelog>
  <changelog author="adam.majer@suse.de" date="1605787200">- ares_dns.h, missing_header.patch: re-add missing header in last release</changelog>
  <changelog author="mrueckert@suse.de" date="1605960000">- add BR for pkg-config to get the provides in the devel package</changelog>
  <changelog author="adam.majer@suse.de" date="1628251200">- Version update to git snapshot 1.17.1+20200724:
  * fixes missing input validation on hostnames returned by DNS
    servers (bsc#1188881, CVE-2021-3672)
  * If ares_getaddrinfo() was terminated by an ares_destroy(),
    it would cause crash
  * Crash in sortaddrinfo() if the list size equals 0 due to
    an unexpected DNS response
  * Expand number of escaped characters in DNS replies as
    per RFC1035 5.1 to prevent spoofing
  * Use unbuffered /dev/urandom for random data to prevent early startup
    performance issues
- missing_header.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1631102400">- 5c995d5.patch: augment input validation on hostnames to allow _
  as part of DNS response (bsc#1190225)</changelog>
</package>
<package pkgid="742a20b69817334eccf5f0b76d02f82407944a20cb590fca1a9a312c16bda31e" name="ca-certificates-mozilla" arch="noarch">
  <version epoch="0" ver="2.44" rel="18.1"/>
  <changelog author="meissner@suse.com" date="1421064000">- Updated to 2.2 (bnc#888534)
  - The following CAs were removed:
    + America_Online_Root_Certification_Authority_1
    + America_Online_Root_Certification_Authority_2
    + GTE_CyberTrust_Global_Root
    + Thawte_Premium_Server_CA
    + Thawte_Server_CA
  - The following CAs were added:
    + COMODO_RSA_Certification_Authority
    codeSigning emailProtection serverAuth
    + GlobalSign_ECC_Root_CA_-_R4
    codeSigning emailProtection serverAuth
    + GlobalSign_ECC_Root_CA_-_R5
    codeSigning emailProtection serverAuth
    + USERTrust_ECC_Certification_Authority
    codeSigning emailProtection serverAuth
    + USERTrust_RSA_Certification_Authority
    codeSigning emailProtection serverAuth
    + VeriSign-C3SSA-G2-temporary-intermediate-after-1024bit-removal
  - The following CAs were changed:
    + Equifax_Secure_eBusiness_CA_1
    remote code signing and https trust, leave email trust
    + Verisign_Class_3_Public_Primary_Certification_Authority_-_G2
    only trust emailProtection</changelog>
  <changelog author="meissner@suse.com" date="1421236800">- diff-from-upstream-2.2.patch:
  Temporary reenable some root ca trusts, as openssl/gnutls
  have trouble using intermediates as root CA.
  - GTE CyberTrust Global Root
  - Thawte Server CA
  - Thawte Premium Server CA
  - ValiCert Class 1 VA
  - ValiCert Class 2 VA
  - RSA Root Certificate 1
  - Entrust.net Secure Server CA
  - America Online Root Certification Authority 1
  - America Online Root Certification Authority 2</changelog>
  <changelog author="meissner@suse.com" date="1459425600">- Updated to 2.7 (bsc#973042).
- diff-from-upstream-2.2.patch: removed as openssl 1.0.2 can do
  immediate root CAs.
- Removed server trust from:
  AC Raíz Certicámara S.A.
  ComSign Secured CA
  NetLock Uzleti (Class B) Tanusitvanykiado
  NetLock Business (Class B) Root
  NetLock Expressz (Class C) Tanusitvanykiado
  TC TrustCenter Class 3 CA II
  TURKTRUST Certificate Services Provider Root 1
  TURKTRUST Certificate Services Provider Root 2
  Equifax Secure Global eBusiness CA-1
  Verisign Class 4 Public Primary Certification Authority G3
- enable server trust
  Actalis Authentication Root CA
- Deleted CAs:
  A Trust nQual 03
  Buypass Class 3 CA 1
  CA Disig
  Digital Signature Trust Co Global CA 1
  Digital Signature Trust Co Global CA 3
  E Guven Kok Elektronik Sertifika Hizmet Saglayicisi
  NetLock Expressz (Class C) Tanusitvanykiado
  NetLock Kozjegyzoi (Class A) Tanusitvanykiado
  NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado
  NetLock Uzleti (Class B) Tanusitvanykiado
  SG TRUST SERVICES RACINE
  Staat der Nederlanden Root CA
  TC TrustCenter Class 2 CA II
  TC TrustCenter Universal CA I
  TDC Internet Root CA
  UTN DATACorp SGC Root CA
  Verisign Class 1 Public Primary Certification Authority - G2
  Verisign Class 3 Public Primary Certification Authority
  Verisign Class 3 Public Primary Certification Authority - G2
- New added CAs:
  CA WoSign ECC Root
  Certification Authority of WoSign
  Certification Authority of WoSign G2
  Certinomis - Root CA
  Certum Trusted Network CA 2
  CFCA EV ROOT
  COMODO RSA Certification Authority
  DigiCert Assured ID Root G2
  DigiCert Assured ID Root G3
  DigiCert Global Root G2
  DigiCert Global Root G3
  DigiCert Trusted Root G4
  Entrust Root Certification Authority - EC1
  Entrust Root Certification Authority - G2
  GlobalSign
  GlobalSign
  IdenTrust Commercial Root CA 1
  IdenTrust Public Sector Root CA 1
  OISTE WISeKey Global Root GB CA
  QuoVadis Root CA 1 G3
  QuoVadis Root CA 2 G3
  QuoVadis Root CA 3 G3
  Staat der Nederlanden EV Root CA
  Staat der Nederlanden Root CA - G3
  S-TRUST Universal Root CA
  SZAFIR ROOT CA2
  TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H5
  TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  USERTrust ECC Certification Authority
  USERTrust RSA Certification Authority
  ?????</changelog>
  <changelog author="meissner@suse.com" date="1459944000">- diff-from-upstream-2.7.patch: restore some important legacy
  CAs, otherwise Pidgin fails to talk to Google Talk for instance.</changelog>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
</package>
<package pkgid="bf00ebc01f63724251ef8fb1f21990360206dcc0f8e5d0185c954d12bacde965" name="ca-certificates-mozilla" arch="src">
  <version epoch="0" ver="2.44" rel="18.1"/>
  <changelog author="meissner@suse.com" date="1409054400">- Updated to 2.1 (bnc#888534)
- The following 1024-bit CA certificates were removed
  - Entrust.net Secure Server Certification Authority
  - ValiCert Class 1 Policy Validation Authority
  - ValiCert Class 2 Policy Validation Authority
  - ValiCert Class 3 Policy Validation Authority
  - TDC Internet Root CA
- The following CA certificates were added:
  - Certification Authority of WoSign
  - CA ?????
  - DigiCert Assured ID Root G2
  - DigiCert Assured ID Root G3
  - DigiCert Global Root G2
  - DigiCert Global Root G3
  - DigiCert Trusted Root G4
  - QuoVadis Root CA 1 G3
  - QuoVadis Root CA 2 G3
  - QuoVadis Root CA 3 G3
- The Trust Bits were changed for the following CA certificates
  - Class 3 Public Primary Certification Authority
  - Class 3 Public Primary Certification Authority
  - Class 2 Public Primary Certification Authority - G2
  - VeriSign Class 2 Public Primary Certification Authority - G3
  - AC Raíz Certicámara S.A.
  - NetLock Uzleti (Class B) Tanusitvanykiado
  - NetLock Expressz (Class C) Tanusitvanykiado
- certdata-temporary-1024.patch: restore some certificates removed
  from NSS as these are still used for some major sites.
  openssl is not as clever as NSS in selecting the new ones in the
  chain correctly.</changelog>
  <changelog author="meissner@suse.com" date="1421064000">- Updated to 2.2 (bnc#888534)
  - The following CAs were removed:
    + America_Online_Root_Certification_Authority_1
    + America_Online_Root_Certification_Authority_2
    + GTE_CyberTrust_Global_Root
    + Thawte_Premium_Server_CA
    + Thawte_Server_CA
  - The following CAs were added:
    + COMODO_RSA_Certification_Authority
    codeSigning emailProtection serverAuth
    + GlobalSign_ECC_Root_CA_-_R4
    codeSigning emailProtection serverAuth
    + GlobalSign_ECC_Root_CA_-_R5
    codeSigning emailProtection serverAuth
    + USERTrust_ECC_Certification_Authority
    codeSigning emailProtection serverAuth
    + USERTrust_RSA_Certification_Authority
    codeSigning emailProtection serverAuth
    + VeriSign-C3SSA-G2-temporary-intermediate-after-1024bit-removal
  - The following CAs were changed:
    + Equifax_Secure_eBusiness_CA_1
    remote code signing and https trust, leave email trust
    + Verisign_Class_3_Public_Primary_Certification_Authority_-_G2
    only trust emailProtection</changelog>
  <changelog author="meissner@suse.com" date="1421236800">- diff-from-upstream-2.2.patch:
  Temporary reenable some root ca trusts, as openssl/gnutls
  have trouble using intermediates as root CA.
  - GTE CyberTrust Global Root
  - Thawte Server CA
  - Thawte Premium Server CA
  - ValiCert Class 1 VA
  - ValiCert Class 2 VA
  - RSA Root Certificate 1
  - Entrust.net Secure Server CA
  - America Online Root Certification Authority 1
  - America Online Root Certification Authority 2</changelog>
  <changelog author="meissner@suse.com" date="1459425600">- Updated to 2.7 (bsc#973042).
- diff-from-upstream-2.2.patch: removed as openssl 1.0.2 can do
  immediate root CAs.
- Removed server trust from:
  AC Raíz Certicámara S.A.
  ComSign Secured CA
  NetLock Uzleti (Class B) Tanusitvanykiado
  NetLock Business (Class B) Root
  NetLock Expressz (Class C) Tanusitvanykiado
  TC TrustCenter Class 3 CA II
  TURKTRUST Certificate Services Provider Root 1
  TURKTRUST Certificate Services Provider Root 2
  Equifax Secure Global eBusiness CA-1
  Verisign Class 4 Public Primary Certification Authority G3
- enable server trust
  Actalis Authentication Root CA
- Deleted CAs:
  A Trust nQual 03
  Buypass Class 3 CA 1
  CA Disig
  Digital Signature Trust Co Global CA 1
  Digital Signature Trust Co Global CA 3
  E Guven Kok Elektronik Sertifika Hizmet Saglayicisi
  NetLock Expressz (Class C) Tanusitvanykiado
  NetLock Kozjegyzoi (Class A) Tanusitvanykiado
  NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado
  NetLock Uzleti (Class B) Tanusitvanykiado
  SG TRUST SERVICES RACINE
  Staat der Nederlanden Root CA
  TC TrustCenter Class 2 CA II
  TC TrustCenter Universal CA I
  TDC Internet Root CA
  UTN DATACorp SGC Root CA
  Verisign Class 1 Public Primary Certification Authority - G2
  Verisign Class 3 Public Primary Certification Authority
  Verisign Class 3 Public Primary Certification Authority - G2
- New added CAs:
  CA WoSign ECC Root
  Certification Authority of WoSign
  Certification Authority of WoSign G2
  Certinomis - Root CA
  Certum Trusted Network CA 2
  CFCA EV ROOT
  COMODO RSA Certification Authority
  DigiCert Assured ID Root G2
  DigiCert Assured ID Root G3
  DigiCert Global Root G2
  DigiCert Global Root G3
  DigiCert Trusted Root G4
  Entrust Root Certification Authority - EC1
  Entrust Root Certification Authority - G2
  GlobalSign
  GlobalSign
  IdenTrust Commercial Root CA 1
  IdenTrust Public Sector Root CA 1
  OISTE WISeKey Global Root GB CA
  QuoVadis Root CA 1 G3
  QuoVadis Root CA 2 G3
  QuoVadis Root CA 3 G3
  Staat der Nederlanden EV Root CA
  Staat der Nederlanden Root CA - G3
  S-TRUST Universal Root CA
  SZAFIR ROOT CA2
  TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H5
  TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  USERTrust ECC Certification Authority
  USERTrust RSA Certification Authority
  ?????</changelog>
  <changelog author="meissner@suse.com" date="1459944000">- diff-from-upstream-2.7.patch: restore some important legacy
  CAs, otherwise Pidgin fails to talk to Google Talk for instance.</changelog>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
</package>
<package pkgid="6208279d78365a1bcbcf7f91df2307ce221b85d0c2b2248791b5c7b862609eb9" name="ca-certificates-mozilla" arch="noarch">
  <version epoch="0" ver="2.44" rel="21.1"/>
  <changelog author="meissner@suse.com" date="1421064000">- Updated to 2.2 (bnc#888534)
  - The following CAs were removed:
    + America_Online_Root_Certification_Authority_1
    + America_Online_Root_Certification_Authority_2
    + GTE_CyberTrust_Global_Root
    + Thawte_Premium_Server_CA
    + Thawte_Server_CA
  - The following CAs were added:
    + COMODO_RSA_Certification_Authority
    codeSigning emailProtection serverAuth
    + GlobalSign_ECC_Root_CA_-_R4
    codeSigning emailProtection serverAuth
    + GlobalSign_ECC_Root_CA_-_R5
    codeSigning emailProtection serverAuth
    + USERTrust_ECC_Certification_Authority
    codeSigning emailProtection serverAuth
    + USERTrust_RSA_Certification_Authority
    codeSigning emailProtection serverAuth
    + VeriSign-C3SSA-G2-temporary-intermediate-after-1024bit-removal
  - The following CAs were changed:
    + Equifax_Secure_eBusiness_CA_1
    remote code signing and https trust, leave email trust
    + Verisign_Class_3_Public_Primary_Certification_Authority_-_G2
    only trust emailProtection</changelog>
  <changelog author="meissner@suse.com" date="1421236800">- diff-from-upstream-2.2.patch:
  Temporary reenable some root ca trusts, as openssl/gnutls
  have trouble using intermediates as root CA.
  - GTE CyberTrust Global Root
  - Thawte Server CA
  - Thawte Premium Server CA
  - ValiCert Class 1 VA
  - ValiCert Class 2 VA
  - RSA Root Certificate 1
  - Entrust.net Secure Server CA
  - America Online Root Certification Authority 1
  - America Online Root Certification Authority 2</changelog>
  <changelog author="meissner@suse.com" date="1459425600">- Updated to 2.7 (bsc#973042).
- diff-from-upstream-2.2.patch: removed as openssl 1.0.2 can do
  immediate root CAs.
- Removed server trust from:
  AC Raíz Certicámara S.A.
  ComSign Secured CA
  NetLock Uzleti (Class B) Tanusitvanykiado
  NetLock Business (Class B) Root
  NetLock Expressz (Class C) Tanusitvanykiado
  TC TrustCenter Class 3 CA II
  TURKTRUST Certificate Services Provider Root 1
  TURKTRUST Certificate Services Provider Root 2
  Equifax Secure Global eBusiness CA-1
  Verisign Class 4 Public Primary Certification Authority G3
- enable server trust
  Actalis Authentication Root CA
- Deleted CAs:
  A Trust nQual 03
  Buypass Class 3 CA 1
  CA Disig
  Digital Signature Trust Co Global CA 1
  Digital Signature Trust Co Global CA 3
  E Guven Kok Elektronik Sertifika Hizmet Saglayicisi
  NetLock Expressz (Class C) Tanusitvanykiado
  NetLock Kozjegyzoi (Class A) Tanusitvanykiado
  NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado
  NetLock Uzleti (Class B) Tanusitvanykiado
  SG TRUST SERVICES RACINE
  Staat der Nederlanden Root CA
  TC TrustCenter Class 2 CA II
  TC TrustCenter Universal CA I
  TDC Internet Root CA
  UTN DATACorp SGC Root CA
  Verisign Class 1 Public Primary Certification Authority - G2
  Verisign Class 3 Public Primary Certification Authority
  Verisign Class 3 Public Primary Certification Authority - G2
- New added CAs:
  CA WoSign ECC Root
  Certification Authority of WoSign
  Certification Authority of WoSign G2
  Certinomis - Root CA
  Certum Trusted Network CA 2
  CFCA EV ROOT
  COMODO RSA Certification Authority
  DigiCert Assured ID Root G2
  DigiCert Assured ID Root G3
  DigiCert Global Root G2
  DigiCert Global Root G3
  DigiCert Trusted Root G4
  Entrust Root Certification Authority - EC1
  Entrust Root Certification Authority - G2
  GlobalSign
  GlobalSign
  IdenTrust Commercial Root CA 1
  IdenTrust Public Sector Root CA 1
  OISTE WISeKey Global Root GB CA
  QuoVadis Root CA 1 G3
  QuoVadis Root CA 2 G3
  QuoVadis Root CA 3 G3
  Staat der Nederlanden EV Root CA
  Staat der Nederlanden Root CA - G3
  S-TRUST Universal Root CA
  SZAFIR ROOT CA2
  TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H5
  TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  USERTrust ECC Certification Authority
  USERTrust RSA Certification Authority
  ?????</changelog>
  <changelog author="meissner@suse.com" date="1459944000">- diff-from-upstream-2.7.patch: restore some important legacy
  CAs, otherwise Pidgin fails to talk to Google Talk for instance.</changelog>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
</package>
<package pkgid="6ef577095b971b917aa462b3769caba1fc1b5651443334a05db8a2f897757844" name="ca-certificates-mozilla" arch="src">
  <version epoch="0" ver="2.44" rel="21.1"/>
  <changelog author="meissner@suse.com" date="1409054400">- Updated to 2.1 (bnc#888534)
- The following 1024-bit CA certificates were removed
  - Entrust.net Secure Server Certification Authority
  - ValiCert Class 1 Policy Validation Authority
  - ValiCert Class 2 Policy Validation Authority
  - ValiCert Class 3 Policy Validation Authority
  - TDC Internet Root CA
- The following CA certificates were added:
  - Certification Authority of WoSign
  - CA ?????
  - DigiCert Assured ID Root G2
  - DigiCert Assured ID Root G3
  - DigiCert Global Root G2
  - DigiCert Global Root G3
  - DigiCert Trusted Root G4
  - QuoVadis Root CA 1 G3
  - QuoVadis Root CA 2 G3
  - QuoVadis Root CA 3 G3
- The Trust Bits were changed for the following CA certificates
  - Class 3 Public Primary Certification Authority
  - Class 3 Public Primary Certification Authority
  - Class 2 Public Primary Certification Authority - G2
  - VeriSign Class 2 Public Primary Certification Authority - G3
  - AC Raíz Certicámara S.A.
  - NetLock Uzleti (Class B) Tanusitvanykiado
  - NetLock Expressz (Class C) Tanusitvanykiado
- certdata-temporary-1024.patch: restore some certificates removed
  from NSS as these are still used for some major sites.
  openssl is not as clever as NSS in selecting the new ones in the
  chain correctly.</changelog>
  <changelog author="meissner@suse.com" date="1421064000">- Updated to 2.2 (bnc#888534)
  - The following CAs were removed:
    + America_Online_Root_Certification_Authority_1
    + America_Online_Root_Certification_Authority_2
    + GTE_CyberTrust_Global_Root
    + Thawte_Premium_Server_CA
    + Thawte_Server_CA
  - The following CAs were added:
    + COMODO_RSA_Certification_Authority
    codeSigning emailProtection serverAuth
    + GlobalSign_ECC_Root_CA_-_R4
    codeSigning emailProtection serverAuth
    + GlobalSign_ECC_Root_CA_-_R5
    codeSigning emailProtection serverAuth
    + USERTrust_ECC_Certification_Authority
    codeSigning emailProtection serverAuth
    + USERTrust_RSA_Certification_Authority
    codeSigning emailProtection serverAuth
    + VeriSign-C3SSA-G2-temporary-intermediate-after-1024bit-removal
  - The following CAs were changed:
    + Equifax_Secure_eBusiness_CA_1
    remote code signing and https trust, leave email trust
    + Verisign_Class_3_Public_Primary_Certification_Authority_-_G2
    only trust emailProtection</changelog>
  <changelog author="meissner@suse.com" date="1421236800">- diff-from-upstream-2.2.patch:
  Temporary reenable some root ca trusts, as openssl/gnutls
  have trouble using intermediates as root CA.
  - GTE CyberTrust Global Root
  - Thawte Server CA
  - Thawte Premium Server CA
  - ValiCert Class 1 VA
  - ValiCert Class 2 VA
  - RSA Root Certificate 1
  - Entrust.net Secure Server CA
  - America Online Root Certification Authority 1
  - America Online Root Certification Authority 2</changelog>
  <changelog author="meissner@suse.com" date="1459425600">- Updated to 2.7 (bsc#973042).
- diff-from-upstream-2.2.patch: removed as openssl 1.0.2 can do
  immediate root CAs.
- Removed server trust from:
  AC Raíz Certicámara S.A.
  ComSign Secured CA
  NetLock Uzleti (Class B) Tanusitvanykiado
  NetLock Business (Class B) Root
  NetLock Expressz (Class C) Tanusitvanykiado
  TC TrustCenter Class 3 CA II
  TURKTRUST Certificate Services Provider Root 1
  TURKTRUST Certificate Services Provider Root 2
  Equifax Secure Global eBusiness CA-1
  Verisign Class 4 Public Primary Certification Authority G3
- enable server trust
  Actalis Authentication Root CA
- Deleted CAs:
  A Trust nQual 03
  Buypass Class 3 CA 1
  CA Disig
  Digital Signature Trust Co Global CA 1
  Digital Signature Trust Co Global CA 3
  E Guven Kok Elektronik Sertifika Hizmet Saglayicisi
  NetLock Expressz (Class C) Tanusitvanykiado
  NetLock Kozjegyzoi (Class A) Tanusitvanykiado
  NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado
  NetLock Uzleti (Class B) Tanusitvanykiado
  SG TRUST SERVICES RACINE
  Staat der Nederlanden Root CA
  TC TrustCenter Class 2 CA II
  TC TrustCenter Universal CA I
  TDC Internet Root CA
  UTN DATACorp SGC Root CA
  Verisign Class 1 Public Primary Certification Authority - G2
  Verisign Class 3 Public Primary Certification Authority
  Verisign Class 3 Public Primary Certification Authority - G2
- New added CAs:
  CA WoSign ECC Root
  Certification Authority of WoSign
  Certification Authority of WoSign G2
  Certinomis - Root CA
  Certum Trusted Network CA 2
  CFCA EV ROOT
  COMODO RSA Certification Authority
  DigiCert Assured ID Root G2
  DigiCert Assured ID Root G3
  DigiCert Global Root G2
  DigiCert Global Root G3
  DigiCert Trusted Root G4
  Entrust Root Certification Authority - EC1
  Entrust Root Certification Authority - G2
  GlobalSign
  GlobalSign
  IdenTrust Commercial Root CA 1
  IdenTrust Public Sector Root CA 1
  OISTE WISeKey Global Root GB CA
  QuoVadis Root CA 1 G3
  QuoVadis Root CA 2 G3
  QuoVadis Root CA 3 G3
  Staat der Nederlanden EV Root CA
  Staat der Nederlanden Root CA - G3
  S-TRUST Universal Root CA
  SZAFIR ROOT CA2
  TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H5
  TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  USERTrust ECC Certification Authority
  USERTrust RSA Certification Authority
  ?????</changelog>
  <changelog author="meissner@suse.com" date="1459944000">- diff-from-upstream-2.7.patch: restore some important legacy
  CAs, otherwise Pidgin fails to talk to Google Talk for instance.</changelog>
  <changelog author="meissner@suse.com" date="1485259200">- updated to 2.11 state of the Mozilla NSS Certificate store.
- removed CAs:
  - Buypass_Class_2_CA_1:2.1.1.crt
    serverAuth
  - EBG_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?:2.8.76.175.115.66.28.142.116.2.crt
    codeSigning emailProtection serverAuth
  - Equifax_Secure_CA:2.4.53.222.244.207.crt
    emailProtection
  - Equifax_Secure_eBusiness_CA_1:2.1.4.crt
    emailProtection
  - Equifax_Secure_Global_eBusiness_CA:2.1.1.crt
    emailProtection
  - IGC_A:2.5.57.17.69.16.148.crt
    codeSigning emailProtection serverAuth
  - Juur-SK:2.4.59.142.75.252.crt
    codeSigning serverAuth
  - Root_CA_Generalitat_Valenciana:2.4.59.69.229.104.crt
    codeSigning emailProtection serverAuth
  - RSA_Security_2048_v3:2.16.10.1.1.1.0.0.2.124.0.0.0.10.0.0.0.2.crt
    codeSigning emailProtection serverAuth
  - Sonera_Class_1_Root_CA:2.1.36.crt
    emailProtection
  - S-TRUST_Authentication_and_Encryption_Root_CA_2005_PN:2.16.55.25.24.230.83.84.124.26.181.184.203.89.90.219.53.183.crt
    emailProtection
  - Verisign_Class_1_Public_Primary_Certification_Authority:2.16.63.105.30.129.156.240.154.74.243.115.255.185.72.162.228.221.crt
    emailProtection
  - Verisign_Class_2_Public_Primary_Certification_Authority_-_G2:2.17.0.185.47.96.204.136.159.161.122.70.9.184.91.112.108.138.175.crt
    emailProtection
  - Verisign_Class_3_Public_Primary_Certification_Authority:2.16.112.186.228.29.16.217.41.52.182.56.202.123.3.204.186.191.crt
    emailProtection
- added CAs:
  + AC_RAIZ_FNMT-RCM:2.15.93.147.141.48.103.54.200.6.29.26.199.84.132.105.7.crt
    serverAuth
  + Amazon_Root_CA_1:2.19.6.108.159.207.153.191.140.10.57.226.240.120.138.67.230.150.54.91.202.crt
    emailProtection serverAuth
  + Amazon_Root_CA_2:2.19.6.108.159.210.150.53.134.159.10.15.229.134.120.248.91.38.187.138.55.crt
    emailProtection serverAuth
  + Amazon_Root_CA_3:2.19.6.108.159.213.116.151.54.102.63.59.11.154.217.232.158.118.3.242.74.crt
    emailProtection serverAuth
  + Amazon_Root_CA_4:2.19.6.108.159.215.193.187.16.76.41.67.229.113.123.123.44.200.26.193.14.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G1:2.18.17.32.85.131.228.45.62.84.86.133.45.131.55.183.44.220.70.17.crt
    emailProtection serverAuth
  + Certplus_Root_CA_G2:2.18.17.32.217.145.206.174.163.232.197.231.255.233.2.175.207.115.188.85.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_ECC_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + Hellenic_Academic_and_Research_Institutions_RootCA_2015:2.1.0.crt
    emailProtection serverAuth
  + ISRG_Root_X1:2.17.0.130.16.207.176.210.64.227.89.68.99.224.187.99.130.139.0.crt (bsc#1010996)
    serverAuth
  + LuxTrust_Global_Root_2:2.20.10.126.166.223.75.68.158.218.106.36.133.158.230.184.21.211.22.127.187.177.crt
    serverAuth
  + OpenTrust_Root_CA_G1:2.18.17.32.179.144.85.57.125.127.54.109.100.194.167.159.107.99.142.103.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G2:2.18.17.32.161.105.27.191.189.185.189.82.150.143.35.232.72.191.38.17.crt
    emailProtection serverAuth
  + OpenTrust_Root_CA_G3:2.18.17.32.230.248.76.252.36.176.190.5.64.172.218.131.27.52.96.63.crt
    emailProtection serverAuth
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G4:2.16.33.110.51.165.203.211.136.164.111.41.7.180.39.60.196.216.crt
    emailProtection
  + Symantec_Class_1_Public_Primary_Certification_Authority_-_G6:2.16.36.50.117.242.29.47.210.9.51.247.180.106.202.208.243.152.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G4:2.16.52.23.101.18.64.59.183.86.128.45.128.203.121.85.166.30.crt
    emailProtection
  + Symantec_Class_2_Public_Primary_Certification_Authority_-_G6:2.16.100.130.158.252.55.30.116.93.252.151.255.151.200.177.255.65.crt
    emailProtection
- diff-from-upstream-2.7.patch: removed as we should be able to do
  intermediate root chains now with openssl 1.0.2 and also gnutls 3.5
  is able to do so.</changelog>
  <changelog author="jmatejek@suse.com" date="1508932800">- convert processing script to Python 3
- ensure a stable conversion of UTF8 hex-encoded certificate names
- ensure a stable ordering of trust/distrust bits in headers</changelog>
  <changelog author="meissner@suse.com" date="1516881600">- Updated to 2.22 state of the Mozilla NSS Certificate store (bsc#1071152,
  bsc#1071390, bsc#1010996)
- Removed CAs:
  * ACEDICOM Root
  * AddTrust Public CA Root
  * AddTrust Qualified CA Root
  * ApplicationCA - Japanese Government
  * CA Disig Root R1
  * CA WoSign ECC Root
  * Certification Authority of WoSign G2
  * Certinomis - Autorité Racine
  * China Internet Network Information Center EV Certificates Root
  * CNNIC ROOT
  * Comodo Secure Certificate Services
  * Comodo Trusted Certificate Services
  * ComSign Secured CA
  * DST ACES CA X6
  * GeoTrust Global CA 2
  * StartCom Certification Authority
  * StartCom Certification Authority
  * StartCom Certification Authority G2
  * Swisscom Root CA 1
  * TÜB?TAK UEKAE Kök Sertifika Hizmet Sa?lay?c?s? - Sürüm 3
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s?
  * TÜRKTRUST Elektronik Sertifika Hizmet Sa?lay?c?s? H6
  * UTN USERFirst Hardware Root CA
  * UTN USERFirst Object Root CA
  * VeriSign Class 3 Secure Server CA - G2
  * WellsSecure Public Root Certificate Authority
  * Certification Authority of WoSign
  * WoSign China
- Added CAs:
  * D-TRUST Root CA 3 2013
  * GDCA TrustAUTH R5 ROOT
  * SSL.com EV Root Certification Authority ECC
  * SSL.com EV Root Certification Authority RSA R2
  * SSL.com Root Certification Authority ECC
  * SSL.com Root Certification Authority RSA
  * TrustCor RootCert CA-1
  * TrustCor RootCert CA-2
  * TUBITAK Kamu SM SSL Kok Sertifikasi - Surum 1</changelog>
  <changelog author="kukuk@suse.de" date="1521547200">-  Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="meissner@suse.com" date="1530878400">- Updated to 2.24 state of the Mozilla NSS Certificate store. (bsc#1100415)
- Removed CAs:
  * S-TRUST_Universal_Root_CA:2.16.96.86.197.75.35.64.91.100.212.237.37.218.217.214.30.30.crt
  * TC_TrustCenter_Class_3_CA_II:2.14.74.71.0.1.0.2.229.160.93.214.63.0.81.191.crt
  * TÜRKTRUST_Elektronik_Sertifika_Hizmet_Sa?lay?c?s?_H5:2.7.0.142.23.254.36.32.129.crt</changelog>
  <changelog author="meissner@suse.com" date="1534420800">- updated to 2.26 state of the Mozilla NSS Certificate store. (bsc#1104780)
  - removed server auth
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - remove CA
  - ComSign CA
  - added new CA
  - GlobalSign</changelog>
  <changelog author="meissner@suse.com" date="1547726400">- updated to 2.30 state of the Mozilla NSS Certificate store. (bsc#1121446)
- Removed CAs:
  - AC Raiz Certicamara S.A.
  - Certplus Root CA G1
  - Certplus Root CA G2
  - OpenTrust Root CA G1
  - OpenTrust Root CA G2
  - OpenTrust Root CA G3
  - Visa eCommerce Root
- Added Root CAs:
  - Certigna Root CA (email and server auth)
  - GTS Root R1 (server auth)
  - GTS Root R2 (server auth)
  - GTS Root R3 (server auth)
  - GTS Root R4 (server auth)
  - OISTE WISeKey Global Root GC CA (email and server auth)
  - UCA Extended Validation Root (server auth)
  - UCA Global G2 Root (email and server auth)</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1564920000">- update to 2.34 state of the Mozilla NSS Certificate store (bsc#1144169)
- Removed CAs:
  - Certinomis - Root CA
- includes added root CAs from the 2.32 version:
  - emSign ECC Root CA - C3 (email and server auth)
  - emSign ECC Root CA - G3 (email and server auth)
  - emSign Root CA - C1 (email and server auth)
  - emSign Root CA - G1 (email and server auth)
  - Hongkong Post Root CA 3 (server auth)</changelog>
  <changelog author="lnussel@suse.de" date="1573560000">- export correct p11kit trust attributes so Firefox detects built in
  certificates (boo#1154871). Courtesy of Fedora.</changelog>
  <changelog author="lnussel@suse.de" date="1576670400">- make sure p11-kit with patches is installed on SLE (boo#1154871)</changelog>
  <changelog author="meissner@suse.com" date="1579003200">- update to 2.40 state of the Mozilla NSS Certificate store (bsc#1160160)
- removed:
  - Certplus Class 2 Primary CA
  - Deutsche Telekom Root CA 2
  - CN=Swisscom Root CA 2
  - UTN-USERFirst-Client Authentication and Email
- added:
  - Entrust Root Certification Authority - G4</changelog>
  <changelog author="meissner@suse.com" date="1585224000">- also run update-ca-certificates in %posttrans</changelog>
  <changelog author="meissner@suse.com" date="1596024000">- update to 2.42 state of the Mozilla NSS Certificate store (bsc#1174673)
  Removed CAs:
  - AddTrust External CA Root
  - AddTrust Class 1 CA Root
  - LuxTrust Global Root 2
  - Staat der Nederlanden Root CA - G2
  - Symantec Class 1 Public Primary Certification Authority - G4
  - Symantec Class 2 Public Primary Certification Authority - G4
  - VeriSign Class 3 Public Primary Certification Authority - G3
  Added CAs:
  - certSIGN Root CA G2
  - e-Szigno Root CA 2017
  - Microsoft ECC Root Certificate Authority 2017
  - Microsoft RSA Root Certificate Authority 2017</changelog>
  <changelog author="meissner@suse.com" date="1603108800">- Updated to 2.44 state of the Mozilla NSS Certificate store (bsc#1177864)
- Removed CAs:
  - EE Certification Centre Root CA
  - Taiwan GRCA
- Added CAs:
  - Trustwave Global Certification Authority
  - Trustwave Global ECC P256 Certification Authority
  - Trustwave Global ECC P384 Certification Authority</changelog>
  <changelog author="meissner@suse.com" date="1632484800">- remove the DST_Root_CA_X3.pem trust, as it expires september 30th 2021.
  (bsc#1190858)</changelog>
</package>
<package pkgid="594707d18b00a3c2c4541d9eb6d26d3b4f2b51fcb9e11a4a2b25a4031cbbe31e" name="ca-certificates-mozilla-prebuilt" arch="noarch">
  <version epoch="0" ver="2.44" rel="21.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="9187887eb3182cae02636aa72a550693fd849a29162529c919d3517db34bb9c0" name="ca-certificates-mozilla-prebuilt" arch="src">
  <version epoch="0" ver="2.44" rel="21.1"/>
  <changelog author="lnussel@suse.de" date="1633348800">- new package for minimal base containers (jsc#SLE-22162)</changelog>
</package>
<package pkgid="2ca24303dd402b66504f0df56d5cc214be2407e186e53b15656839db0d139f5f" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.43.1" rel="15.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
</package>
<package pkgid="485d2b892faa97dc70e590a3eb7237069427a33554a862bc0c7a6e56993f01a9" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.43.1" rel="15.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
</package>
<package pkgid="f7c35fa547987cbe21f78786133c1bfef9c24c66b76109da3800082cce9c9118" name="cargo" arch="s390x">
  <version epoch="0" ver="1.43.1" rel="15.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
</package>
<package pkgid="803bfcb62e231e94a963627ca700000b96facf535255dd69a6143c449bda258c" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.43.1" rel="15.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
</package>
<package pkgid="f3029bdb17021ea9e5454dddce74252df5d5154548bacf54008c0001665327ca" name="cargo" arch="noarch">
  <version epoch="0" ver="1.53.0" rel="21.3.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Remove patches that are no longer required due to conversation to
  metapackage:
  * Fix-big-endian-miscompile-of-bitcast-zex.patch
  * ignore-Wstring-conversion.patch
- Define latest rust as 1.53</changelog>
</package>
<package pkgid="d7b71e7eeed3f121dfdf83a5d27f824335fbdfddd1f795a4dcb95fe67e3bb159" name="cargo" arch="aarch64">
  <version epoch="0" ver="1.54.0" rel="21.6.2"/>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Remove patches that are no longer required due to conversation to
  metapackage:
  * Fix-big-endian-miscompile-of-bitcast-zex.patch
  * ignore-Wstring-conversion.patch
- Define latest rust as 1.53</changelog>
  <changelog author="william.brown@suse.com" date="1627905600">- Update to version 1.54</changelog>
</package>
<package pkgid="5a45aa2ece776863535c4260c7143525149e523323a172b8b4e8048b242e2440" name="cargo" arch="i586">
  <version epoch="0" ver="1.54.0" rel="21.6.2"/>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Remove patches that are no longer required due to conversation to
  metapackage:
  * Fix-big-endian-miscompile-of-bitcast-zex.patch
  * ignore-Wstring-conversion.patch
- Define latest rust as 1.53</changelog>
  <changelog author="william.brown@suse.com" date="1627905600">- Update to version 1.54</changelog>
</package>
<package pkgid="7cd41ed3bc742b173d07c96dd6d87fd14c6e1c49c3072775946d91d660588d59" name="cargo" arch="ppc64le">
  <version epoch="0" ver="1.54.0" rel="21.6.2"/>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Remove patches that are no longer required due to conversation to
  metapackage:
  * Fix-big-endian-miscompile-of-bitcast-zex.patch
  * ignore-Wstring-conversion.patch
- Define latest rust as 1.53</changelog>
  <changelog author="william.brown@suse.com" date="1627905600">- Update to version 1.54</changelog>
</package>
<package pkgid="b3f18ef85164a475f1056519995748e642329227e070a19d8ee35192d9406d3d" name="cargo" arch="s390x">
  <version epoch="0" ver="1.54.0" rel="21.6.2"/>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Remove patches that are no longer required due to conversation to
  metapackage:
  * Fix-big-endian-miscompile-of-bitcast-zex.patch
  * ignore-Wstring-conversion.patch
- Define latest rust as 1.53</changelog>
  <changelog author="william.brown@suse.com" date="1627905600">- Update to version 1.54</changelog>
</package>
<package pkgid="a645bc82caa30450eab7966c22f8cb56a2a99f70252a1d3167772fd6f4368135" name="cargo" arch="x86_64">
  <version epoch="0" ver="1.54.0" rel="21.6.2"/>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.
- Remove patches that are no longer required due to conversation to
  metapackage:
  * Fix-big-endian-miscompile-of-bitcast-zex.patch
  * ignore-Wstring-conversion.patch
- Define latest rust as 1.53</changelog>
  <changelog author="william.brown@suse.com" date="1627905600">- Update to version 1.54</changelog>
</package>
<package pkgid="4bd8114b032be653249a5cdb7ff4226d5d7d90edebdcb0dd6c29d6f6f6c7f2dc" name="cargo-doc" arch="noarch">
  <version epoch="0" ver="1.43.1" rel="15.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
</package>
<package pkgid="2737862b903640a77626a80d318ddd190d632633923350b6eb7c7eba09d69545" name="cargo1.43" arch="aarch64">
  <version epoch="0" ver="1.43.1" rel="7.3.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="de710dd03e5c2df26b74f2f07592a3f362816643ad76e65e87a70ec17129df7b" name="cargo1.43" arch="i586">
  <version epoch="0" ver="1.43.1" rel="7.3.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="c54659baae095862c6bef4cf44b7520fdba0ff5c6a25281a6ec631723ab25317" name="cargo1.43" arch="ppc64le">
  <version epoch="0" ver="1.43.1" rel="7.3.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="c1003355e44539f6da165277d20655e6ea3315451f65d2bafbce85c0ac28ff25" name="cargo1.43" arch="s390x">
  <version epoch="0" ver="1.43.1" rel="7.3.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="3e1ed1663c95c5f913ffccb0e576871b1b60cb9dd47c19b38bb562d6354e8a5e" name="cargo1.43" arch="x86_64">
  <version epoch="0" ver="1.43.1" rel="7.3.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="0e1068579c3ece8194ef36a9882eb18df2a764a1bf3e26adb318e4815969806a" name="cargo1.43-doc" arch="noarch">
  <version epoch="0" ver="1.43.1" rel="7.3.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="3a6fd92e77d214de8eaa40b450d043eb9998e4ac2fd75d9a57dc4c0a6f0ebd94" name="cargo1.53" arch="aarch64">
  <version epoch="0" ver="1.53.0" rel="7.3.1"/>
  <changelog author="bwiedemann@suse.com" date="1606564800">- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="manfred.h@gmx.net" date="1609588800">- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675200">- LLVM &gt;= 9.0 is needed nowadays.
- Disable usage of "ninja" for all distributions older than Leap 15.2</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675201">- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193600">- Leap 15.3 does not provide a suitable llvm-devel package, hence
  explicitly require llvm9-devel. Details can be seen in the following
  e-mail thread
  &lt;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ZQWAMG2VYBSI2BFM7G3H5YG26ALXWAOA/&gt;</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193601">- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.</changelog>
  <changelog author="ngompa13@gmail.com" date="1610280000">- Add riscv64 build</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1614168000">- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1615464000">- Add bootstrap for armv6</changelog>
  <changelog author="manfred.h@gmx.net" date="1616932800">- rust.spec: Fix typo.
  Add work-around for cargo not respecting _libexecdir on Leap.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1617019200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1618660800">- Add support-llvm12.patch to support building with LLVM 12.</changelog>
  <changelog author="william.brown@suse.com" date="1620388800">- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Remove support-llvm12.patch - feature of 1.52</changelog>
  <changelog author="william.brown@suse.com" date="1624017600">- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].</changelog>
  <changelog author="william.brown@suse.com" date="1624363200">- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM</changelog>
  <changelog author="william.brown@suse.com" date="1624449600">- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.</changelog>
  <changelog author="william.brown@suse.com" date="1624622400">- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1625227200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="7f4dfcb5a8556516050fc0bb10b405454ef9686f432152ebe335f2808aae7508" name="cargo1.53" arch="i586">
  <version epoch="0" ver="1.53.0" rel="7.3.1"/>
  <changelog author="bwiedemann@suse.com" date="1606564800">- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="manfred.h@gmx.net" date="1609588800">- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675200">- LLVM &gt;= 9.0 is needed nowadays.
- Disable usage of "ninja" for all distributions older than Leap 15.2</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675201">- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193600">- Leap 15.3 does not provide a suitable llvm-devel package, hence
  explicitly require llvm9-devel. Details can be seen in the following
  e-mail thread
  &lt;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ZQWAMG2VYBSI2BFM7G3H5YG26ALXWAOA/&gt;</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193601">- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.</changelog>
  <changelog author="ngompa13@gmail.com" date="1610280000">- Add riscv64 build</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1614168000">- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1615464000">- Add bootstrap for armv6</changelog>
  <changelog author="manfred.h@gmx.net" date="1616932800">- rust.spec: Fix typo.
  Add work-around for cargo not respecting _libexecdir on Leap.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1617019200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1618660800">- Add support-llvm12.patch to support building with LLVM 12.</changelog>
  <changelog author="william.brown@suse.com" date="1620388800">- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Remove support-llvm12.patch - feature of 1.52</changelog>
  <changelog author="william.brown@suse.com" date="1624017600">- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].</changelog>
  <changelog author="william.brown@suse.com" date="1624363200">- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM</changelog>
  <changelog author="william.brown@suse.com" date="1624449600">- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.</changelog>
  <changelog author="william.brown@suse.com" date="1624622400">- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1625227200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="bb3e40fff9a778d00ae73bc9b05837725ada81d398b15264db12be3f45d6ed4c" name="cargo1.53" arch="ppc64le">
  <version epoch="0" ver="1.53.0" rel="7.3.1"/>
  <changelog author="bwiedemann@suse.com" date="1606564800">- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="manfred.h@gmx.net" date="1609588800">- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675200">- LLVM &gt;= 9.0 is needed nowadays.
- Disable usage of "ninja" for all distributions older than Leap 15.2</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675201">- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193600">- Leap 15.3 does not provide a suitable llvm-devel package, hence
  explicitly require llvm9-devel. Details can be seen in the following
  e-mail thread
  &lt;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ZQWAMG2VYBSI2BFM7G3H5YG26ALXWAOA/&gt;</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193601">- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.</changelog>
  <changelog author="ngompa13@gmail.com" date="1610280000">- Add riscv64 build</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1614168000">- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1615464000">- Add bootstrap for armv6</changelog>
  <changelog author="manfred.h@gmx.net" date="1616932800">- rust.spec: Fix typo.
  Add work-around for cargo not respecting _libexecdir on Leap.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1617019200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1618660800">- Add support-llvm12.patch to support building with LLVM 12.</changelog>
  <changelog author="william.brown@suse.com" date="1620388800">- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Remove support-llvm12.patch - feature of 1.52</changelog>
  <changelog author="william.brown@suse.com" date="1624017600">- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].</changelog>
  <changelog author="william.brown@suse.com" date="1624363200">- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM</changelog>
  <changelog author="william.brown@suse.com" date="1624449600">- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.</changelog>
  <changelog author="william.brown@suse.com" date="1624622400">- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1625227200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="c0b3418c8088809cadd4d6da0a8b7f08c912b0387df97725adb4f8083845f4fb" name="cargo1.53" arch="s390x">
  <version epoch="0" ver="1.53.0" rel="7.3.1"/>
  <changelog author="bwiedemann@suse.com" date="1606564800">- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="manfred.h@gmx.net" date="1609588800">- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675200">- LLVM &gt;= 9.0 is needed nowadays.
- Disable usage of "ninja" for all distributions older than Leap 15.2</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675201">- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193600">- Leap 15.3 does not provide a suitable llvm-devel package, hence
  explicitly require llvm9-devel. Details can be seen in the following
  e-mail thread
  &lt;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ZQWAMG2VYBSI2BFM7G3H5YG26ALXWAOA/&gt;</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193601">- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.</changelog>
  <changelog author="ngompa13@gmail.com" date="1610280000">- Add riscv64 build</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1614168000">- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1615464000">- Add bootstrap for armv6</changelog>
  <changelog author="manfred.h@gmx.net" date="1616932800">- rust.spec: Fix typo.
  Add work-around for cargo not respecting _libexecdir on Leap.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1617019200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1618660800">- Add support-llvm12.patch to support building with LLVM 12.</changelog>
  <changelog author="william.brown@suse.com" date="1620388800">- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Remove support-llvm12.patch - feature of 1.52</changelog>
  <changelog author="william.brown@suse.com" date="1624017600">- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].</changelog>
  <changelog author="william.brown@suse.com" date="1624363200">- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM</changelog>
  <changelog author="william.brown@suse.com" date="1624449600">- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.</changelog>
  <changelog author="william.brown@suse.com" date="1624622400">- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1625227200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="53897671b257a9204ca6eb405f2fdb1c40b6fa5815d1516ff70af35b992a80ae" name="cargo1.53" arch="x86_64">
  <version epoch="0" ver="1.53.0" rel="7.3.1"/>
  <changelog author="bwiedemann@suse.com" date="1606564800">- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="manfred.h@gmx.net" date="1609588800">- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675200">- LLVM &gt;= 9.0 is needed nowadays.
- Disable usage of "ninja" for all distributions older than Leap 15.2</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675201">- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193600">- Leap 15.3 does not provide a suitable llvm-devel package, hence
  explicitly require llvm9-devel. Details can be seen in the following
  e-mail thread
  &lt;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ZQWAMG2VYBSI2BFM7G3H5YG26ALXWAOA/&gt;</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193601">- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.</changelog>
  <changelog author="ngompa13@gmail.com" date="1610280000">- Add riscv64 build</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1614168000">- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1615464000">- Add bootstrap for armv6</changelog>
  <changelog author="manfred.h@gmx.net" date="1616932800">- rust.spec: Fix typo.
  Add work-around for cargo not respecting _libexecdir on Leap.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1617019200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1618660800">- Add support-llvm12.patch to support building with LLVM 12.</changelog>
  <changelog author="william.brown@suse.com" date="1620388800">- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Remove support-llvm12.patch - feature of 1.52</changelog>
  <changelog author="william.brown@suse.com" date="1624017600">- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].</changelog>
  <changelog author="william.brown@suse.com" date="1624363200">- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM</changelog>
  <changelog author="william.brown@suse.com" date="1624449600">- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.</changelog>
  <changelog author="william.brown@suse.com" date="1624622400">- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1625227200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="fd5f5f48245cd5b381e5762aa42382ca17dcd26e5466426275b8d19bb5717832" name="cargo1.53-doc" arch="noarch">
  <version epoch="0" ver="1.53.0" rel="7.3.1"/>
  <changelog author="bwiedemann@suse.com" date="1606564800">- Check upstream signatures for binaries
- Add rust.keyring</changelog>
  <changelog author="manfred.h@gmx.net" date="1609588800">- Update to version 1.48.0
  + Language
  - The `unsafe` keyword is now syntactically permitted on modules.
    This is still rejected semantically, but can now be parsed by procedural
    macros.
  + Compiler
  - Stabilised the `-C link-self-contained=&lt;yes|no&gt;` compiler flag.
    This tells `rustc` whether to link its own C runtime and libraries or to
    rely on a external linker to find them. (Supported only on `windows-gnu`,
    `linux-musl`, and `wasi` platforms.)
  - You can now use `-C target-feature=+crt-static` on `linux-gnu` targets.
    Note: If you're using cargo you must explicitly pass the `--target` flag.
  - Added tier 2* support for aarch64-unknown-linux-musl.
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - io::Write is now implemented for &amp;ChildStdin &amp;Sink, &amp;Stdout, and &amp;Stderr.
  - All arrays of any length now implement TryFrom&lt;Vec&lt;T&gt;&gt;.
  - The matches! macro now supports having a trailing comma.
  - Vec&lt;A&gt; now implements PartialEq&lt;[B]&gt; where A: PartialEq&lt;B&gt;.
  - The RefCell::{replace, replace_with, clone} methods now all use #[track_caller].
  + Stabilized APIs
  - slice::as_ptr_range
  - slice::as_mut_ptr_range
  - VecDeque::make_contiguous
  - future::pending
  - future::ready
  The following previously stable methods are now `const fn's`:
  - Option::is_some
  - Option::is_none
  - Option::as_ref
  - Result::is_ok
  - Result::is_err
  - Result::as_ref
  - Ordering::reverse
  - Ordering::then
  + Cargo
  + Rustdoc
  - You can now link to items in rustdoc using the intra-doc link syntax.
    E.g. /// Uses [`std::future`] will automatically generate a link to
    std::future's documentation. See "Linking to items by name" for more
    information.
  - You can now specify #[doc(alias = "&lt;alias&gt;")] on items to add search
    aliases when searching through rustdoc's UI.
  + Compatibility Notes
  - Promotion of references to 'static lifetime inside const fn now
    follows the same rules as inside a fn body. In particular, &amp;foo()
    will not be promoted to 'static lifetime any more inside const fns.
  - Associated type bindings on trait objects are now verified to meet
    the bounds declared on the trait when checking that they implement
    the trait.
  - When trait bounds on associated types or opaque types are ambiguous,
    the compiler no longer makes an arbitrary choice on which bound to use.
  - Fixed recursive nonterminals not being expanded in macros during
    pretty-print/reparse check. This may cause errors if your macro
    wasn't correctly handling recursive nonterminal tokens.
  - &amp;mut references to non zero-sized types are no longer promoted.
  - rustc will now warn if you use attributes like #[link_name] or
    [#][cold] in places where they have no effect.
  - Updated _mm256_extract_epi8 and _mm256_extract_epi16 signatures
    in arch::{x86, x86_64} to return i32 to match the vendor signatures.
  - mem::uninitialized will now panic if any inner types inside a struct
    or enum disallow zero-initialization.
  - #[target_feature] will now error if used in a place where it has no effect.
  - Foreign exceptions are now caught by catch_unwind and will cause an
    abort. Note: This behaviour is not guaranteed and is still considered
    undefined behaviour, see the catch_unwind documentation for further
    information.
  + Internal Only
    These changes provide no direct user facing benefits, but represent
    significant improvements to the internals and overall performance of
    rustc and related tools.
  - Building rustc from source now uses ninja by default over make.
    You can continue building with make by setting ninja=false in
    your config.toml.
  - cg_llvm: fewer_names in uncached_llvm_type
  - Made ensure_sufficient_stack() non-generic
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675200">- LLVM &gt;= 9.0 is needed nowadays.
- Disable usage of "ninja" for all distributions older than Leap 15.2</changelog>
  <changelog author="manfred.h@gmx.net" date="1609675201">- Update to version 1.49.0
  + Language
  - Unions can now implement Drop, and you can now have a field in
    a union with ManuallyDrop&lt;T&gt;.
  - You can now cast uninhabited enums to integers.
  - You can now bind by reference and by move in patterns. This
    allows you to selectively borrow individual components of a type.
    E.g.
    [#][derive(Debug)]
    struct Person {
    name: String,
    age: u8,
    }
    let person = Person {
    name: String::from("Alice"),
    age: 20,
    };
    // `name` is moved out of person, but `age` is referenced.
    let Person { name, ref age } = person;
    println!("{} {}", name, age);
  + Compiler
  - Added tier 1* support for aarch64-unknown-linux-gnu.
  - Added tier 2 support for aarch64-apple-darwin.
  - Added tier 2 support for aarch64-pc-windows-msvc.
  - Added tier 3 support for mipsel-unknown-none.
  - Raised the minimum supported LLVM version to LLVM 9.
  - Output from threads spawned in tests is now captured.
  - Change os and vendor values to "none" and "unknown" for some targets
  * Refer to Rust's platform support page for more information on Rust's
    tiered platform support.
  + Libraries
  - RangeInclusive now checks for exhaustion when calling contains and
    indexing.
  - ToString::to_string now no longer shrinks the internal buffer in
    the default implementation.
  - ops::{Index, IndexMut} are now implemented for fixed sized arrays
    of any length.
  + Stabilized APIs
  - slice::select_nth_unstable
  - slice::select_nth_unstable_by
  - slice::select_nth_unstable_by_key
  The following previously stable methods are now const.
  - Poll::is_ready
  - Poll::is_pending
  + Cargo
  - Building a crate with cargo-package should now be independently
    reproducible.
  - cargo-tree now marks proc-macro crates.
  - Added CARGO_PRIMARY_PACKAGE build-time environment variable. This
    variable will be set if the crate being built is one the user
    selected to build, either with -p or through defaults.
  - You can now use glob patterns when specifying packages &amp; targets.
  + Compatibility Notes
  - Demoted i686-unknown-freebsd from host tier 2 to target tier 2
    support.
  - Macros that end with a semi-colon are now treated as statements
    even if they expand to nothing.
  - Rustc will now check for the validity of some built-in attributes
    on enum variants. Previously such invalid or unused attributes
    could be ignored.
  - Leading whitespace is stripped more uniformly in documentation
    comments, which may change behavior. You read this post about
    the changes for more details.
  - Trait bounds are no longer inferred for associated types.
  + Internal Only
  These changes provide no direct user facing benefits, but
  represent significant improvements to the internals and overall
  performance of rustc and related tools.
  - rustc's internal crates are now compiled using the initial-exec
    Thread Local Storage model.
  - Calculate visibilities once in resolve.
  - Added system to the llvm-libunwind bootstrap config option.
  - Added --color for configuring terminal color support to bootstrap.
- Rebased patches:
  + ignore-Wstring-conversion.patch (location)</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193600">- Leap 15.3 does not provide a suitable llvm-devel package, hence
  explicitly require llvm9-devel. Details can be seen in the following
  e-mail thread
  &lt;https://lists.opensuse.org/archives/list/factory@lists.opensuse.org/thread/ZQWAMG2VYBSI2BFM7G3H5YG26ALXWAOA/&gt;</changelog>
  <changelog author="manfred.h@gmx.net" date="1610193601">- &lt;https://github.com/rust-lang/rust/issues/74976&gt;: Add "--stage 1"
  to the "./x.py doc" call to ensure the newly built compiler gets
  used.</changelog>
  <changelog author="ngompa13@gmail.com" date="1610280000">- Add riscv64 build</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1614168000">- Update to version 1.50:
  * This fixes build on armv7 - boo#1181643
  + Language
  - You can now use const values for x in [x; N] array expressions.
    This has been technically possible since 1.38.0, as it was
    unintentionally stabilized.
  - Assignments to ManuallyDrop&lt;T&gt; union fields are now considered safe.
  + Compiler
  - Added tier 3* support for the armv5te-unknown-linux-uclibceabi
    target.
  - Added tier 3 support for the aarch64-apple-ios-macabi target.
  - The x86_64-unknown-freebsd is now built with the full toolset.
  - Dropped support for all cloudabi targets.
  * Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - proc_macro::Punct now implements PartialEq&lt;char&gt;.
  - ops::{Index, IndexMut} are now implemented for fixed sized
    arrays of any length.
  - On Unix platforms, the std::fs::File type now has a "niche" of -1.
    This value cannot be a valid file descriptor, and now means Option&lt;File&gt;
    takes up the same amount of space as File.
  + Stabilized APIs
    bool::then
    btree_map::Entry::or_insert_with_key
    f32::clamp
    f64::clamp
    hash_map::Entry::or_insert_with_key
    Ord::clamp
    RefCell::take
    slice::fill
    UnsafeCell::get_mut
  - The following previously stable methods are now const.
    IpAddr::is_ipv4
    IpAddr::is_ipv6
    IpAddr::is_unspecified
    IpAddr::is_loopback
    IpAddr::is_multicast
    Ipv4Addr::octets
    Ipv4Addr::is_loopback
    Ipv4Addr::is_private
    Ipv4Addr::is_link_local
    Ipv4Addr::is_multicast
    Ipv4Addr::is_broadcast
    Ipv4Addr::is_documentation
    Ipv4Addr::to_ipv6_compatible
    Ipv4Addr::to_ipv6_mapped
    Ipv6Addr::segments
    Ipv6Addr::is_unspecified
    Ipv6Addr::is_loopback
    Ipv6Addr::is_multicast
    Ipv6Addr::to_ipv4
    Layout::size
    Layout::align
    Layout::from_size_align
    pow for all integer types.
    checked_pow for all integer types.
    saturating_pow for all integer types.
    wrapping_pow for all integer types.
    next_power_of_two for all unsigned integer types.
    checked_next_power_of_two for all unsigned integer types.
  + Cargo
  - Added the [build.rustc-workspace-wrapper] option. This option
    sets a wrapper to execute instead of rustc, for workspace members only.
  - cargo:rerun-if-changed will now, if provided a directory,
    scan the entire contents of that directory for changes.
  - Added the --workspace flag to the cargo update command.
  + Misc
  - The search results tab and the help button are focusable
    with keyboard in rustdoc.
  - Running tests will now print the total time taken to execute.
  + Compatibility Notes
  - The compare_and_swap method on atomics has been deprecated.
    It's recommended to use the compare_exchange and
    compare_exchange_weak methods instead.
  - Changes in how TokenStreams are checked have fixed some cases
    where you could write unhygenic macro_rules! macros.
  - #![test] as an inner attribute is now considered unstable
    like other inner macro attributes, and reports an error by
    default through the soft_unstable lint.
  - Overriding a forbid lint at the same level that it was set
    is now a hard error.
  - You can no longer intercept panic! calls by supplying your own
    macro. It's recommended to use the #[panic_handler] attribute
    to provide your own implementation.
  - Semi-colons after item statements (e.g. struct Foo {};)
    now produce a warning.</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1615464000">- Add bootstrap for armv6</changelog>
  <changelog author="manfred.h@gmx.net" date="1616932800">- rust.spec: Fix typo.
  Add work-around for cargo not respecting _libexecdir on Leap.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1617019200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1617710400">- Update to version 1.51:
  + Language
  - [You can now parameterize items such as functions, traits, and `struct`s by constant
    values in addition to by types and lifetimes.][79135] Also known as "const generics"
    E.g. you can now write the following. Note: Only values of primitive integers,
    `bool`, or `char` types are currently permitted.
  + Compiler
  - [Added the `-Csplit-debuginfo` codegen option for macOS platforms.][79570]
    This option controls whether debug information is split across multiple files
    or packed into a single file. **Note** This option is unstable on other platforms.
  - [Added tier 3\* support for `aarch64_be-unknown-linux-gnu`,
    `aarch64-unknown-linux-gnu_ilp32`, and `aarch64_be-unknown-linux-gnu_ilp32` targets.][81455]
  - [Added tier 3 support for `i386-unknown-linux-gnu` and `i486-unknown-linux-gnu` targets.][80662]
  - [The `target-cpu=native` option will now detect individual features of CPUs.][80749]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [`Box::downcast` is now also implemented for any `dyn Any + Send + Sync` object.][80945]
  - [`str` now implements `AsMut&lt;str&gt;`.][80279]
  - [`u64` and `u128` now implement `From&lt;char&gt;`.][79502]
  - [`Error` is now implemented for `&amp;T` where `T` implements `Error`.][75180]
  - [`Poll::{map_ok, map_err}` are now implemented for `Poll&lt;Option&lt;Result&lt;T, E&gt;&gt;&gt;`.][80968]
  - [`unsigned_abs` is now implemented for all signed integer types.][80959]
  - [`io::Empty` now implements `io::Seek`.][78044]
  - [`rc::Weak&lt;T&gt;` and `sync::Weak&lt;T&gt;`'s methods such as `as_ptr` are now implemented for
    `T: ?Sized` types.][80764]
  + Stabilized APIs
  - [`Arc::decrement_strong_count`]
  - [`Arc::increment_strong_count`]
  - [`Once::call_once_force`]
  - [`Peekable::next_if_eq`]
  - [`Peekable::next_if`]
  - [`Seek::stream_position`]
  - [`array::IntoIter`]
  - [`panic::panic_any`]
  - [`ptr::addr_of!`]
  - [`ptr::addr_of_mut!`]
  - [`slice::fill_with`]
  - [`slice::split_inclusive_mut`]
  - [`slice::split_inclusive`]
  - [`slice::strip_prefix`]
  - [`slice::strip_suffix`]
  - [`str::split_inclusive`]
  - [`sync::OnceState`]
  - [`task::Wake`]
  + Cargo
  - [Added the `split-debuginfo` profile option to control the -Csplit-debuginfo
    codegen option.][cargo/9112]
  - [Added the `resolver` field to `Cargo.toml` to enable the new feature resolver
    and CLI option behavior.][cargo/8997] Version 2 of the feature resolver will try
    to avoid unifying features of dependencies where that unification could be unwanted.
    Such as using the same dependency with a `std` feature in a build scripts and
    proc-macros, while using the `no-std` feature in the final binary. See the
    [Cargo book documentation][feature-resolver@2.0] for more information on the feature.
  + Rustdoc
  - [Rustdoc will now include documentation for methods available from _nested_ `Deref` traits.][80653]
  - [You can now provide a `--default-theme` flag which sets the default theme to use for
    documentation.][79642]
    Various improvements to intra-doc links:
  - [You can link to non-path primitives such as `slice`.][80181]
  - [You can link to associated items.][74489]
  - [You can now include generic parameters when linking to items, like `Vec&lt;T&gt;`.][76934]
  + Misc
  - [You can now pass `--include-ignored` to tests (e.g. with
    `cargo test -- --include-ignored`) to include testing tests marked `#[ignore]`.][80053]
  + Compatibility Notes
  - [WASI platforms no longer use the `wasm-bindgen` ABI, and instead use the wasm32 ABI.][79998]
  - [`rustc` no longer promotes division, modulo and indexing operations to `const` that
    could fail.][80579]
  - [The minimum version of glibc for the following platforms has been bumped to version 2.31
    for the distributed artifacts.][81521]
  - `armv5te-unknown-linux-gnueabi`
  - `sparc64-unknown-linux-gnu`
  - `thumbv7neon-unknown-linux-gnueabihf`
  - `armv7-unknown-linux-gnueabi`
  - `x86_64-unknown-linux-gnux32`</changelog>
  <changelog author="aaronpuchert@alice-dsl.net" date="1618660800">- Add support-llvm12.patch to support building with LLVM 12.</changelog>
  <changelog author="william.brown@suse.com" date="1620388800">- Update to version 1.52:
  + Language
  - [Added the `unsafe_op_in_unsafe_fn` lint, which checks whether the unsafe code
    in an `unsafe fn` is wrapped in a `unsafe` block.][79208] This lint
    is allowed by default, and may become a warning or hard error in a
    future edition.
  - [You can now cast mutable references to arrays to a pointer of the same type as
    the element.][81479]
  + Compiler
  - [Upgraded the default LLVM to LLVM 12.][81451]
  - Added tier 3\* support for the following targets.
  - [`s390x-unknown-linux-musl`][82166]
  - [`riscv32gc-unknown-linux-musl` &amp; `riscv64gc-unknown-linux-musl`][82202]
  - [`powerpc-unknown-openbsd`][82733]
  + Libraries
  - [`OsString` now implements `Extend` and `FromIterator`.][82121]
  - [`cmp::Reverse` now has `#[repr(transparent)]` representation.][81879]
  - [`Arc&lt;impl Error&gt;` now implements `error::Error`.][80553]
  - [All integer division and remainder operations are now `const`.][80962]
  + Stabilised APIs
  - [`Arguments::as_str`]
  - [`char::MAX`]
  - [`char::REPLACEMENT_CHARACTER`]
  - [`char::UNICODE_VERSION`]
  - [`char::decode_utf16`]
  - [`char::from_digit`]
  - [`char::from_u32_unchecked`]
  - [`char::from_u32`]
  - [`slice::partition_point`]
  - [`str::rsplit_once`]
  - [`str::split_once`]
    The following previously stable APIs are now `const`.
  - [`char::len_utf8`]
  - [`char::len_utf16`]
  - [`char::to_ascii_uppercase`]
  - [`char::to_ascii_lowercase`]
  - [`char::eq_ignore_ascii_case`]
  - [`u8::to_ascii_uppercase`]
  - [`u8::to_ascii_lowercase`]
  - [`u8::eq_ignore_ascii_case`]
  + Rustdoc
  - [Rustdoc lints are now treated as a tool lint, meaning that
    lints are now prefixed with `rustdoc::` (e.g. `#[warn(rustdoc::non_autolinks)]`).][80527]
    Using the old style is still allowed, and will become a warning in
    a future release.
  - [Rustdoc now supports argument files.][82261]
  - [Rustdoc now generates smart punctuation for documentation.][79423]
  - [You can now use "task lists" in Rustdoc Markdown.][81766] E.g.
    ```markdown
  - [x] Complete
  - [ ] Todo
    ```
  + Misc
  - [You can now pass multiple filters to tests.][81356] E.g.
    `cargo test -- foo bar` will run all tests that match `foo` and `bar`.
  - [Rustup now distributes PDB symbols for the `std` library on Windows,
    allowing you to see `std` symbols when debugging.][82218]
  + Internal Only
    These changes provide no direct user facing benefits, but represent significant
    improvements to the internals and overall performance of rustc and
    related tools.
  - [Check the result cache before the DepGraph when ensuring queries][81855]
  - [Try fast_reject::simplify_type in coherence before doing full check][81744]
  - [Only store a LocalDefId in some HIR nodes][81611]
  - [Store HIR attributes in a side table][79519]
  + Compatibility Notes
  - ------------------
  - [Cargo build scripts are now forbidden from setting `RUSTC_BOOTSTRAP`.][cargo/9181]
  - [Removed support for the `x86_64-rumprun-netbsd` target.][82594]
  - [Deprecated the `x86_64-sun-solaris` target in favor of `x86_64-pc-solaris`.][82216]
  - [Rustdoc now only accepts `,`, ` `, and `\t` as delimiters for specifying
    languages in code blocks.][78429]
  - [Rustc now catches more cases of `pub_use_of_private_extern_crate`][80763]
  - [Changes in how proc macros handle whitespace may lead to panics when used
    with older `proc-macro-hack` versions. A `cargo update` should be sufficient to fix
    this in all cases.][84136]
- Remove support-llvm12.patch - feature of 1.52</changelog>
  <changelog author="william.brown@suse.com" date="1624017600">- Update to version 1.53:
  + Language
  - [You can now use unicode for identifiers.][83799] This allows multilingual
    identifiers but still doesn't allow glyphs that are not considered characters
    such as `?` or `?`. More specifically you can now use any identifier that
    matches the UAX #31 "Unicode Identifier and Pattern Syntax" standard. This
    is the same standard as languages like Python, however Rust uses NFC
    normalization which may be different from other languages.
  - [You can now specify "or patterns" inside pattern matches.][79278]
    Previously you could only use `|` (OR) on complete patterns. E.g.
    ```rust
    let x = Some(2u8);
    // Before
    matches!(x, Some(1) | Some(2));
    // Now
    matches!(x, Some(1 | 2));
    ```
  - [Added the `:pat_param` `macro_rules!` matcher.][83386] This matcher
    has the same semantics as the `:pat` matcher. This is to allow `:pat`
    to change semantics to being a pattern fragment in a future edition.
  + Compiler
  - [Updated the minimum external LLVM version to LLVM 10.][83387]
  - [Added Tier 3\* support for the `wasm64-unknown-unknown` target.][80525]
  - [Improved debuginfo for closures and async functions on Windows MSVC.][83941]
    \* Refer to Rust's [platform support page][platform-support-doc] for more
    information on Rust's tiered platform support.
  + Libraries
  - [Abort messages will now forward to `android_set_abort_message` on
    Android platforms when available.][81469]
  - [`slice::IterMut&lt;'_, T&gt;` now implements `AsRef&lt;[T]&gt;`][82771]
  - [Arrays of any length now implement `IntoIterator`.][84147]
    Currently calling `.into_iter()` as a method on an array will
    return `impl Iterator&lt;Item=&amp;T&gt;`, but this may change in a
    future edition to change `Item` to `T`. Calling `IntoIterator::into_iter`
    directly on arrays will provide `impl Iterator&lt;Item=T&gt;` as expected.
  - [`leading_zeros`, and `trailing_zeros` are now available on all
    `NonZero` integer types.][84082]
  - [`{f32, f64}::from_str` now parse and print special values
    (`NaN`, `-0`) according to IEEE RFC 754.][78618]
  - [You can now index into slices using `(Bound&lt;usize&gt;, Bound&lt;usize&gt;)`.][77704]
  - [Add the `BITS` associated constant to all numeric types.][82565]
  + Cargo
  - [Cargo now supports git repositories where the default `HEAD` branch is not
    "master".][cargo/9392] This also includes a switch to the version 3 `Cargo.lock` format
    which can handle default branches correctly.
  - [macOS targets now default to `unpacked` split-debuginfo.][cargo/9298]
  - [The `authors` field is no longer included in `Cargo.toml` for new
    projects.][cargo/9282]
  + Rustdoc
  - [Added the `rustdoc::bare_urls` lint that warns when you have URLs
    without hyperlinks.][81764]
  + Compatibility Notes
  - [Implement token-based handling of attributes during expansion][82608]
  - [`Ipv4::from_str` will now reject octal format IP addresses in addition
    to rejecting hexadecimal IP addresses.][83652] The octal format can lead
    to confusion and potential security vulnerabilities and [is no
    longer recommended][ietf6943].</changelog>
  <changelog author="william.brown@suse.com" date="1624363200">- Updates to spec file and legacy cleanups during build processes
- Correct issues with incorrect tuning of codegen units that caused
  builders to OOM</changelog>
  <changelog author="william.brown@suse.com" date="1624449600">- Correct build issues with esoteric cpu architectures, by removing
  developer facing tools in some cases.</changelog>
  <changelog author="william.brown@suse.com" date="1624622400">- Resolve issue in constraints to select aarch64 builders in OBS that
  have correctly functioning CPU's.
- Resolve issue with zlib selection and buildrequires.</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1625227200">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="william.brown@suse.com" date="1626004800">- jsc#SLE-18626 - Migrate rust to parallel versioned packages allowing
  more flexible build requirements to be expressed.</changelog>
</package>
<package pkgid="7e7a80dd2ec050754c40a1312aab2ccd9f386ce6adef1d3c6e47b63b1d8c2386" name="cargo1.54" arch="aarch64">
  <version epoch="0" ver="1.54.0" rel="7.3.1"/>
  <changelog author="william.brown@suse.com" date="1627646400">Version 1.54.0 (2021-07-29)
  Language
- [You can now use macros for values in built-in attribute macros.][83366]
  While a seemingly minor addition on its own, this enables a lot of
  powerful functionality when combined correctly. Most notably you can
  now include external documentation in your crate by writing the following.
  ```rust
  [#]![doc = include_str!("README.md")]
  ```
  You can also use this to include auto-generated modules:
  ```rust
  [#][path = concat!(env!("OUT_DIR"), "/generated.rs")]
  mod generated;
  ```
- [You can now cast between unsized slice types (and types which contain
  unsized slices) in `const fn`.][85078]
- [You can now use multiple generic lifetimes with `impl Trait` where the
  lifetimes don't explicitly outlive another.][84701] In code this means
  that you can now have `impl Trait&lt;'a, 'b&gt;` where as before you could
  only have `impl Trait&lt;'a, 'b&gt; where 'b: 'a`.
  Compiler
- [Rustc will now search for custom JSON targets in
  `/lib/rustlib/&lt;target-triple&gt;/target.json` where `/` is the "sysroot"
  directory.][83800] You can find your sysroot directory by running
  `rustc --print sysroot`.
- [Added `wasm` as a `target_family` for WebAssembly platforms.][84072]
- [You can now use `#[target_feature]` on safe functions when targeting
  WebAssembly platforms.][84988]
- [Improved debugger output for enums on Windows MSVC platforms.][85292]
- [Added tier 3\* support for `bpfel-unknown-none`
  and `bpfeb-unknown-none`.][79608]
  \* Refer to Rust's [platform support page][platform-support-doc] for more
  information on Rust's tiered platform support.
  Libraries
- [`panic::panic_any` will now `#[track_caller]`.][85745]
- [Added `OutOfMemory` as a variant of `io::ErrorKind`.][84744]
- [ `proc_macro::Literal` now implements `FromStr`.][84717]
- [The implementations of vendor intrinsics in core::arch have been
  significantly refactored.][83278] The main user-visible changes are
  a 50% reduction in the size of libcore.rlib and stricter validation
  of constant operands passed to intrinsics. The latter is technically
  a breaking change, but allows Rust to more closely match the C vendor
  intrinsics API.
  Stabilized APIs
- [`BTreeMap::into_keys`]
- [`BTreeMap::into_values`]
- [`HashMap::into_keys`]
- [`HashMap::into_values`]
- [`arch::wasm32`]
- [`VecDeque::binary_search`]
- [`VecDeque::binary_search_by`]
- [`VecDeque::binary_search_by_key`]
- [`VecDeque::partition_point`]
  Cargo
-----
- [Added the `--prune &lt;spec&gt;` option to `cargo-tree` to remove a package from
  the dependency graph.][cargo/9520]
- [Added the `--depth` option to `cargo-tree` to print only to a certain depth
  in the tree ][cargo/9499]
- [Added the `no-proc-macro` value to `cargo-tree --edges` to hide procedural
  macro dependencies.][cargo/9488]
- [A new environment variable named `CARGO_TARGET_TMPDIR` is available.][cargo/9375]
  This variable points to a directory that integration tests and benches
  can use as a "scratchpad" for testing filesystem operations.</changelog>
  <changelog author="william.brown@suse.com" date="1628251200">- Change llvm_bundling to be required on s390x on 15.3 due to an llvm11
  codegen issue.</changelog>
</package>
<package pkgid="12a6bc1e1b97d5240b12b028db2569c3ad463872ad64b00637e20abdd0e4d6ff" name="cargo1.54" arch="ppc64le">
  <version epoch="0" ver="1.54.0" rel="7.3.1"/>
  <changelog author="william.brown@suse.com" date="1627646400">Version 1.54.0 (2021-07-29)
  Language
- [You can now use macros for values in built-in attribute macros.][83366]
  While a seemingly minor addition on its own, this enables a lot of
  powerful functionality when combined correctly. Most notably you can
  now include external documentation in your crate by writing the following.
  ```rust
  [#]![doc = include_str!("README.md")]
  ```
  You can also use this to include auto-generated modules:
  ```rust
  [#][path = concat!(env!("OUT_DIR"), "/generated.rs")]
  mod generated;
  ```
- [You can now cast between unsized slice types (and types which contain
  unsized slices) in `const fn`.][85078]
- [You can now use multiple generic lifetimes with `impl Trait` where the
  lifetimes don't explicitly outlive another.][84701] In code this means
  that you can now have `impl Trait&lt;'a, 'b&gt;` where as before you could
  only have `impl Trait&lt;'a, 'b&gt; where 'b: 'a`.
  Compiler
- [Rustc will now search for custom JSON targets in
  `/lib/rustlib/&lt;target-triple&gt;/target.json` where `/` is the "sysroot"
  directory.][83800] You can find your sysroot directory by running
  `rustc --print sysroot`.
- [Added `wasm` as a `target_family` for WebAssembly platforms.][84072]
- [You can now use `#[target_feature]` on safe functions when targeting
  WebAssembly platforms.][84988]
- [Improved debugger output for enums on Windows MSVC platforms.][85292]
- [Added tier 3\* support for `bpfel-unknown-none`
  and `bpfeb-unknown-none`.][79608]
  \* Refer to Rust's [platform support page][platform-support-doc] for more
  information on Rust's tiered platform support.
  Libraries
- [`panic::panic_any` will now `#[track_caller]`.][85745]
- [Added `OutOfMemory` as a variant of `io::ErrorKind`.][84744]
- [ `proc_macro::Literal` now implements `FromStr`.][84717]
- [The implementations of vendor intrinsics in core::arch have been
  significantly refactored.][83278] The main user-visible changes are
  a 50% reduction in the size of libcore.rlib and stricter validation
  of constant operands passed to intrinsics. The latter is technically
  a breaking change, but allows Rust to more closely match the C vendor
  intrinsics API.
  Stabilized APIs
- [`BTreeMap::into_keys`]
- [`BTreeMap::into_values`]
- [`HashMap::into_keys`]
- [`HashMap::into_values`]
- [`arch::wasm32`]
- [`VecDeque::binary_search`]
- [`VecDeque::binary_search_by`]
- [`VecDeque::binary_search_by_key`]
- [`VecDeque::partition_point`]
  Cargo
-----
- [Added the `--prune &lt;spec&gt;` option to `cargo-tree` to remove a package from
  the dependency graph.][cargo/9520]
- [Added the `--depth` option to `cargo-tree` to print only to a certain depth
  in the tree ][cargo/9499]
- [Added the `no-proc-macro` value to `cargo-tree --edges` to hide procedural
  macro dependencies.][cargo/9488]
- [A new environment variable named `CARGO_TARGET_TMPDIR` is available.][cargo/9375]
  This variable points to a directory that integration tests and benches
  can use as a "scratchpad" for testing filesystem operations.</changelog>
  <changelog author="william.brown@suse.com" date="1628251200">- Change llvm_bundling to be required on s390x on 15.3 due to an llvm11
  codegen issue.</changelog>
</package>
<package pkgid="78de7c30baa5210eeadb7c0d5c902c97ddda607970fbb246082b2951407da5db" name="cargo1.54" arch="s390x">
  <version epoch="0" ver="1.54.0" rel="7.3.1"/>
  <changelog author="william.brown@suse.com" date="1627646400">Version 1.54.0 (2021-07-29)
  Language
- [You can now use macros for values in built-in attribute macros.][83366]
  While a seemingly minor addition on its own, this enables a lot of
  powerful functionality when combined correctly. Most notably you can
  now include external documentation in your crate by writing the following.
  ```rust
  [#]![doc = include_str!("README.md")]
  ```
  You can also use this to include auto-generated modules:
  ```rust
  [#][path = concat!(env!("OUT_DIR"), "/generated.rs")]
  mod generated;
  ```
- [You can now cast between unsized slice types (and types which contain
  unsized slices) in `const fn`.][85078]
- [You can now use multiple generic lifetimes with `impl Trait` where the
  lifetimes don't explicitly outlive another.][84701] In code this means
  that you can now have `impl Trait&lt;'a, 'b&gt;` where as before you could
  only have `impl Trait&lt;'a, 'b&gt; where 'b: 'a`.
  Compiler
- [Rustc will now search for custom JSON targets in
  `/lib/rustlib/&lt;target-triple&gt;/target.json` where `/` is the "sysroot"
  directory.][83800] You can find your sysroot directory by running
  `rustc --print sysroot`.
- [Added `wasm` as a `target_family` for WebAssembly platforms.][84072]
- [You can now use `#[target_feature]` on safe functions when targeting
  WebAssembly platforms.][84988]
- [Improved debugger output for enums on Windows MSVC platforms.][85292]
- [Added tier 3\* support for `bpfel-unknown-none`
  and `bpfeb-unknown-none`.][79608]
  \* Refer to Rust's [platform support page][platform-support-doc] for more
  information on Rust's tiered platform support.
  Libraries
- [`panic::panic_any` will now `#[track_caller]`.][85745]
- [Added `OutOfMemory` as a variant of `io::ErrorKind`.][84744]
- [ `proc_macro::Literal` now implements `FromStr`.][84717]
- [The implementations of vendor intrinsics in core::arch have been
  significantly refactored.][83278] The main user-visible changes are
  a 50% reduction in the size of libcore.rlib and stricter validation
  of constant operands passed to intrinsics. The latter is technically
  a breaking change, but allows Rust to more closely match the C vendor
  intrinsics API.
  Stabilized APIs
- [`BTreeMap::into_keys`]
- [`BTreeMap::into_values`]
- [`HashMap::into_keys`]
- [`HashMap::into_values`]
- [`arch::wasm32`]
- [`VecDeque::binary_search`]
- [`VecDeque::binary_search_by`]
- [`VecDeque::binary_search_by_key`]
- [`VecDeque::partition_point`]
  Cargo
-----
- [Added the `--prune &lt;spec&gt;` option to `cargo-tree` to remove a package from
  the dependency graph.][cargo/9520]
- [Added the `--depth` option to `cargo-tree` to print only to a certain depth
  in the tree ][cargo/9499]
- [Added the `no-proc-macro` value to `cargo-tree --edges` to hide procedural
  macro dependencies.][cargo/9488]
- [A new environment variable named `CARGO_TARGET_TMPDIR` is available.][cargo/9375]
  This variable points to a directory that integration tests and benches
  can use as a "scratchpad" for testing filesystem operations.</changelog>
  <changelog author="william.brown@suse.com" date="1628251200">- Change llvm_bundling to be required on s390x on 15.3 due to an llvm11
  codegen issue.</changelog>
</package>
<package pkgid="7cfec386ba21996a38500399965f9ebff2e5928b72eab4983efc482ccfd9e874" name="cargo1.54" arch="x86_64">
  <version epoch="0" ver="1.54.0" rel="7.3.1"/>
  <changelog author="william.brown@suse.com" date="1627646400">Version 1.54.0 (2021-07-29)
  Language
- [You can now use macros for values in built-in attribute macros.][83366]
  While a seemingly minor addition on its own, this enables a lot of
  powerful functionality when combined correctly. Most notably you can
  now include external documentation in your crate by writing the following.
  ```rust
  [#]![doc = include_str!("README.md")]
  ```
  You can also use this to include auto-generated modules:
  ```rust
  [#][path = concat!(env!("OUT_DIR"), "/generated.rs")]
  mod generated;
  ```
- [You can now cast between unsized slice types (and types which contain
  unsized slices) in `const fn`.][85078]
- [You can now use multiple generic lifetimes with `impl Trait` where the
  lifetimes don't explicitly outlive another.][84701] In code this means
  that you can now have `impl Trait&lt;'a, 'b&gt;` where as before you could
  only have `impl Trait&lt;'a, 'b&gt; where 'b: 'a`.
  Compiler
- [Rustc will now search for custom JSON targets in
  `/lib/rustlib/&lt;target-triple&gt;/target.json` where `/` is the "sysroot"
  directory.][83800] You can find your sysroot directory by running
  `rustc --print sysroot`.
- [Added `wasm` as a `target_family` for WebAssembly platforms.][84072]
- [You can now use `#[target_feature]` on safe functions when targeting
  WebAssembly platforms.][84988]
- [Improved debugger output for enums on Windows MSVC platforms.][85292]
- [Added tier 3\* support for `bpfel-unknown-none`
  and `bpfeb-unknown-none`.][79608]
  \* Refer to Rust's [platform support page][platform-support-doc] for more
  information on Rust's tiered platform support.
  Libraries
- [`panic::panic_any` will now `#[track_caller]`.][85745]
- [Added `OutOfMemory` as a variant of `io::ErrorKind`.][84744]
- [ `proc_macro::Literal` now implements `FromStr`.][84717]
- [The implementations of vendor intrinsics in core::arch have been
  significantly refactored.][83278] The main user-visible changes are
  a 50% reduction in the size of libcore.rlib and stricter validation
  of constant operands passed to intrinsics. The latter is technically
  a breaking change, but allows Rust to more closely match the C vendor
  intrinsics API.
  Stabilized APIs
- [`BTreeMap::into_keys`]
- [`BTreeMap::into_values`]
- [`HashMap::into_keys`]
- [`HashMap::into_values`]
- [`arch::wasm32`]
- [`VecDeque::binary_search`]
- [`VecDeque::binary_search_by`]
- [`VecDeque::binary_search_by_key`]
- [`VecDeque::partition_point`]
  Cargo
-----
- [Added the `--prune &lt;spec&gt;` option to `cargo-tree` to remove a package from
  the dependency graph.][cargo/9520]
- [Added the `--depth` option to `cargo-tree` to print only to a certain depth
  in the tree ][cargo/9499]
- [Added the `no-proc-macro` value to `cargo-tree --edges` to hide procedural
  macro dependencies.][cargo/9488]
- [A new environment variable named `CARGO_TARGET_TMPDIR` is available.][cargo/9375]
  This variable points to a directory that integration tests and benches
  can use as a "scratchpad" for testing filesystem operations.</changelog>
  <changelog author="william.brown@suse.com" date="1628251200">- Change llvm_bundling to be required on s390x on 15.3 due to an llvm11
  codegen issue.</changelog>
</package>
<package pkgid="ccdca9de799a10ab70cbd3312054e8adc08ee2712530344b48fa34ae4b8e19a5" name="cargo1.54-doc" arch="noarch">
  <version epoch="0" ver="1.54.0" rel="7.3.1"/>
  <changelog author="william.brown@suse.com" date="1627646400">Version 1.54.0 (2021-07-29)
  Language
- [You can now use macros for values in built-in attribute macros.][83366]
  While a seemingly minor addition on its own, this enables a lot of
  powerful functionality when combined correctly. Most notably you can
  now include external documentation in your crate by writing the following.
  ```rust
  [#]![doc = include_str!("README.md")]
  ```
  You can also use this to include auto-generated modules:
  ```rust
  [#][path = concat!(env!("OUT_DIR"), "/generated.rs")]
  mod generated;
  ```
- [You can now cast between unsized slice types (and types which contain
  unsized slices) in `const fn`.][85078]
- [You can now use multiple generic lifetimes with `impl Trait` where the
  lifetimes don't explicitly outlive another.][84701] In code this means
  that you can now have `impl Trait&lt;'a, 'b&gt;` where as before you could
  only have `impl Trait&lt;'a, 'b&gt; where 'b: 'a`.
  Compiler
- [Rustc will now search for custom JSON targets in
  `/lib/rustlib/&lt;target-triple&gt;/target.json` where `/` is the "sysroot"
  directory.][83800] You can find your sysroot directory by running
  `rustc --print sysroot`.
- [Added `wasm` as a `target_family` for WebAssembly platforms.][84072]
- [You can now use `#[target_feature]` on safe functions when targeting
  WebAssembly platforms.][84988]
- [Improved debugger output for enums on Windows MSVC platforms.][85292]
- [Added tier 3\* support for `bpfel-unknown-none`
  and `bpfeb-unknown-none`.][79608]
  \* Refer to Rust's [platform support page][platform-support-doc] for more
  information on Rust's tiered platform support.
  Libraries
- [`panic::panic_any` will now `#[track_caller]`.][85745]
- [Added `OutOfMemory` as a variant of `io::ErrorKind`.][84744]
- [ `proc_macro::Literal` now implements `FromStr`.][84717]
- [The implementations of vendor intrinsics in core::arch have been
  significantly refactored.][83278] The main user-visible changes are
  a 50% reduction in the size of libcore.rlib and stricter validation
  of constant operands passed to intrinsics. The latter is technically
  a breaking change, but allows Rust to more closely match the C vendor
  intrinsics API.
  Stabilized APIs
- [`BTreeMap::into_keys`]
- [`BTreeMap::into_values`]
- [`HashMap::into_keys`]
- [`HashMap::into_values`]
- [`arch::wasm32`]
- [`VecDeque::binary_search`]
- [`VecDeque::binary_search_by`]
- [`VecDeque::binary_search_by_key`]
- [`VecDeque::partition_point`]
  Cargo
-----
- [Added the `--prune &lt;spec&gt;` option to `cargo-tree` to remove a package from
  the dependency graph.][cargo/9520]
- [Added the `--depth` option to `cargo-tree` to print only to a certain depth
  in the tree ][cargo/9499]
- [Added the `no-proc-macro` value to `cargo-tree --edges` to hide procedural
  macro dependencies.][cargo/9488]
- [A new environment variable named `CARGO_TARGET_TMPDIR` is available.][cargo/9375]
  This variable points to a directory that integration tests and benches
  can use as a "scratchpad" for testing filesystem operations.</changelog>
  <changelog author="william.brown@suse.com" date="1628251200">- Change llvm_bundling to be required on s390x on 15.3 due to an llvm11
  codegen issue.</changelog>
</package>
<package pkgid="5bdb316711c5d7b2665298bb301cd24b01fb4ff96596d677e57d44a0a479126e" name="caribou" arch="aarch64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="6f27bbf7b3cd698c7f6d67195163aff74de8b67881a356a2f3c267304907274b" name="caribou" arch="ppc64le">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="a7b86a319d8e202770b882e7253df243feae90b4326793abeec227a07d77c7b0" name="caribou" arch="s390x">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="70c468f903b13c571694e301be4ddd27644dd14af616af6e084be53029f254b8" name="caribou" arch="src">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="dimstar@opensuse.org" date="1379764800">- Change RPM Group of shared library package to System/Libraries.</changelog>
  <changelog author="dimstar@opensuse.org" date="1384862400">- Update to version 0.4.13:
  + bgo#698746: Accessibility: "slow keys" breaks "screen keyboard"
    feature.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1394798400">- Move caribou schema and keyboard layout files to a caribou-common
  package. They are required by libcaribou, which is used by
  gnome-shell if the on-screen keyboard is enabled. (bnc#861360)</changelog>
  <changelog author="dimstar@opensuse.org" date="1410177600">- Update to version 0.4.14:
  + bgo#720653: some string in daemon.vala is not available for
    translation.
  + bgo#722355: #!/usr/bin/python in tools/fix_gir.py.
  + bgo#735504: Fails to build with latest vala.
  + bgo#683712: Invocation of on screen keyboard.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1410868800">- Update to version 0.4.15:
  + Fix race condition when invoking OSK through D-Bus
    (bgo#683712).</changelog>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="693225abf1732885866b844dbee098e4af39455d96c1d1bc6f8c0a781aa7ec36" name="caribou" arch="x86_64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="fce23c24e1cdb8e38893efe85aabf680d669c70d0b912982c8aff1d0aa485007" name="caribou-common" arch="aarch64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="e8bccb79aa39780e0863f4b888211d431ad043a042010c471287bb8a20f588c5" name="caribou-common" arch="ppc64le">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="dcf068b96efe61dca59e21c6a619297d66dfb0e3a0760810739819f9e7d2c48d" name="caribou-common" arch="s390x">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="22c56a01c5fcbe2c50add7bf463c62abf063482d1f8db9450e4572c8e71a1002" name="caribou-common" arch="x86_64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="a2fc2b2f8900093866cd0dde50f598d12e7d573ec378a5cab287069f6b84056b" name="caribou-devel" arch="aarch64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="b6d7bdffbaff17a36463ba112b3713022c316d208a86595baf59bba7e6e0c8de" name="caribou-devel" arch="ppc64le">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="c58c25c8dbca57d85c604c80cbfeb960177d5d7c57fa38bbb6a893922aaf0505" name="caribou-devel" arch="s390x">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="e5b1c2a5b2ef3579b3ced1696f41fb7fd688e963f545963f2658de2e909639b1" name="caribou-devel" arch="x86_64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="82620683f6f95c2e49d8117127c4ccb778c212b85cfec0edb9780b5ea6dd99a5" name="caribou-gtk-module-common" arch="aarch64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="285a1f20da4402a2097f0dfb0abc9bfd3582ec9fa2ca147f01d0932ab6778745" name="caribou-gtk-module-common" arch="ppc64le">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="a2cf1e5c43e666deab339f2f8e562ee4fb90b2aac6e319089083b74447e173bb" name="caribou-gtk-module-common" arch="s390x">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="16a518745207c88cb94bfa16b9c81a352d1080f74e531e9dcd26b8de0ba08260" name="caribou-gtk-module-common" arch="x86_64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="0892e3c6326668c0a365d3d2979e71bd8318640f7882c1c5494f1aa585b5bc94" name="caribou-gtk2-module" arch="aarch64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="6648cafa64427a8007224a6010983396000c790e21d2664b1ee0d6d37042555c" name="caribou-gtk2-module" arch="ppc64le">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="ed19dd644c12ee0f9d75238694541506898497a481baae4507efd9790d14ed14" name="caribou-gtk2-module" arch="s390x">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="2386022d7ba5c6530687ecf5e7cefea2955b813dd60b4c1c5ba6c2a96255778f" name="caribou-gtk2-module" arch="x86_64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="e9a72a8774627dd51f9748b924267a2c36d78b9717f256a9a744105662c382c1" name="caribou-gtk3-module" arch="aarch64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="05941aa0cdde52bef1b6643ad7813df6d35da6961013e6aa7ab192a7f43c4c85" name="caribou-gtk3-module" arch="ppc64le">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="3638520102f5056c58f6fd9166a952ae74501c5ddee04162871c1e0023961ba3" name="caribou-gtk3-module" arch="s390x">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="64f67fe7316834df7c990109b35e423a74cfce084f5ea999d6973a6abd785457" name="caribou-gtk3-module" arch="x86_64">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="d1f845da481a3fc371703def1639991f3fb4a9bdab5ebd40c7680d291df0b24b" name="caribou-lang" arch="noarch">
  <version epoch="0" ver="0.4.21" rel="12.5.1"/>
  <changelog author="zaitor@opensuse.org" date="1416830400">- Update to version 0.4.16:
  + Stop using deprecated accessibility events ("focus:*").
  + bgo#739837: Allow label overwrite in keyboard layout.
  + bgo#739716: Add more keys to label_map.
  + bgo#739711: Escape key does not work in us layout.
  + bgo#739526: Some buttons do not have a label.
  + bgo#722634: [regression] build failure: ImportError: No module
    named 'caribou_settings'.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1424088000">- Update to version 0.4.17:
  + Bundle tools to generate and manipulate keyboard layout files.
  + bgo#691811: Add support for azerty layout as seen in french.
  + bgo#743267: Caribou does 100-130 syscalls for each keypress.
  + bgo#743880: String that is hard to understand.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1426852800">- Update to version 0.4.18:
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1429099200">- Update to version 0.4.18.1:
  + bgo#747273: display-adapter: Allow setting an external default
    adapter instance.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1444737600">- Update to version 0.4.19:
  + xadapter: Avoid a crash when Xkl doesn't know the real xkb
    groups (bgo#756194).</changelog>
  <changelog author="dimstar@opensuse.org" date="1455624000">- Update to version 0.4.20:
  + bgo#758490: Please make caribou compatible with python3.
  + bgo#759896: German (qwertz) fullscale layout.
  + bgo#760470: Proposing a new fullscale keyboard layout.
  + bgo#756623: No Polish diacritic letters.
  + Updated translations.</changelog>
  <changelog author="mgorse@suse.com" date="1460635200">- Update to GNOME 3.20  Fate#318572</changelog>
  <changelog author="zaitor@opensuse.org" date="1469448000">- Update to version 0.4.21:
  + bgo#768104: Initialize Clutter explicitly in antler code.
  + bgo#768105: Fix theme parsing error for antler keyboard
    style.css.
  + bgo#767664: Add missing python3 compatibility.
  + Updated translations.</changelog>
  <changelog author="fcrozat@suse.com" date="1510315200">- Switch build to python3.
- Remove glib2_gsettings_schema macros calls in post/postun, not
  needed anymore with filetriggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1511956800">- Drop %py_requires: this is a python2 dependency, but the package
  was already migrated to python3.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="dimstar@opensuse.org" date="1580385600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="fcrozat@suse.com" date="1581336000">- Add python3-gobject BuildRequires: We eliminated an auto-pull-in
  of the python stack for consumers of the C-headers. Caribou uses
  both.</changelog>
  <changelog author="mgorse@suse.com" date="1622635200">- Add caribou-vala-build-fix.patch: fix build with newer valac
  versions (boo#1186617).
- Add caribou-CVE-2021-3567.patch: fix segfault when attempting to
  use shifted characters (boo#1186617 CVE-2021-3567).</changelog>
  <changelog author="mgorse@suse.com" date="1625054400">- Add caribou-css-fix.patch: fix failure to start in GNOME
  flashback (boo#1187112).</changelog>
</package>
<package pkgid="29e74f46841b29d9601af76cd745db11928146dd4da4761ef6b8aec7f573d544" name="cepces" arch="noarch">
  <version epoch="0" ver="0.3.4" rel="7.3.1"/>
  <changelog author="daniel.uvehag@gmail.com" date="1467028800">- Initial package.</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1517486400">- Update to version 0.2.1-1</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1517832000">- Update to version 0.3.0-1</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1564401600">- Update to version 0.3.3-1</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1564401601">- Add missing log directory</changelog>
  <changelog author="dmulder@suse.com" date="1624968000">- v0.3.3: Initial submission of sources; (jsc#SLE-18457).</changelog>
  <changelog author="dmulder@suse.com" date="1626091200">- v0.3.4: Allow overriding of parameters from the command line
  - Removed upstreamed patch 0001-Added-Kerberos-delegation.patch
  - Removed upstreamed patch 0001-Allow-overriding-of-server-auth-from-the-command-lin.patch
  - Removed upstreamed patch 0001-add-SELinux-permissions-for-RHEL-6.patch</changelog>
  <changelog author="dmulder@suse.com" date="1626696000">- Fix configuration missing global section.
- Add a test runner for executing unittests, and github CI.</changelog>
  <changelog author="dmulder@suse.com" date="1629374400">- Disable selinux where not supported; (jsc#SLE-18456).</changelog>
</package>
<package pkgid="d33d40d542946fcba98be77140a09df4ce655a4e7a5c3c8eaff5a9b7a094a3a6" name="cepces" arch="src">
  <version epoch="0" ver="0.3.4" rel="7.3.1"/>
  <changelog author="daniel.uvehag@gmail.com" date="1467028800">- Initial package.</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1517486400">- Update to version 0.2.1-1</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1517832000">- Update to version 0.3.0-1</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1564401600">- Update to version 0.3.3-1</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1564401601">- Add missing log directory</changelog>
  <changelog author="dmulder@suse.com" date="1624968000">- v0.3.3: Initial submission of sources; (jsc#SLE-18457).</changelog>
  <changelog author="dmulder@suse.com" date="1626091200">- v0.3.4: Allow overriding of parameters from the command line
  - Removed upstreamed patch 0001-Added-Kerberos-delegation.patch
  - Removed upstreamed patch 0001-Allow-overriding-of-server-auth-from-the-command-lin.patch
  - Removed upstreamed patch 0001-add-SELinux-permissions-for-RHEL-6.patch</changelog>
  <changelog author="dmulder@suse.com" date="1626696000">- Fix configuration missing global section.
- Add a test runner for executing unittests, and github CI.</changelog>
  <changelog author="dmulder@suse.com" date="1629374400">- Disable selinux where not supported; (jsc#SLE-18456).</changelog>
</package>
<package pkgid="9e9dbae2f62f046487ed8a6ee6fe894c662939102328395cb0fa18febaeb1f5e" name="cepces-certmonger" arch="noarch">
  <version epoch="0" ver="0.3.4" rel="7.3.1"/>
  <changelog author="daniel.uvehag@gmail.com" date="1467028800">- Initial package.</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1517486400">- Update to version 0.2.1-1</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1517832000">- Update to version 0.3.0-1</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1564401600">- Update to version 0.3.3-1</changelog>
  <changelog author="daniel.uvehag@gmail.com" date="1564401601">- Add missing log directory</changelog>
  <changelog author="dmulder@suse.com" date="1624968000">- v0.3.3: Initial submission of sources; (jsc#SLE-18457).</changelog>
  <changelog author="dmulder@suse.com" date="1626091200">- v0.3.4: Allow overriding of parameters from the command line
  - Removed upstreamed patch 0001-Added-Kerberos-delegation.patch
  - Removed upstreamed patch 0001-Allow-overriding-of-server-auth-from-the-command-lin.patch
  - Removed upstreamed patch 0001-add-SELinux-permissions-for-RHEL-6.patch</changelog>
  <changelog author="dmulder@suse.com" date="1626696000">- Fix configuration missing global section.
- Add a test runner for executing unittests, and github CI.</changelog>
  <changelog author="dmulder@suse.com" date="1629374400">- Disable selinux where not supported; (jsc#SLE-18456).</changelog>
</package>
<package pkgid="9325b4eaecf13e2c2121c02e8580fae148fbe619aedffc22dd61330b59e6e438" name="ceph" arch="src">
  <version epoch="0" ver="14.2.22.404+gf74e15c2e55" rel="3.69.2"/>
  <changelog author="ncutler@suse.com" date="1585310400">- Update to 14.2.5-389-gb0f23ac248:
  + fix Nonce reuse in msgr V2 secure mode (bsc#1166403, CVE-2020-1759)
  + prevent RGW GetObject header-splitting XSS (bsc#1166484, CVE-2020-1760)</changelog>
  <changelog author="ncutler@suse.com" date="1590408000">- Update to 14.2.9-969-g9917342dc8d:
  * rebase on top of upstream nautilus, SHA1 ccd9c04f88e53aef7e4f1068ce1221fa3b97450d
  * cmake: Improve test for 16-byte atomic support on IBM Z
  * (jsc#SES-680) monitoring: add details to Prometheus alerts
  * (bsc#1155045) mgr/dashboard: add debug mode, and accept expected exception when SSL handshaking
  * (bsc#1152100) monitoring: alert for prediction of disk and pool fill up broken
  * (bsc#1155262) mgr/dashboard: iSCSI targets not available if any gateway is down
  * (bsc#1159689) os/bluestore: more flexible DB volume space usage
  * (bsc#1156087) ceph-volume: make get_devices fs location independent
  * (bsc#1156409) monitoring: wait before firing osd full alert
  * (bsc#1160626) mgr/dashboard: Unable to remove an iSCSI gateway that is already in use
  * (bsc#1161718) mount.ceph: remove arbitrary limit on size of name= option
  * (bsc#1162553) ceph-volume: strip _dmcrypt suffix in simple scan json output
  * (bsc#1163119) mgr/dashboard: Not able to restrict bucket creation for new user
  * (bsc#1164571) mgr/dashboard: Prevent iSCSI target recreation when editing controls
  * (bsc#1165713) mgr/dashboard: Repair broken grafana panels
  * (bsc#1165835) rgw: get barbican secret key request maybe return error code
  * (bsc#1165840) rgw: making implicit_tenants backwards compatible
  * (bsc#1166297) mgr/dashboard: Repair broken grafana panels
  * (bsc#1166393) mgr/dashboard: KeyError on dashboard reload
  * (bsc#1166624) mgr/dashboard: Fix iSCSI's username and password validation
  * (bsc#1166670) monitoring: root volume full alert fires false positives
  * (bsc#1166932) mgr: synchronize ClusterState's health and mon_status
  * (bsc#1168403) mgr/dashboard: Add more debug information to Dashboard RGW backend
  * (bsc#1169356) rgw: reshard: skip stale bucket id entries from reshard queue
  * (bsc#1170938) mon/OSDMonitor: allow trimming maps even if osds are down
  * (bsc#1171367) Set OSD's bluefs-buffered-io param to false by default</changelog>
  <changelog author="ncutler@suse.com" date="1592136000">- Update to 14.2.9-970-ged84cae0c9:
  + rgw: sanitize newlines in s3 CORSConfiguration's ExposeHeader
    (bsc#1171921, CVE-2020-10753)</changelog>
  <changelog author="ncutler@suse.com" date="1593172800">- Update to 14.2.10-392-gb3a13b81cb:
  + Upstream 14.2.10 release
    see https://ceph.io/releases/v14-2-10-nautilus-released/
  * mgr: Improve internal python to c++ interface (bsc#1167477)</changelog>
  <changelog author="ncutler@suse.com" date="1597406400">- Update to 14.2.11-394-g9cbbc473c0:
  + Upstream 14.2.11 release
    see https://ceph.io/releases/v14-2-11-nautilus-released/
  * mgr/progress: Skip pg_summary update if _events dict is empty
    (bsc#1167477) (bsc#1172142) (bsc#1171956)
  * mgr/dashboard: Allow to edit iSCSI target with active session
    (bsc#1173339)</changelog>
  <changelog author="ncutler@suse.com" date="1603368000">- Update to 14.2.12-436-g6feab505b7:
  + Upstream 14.2.12 release
    see https://ceph.io/releases/v14-2-12-nautilus-released/
  * (bsc#1169134) mgr/dashboard: document Prometheus' security model
  * (bsc#1170487) monclient: schedule first tick using mon_client_hunt_interval
  * (bsc#1172546) os/bluestore: fix collection_list ordering
  * (bsc#1174591) mgr/dashboard: Unable to edit iSCSI logged-in client
  * (bsc#1174591) mgr/dashboard: Allow editing iSCSI targets with initiators logged-in
  * (bsc#1175061) os/bluestore: dump onode that has too many spanning blobs
  * (bsc#1175240) pybind/mgr/restful: use dict.items() for py3 compatible
  * (bsc#1175585) mgr/dashboard: Fix many-to-many issue in host-details Grafana dashboard
  + (bsc#1175781) ceph-volume: lvmcache: print help correctly
  + spec: move python-enum34 into rhel 7 conditional</changelog>
  <changelog author="ncutler@suse.com" date="1604404800">- Update to 14.2.13-398-gb6c514eec7:
  + Upstream 14.2.13 release
    see https://ceph.io/releases/v14-2-13-nautilus-released/
  * (bsc#1151612, bsc#1158257) ceph-volume: major batch refactor</changelog>
  <changelog author="ncutler@suse.com" date="1605182400">- Update to 14.2.13-447-g4d9ac2b00a:
  + rebase on top of upstream nautilus branch, SHA1 04747f7b3800889f24311e0ef15e0531a2cc4d8d
  * rbd: rbd-nbd: don't ignore namespace when unmapping by image spec
  * rbd: librbd: ignore -ENOENT error when disabling object-map
  * rgw: radosgw-admin should paginate internally when listing bucket
  * rgw: fix expiration header returned even if there is only one tag in the
    object the same as the rule
  * rgw: fix S3 API KeyCount incorrect return
  * osdc/ObjectCacher: overwrite might cause stray read request callbacks
  * mgr/dashboard: redirect to original URL after successful login
  * mgr/dashboard: Strange iSCSI discovery auth behavior
  * mgr/prometheus: add pool compression stats
  * bluestore: BlockDevice.cc: use pending_aios instead of iovec size as ios num
  * bluestore: test/objectstore/store_test: kill ExcessiveFragmentation test case
  * bluestore: Support flock retry
  * bluestore: attach csum for compressed blobs
  * mgr: fix race between module load and notify
  * mon: set session_timeout when adding to session_map</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 14.2.13-450-g65ea1b614d:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1607342400">- Update to 14.2.15-400-gee47c9760b:
  + rebase on top of upstream nautilus branch, SHA1 afdd217ae5fb1ed3f60e16bd62357ca58cc650e5
    Upstream 14.2.15 release
    see https://ceph.io/releases/v14-2-15-nautilus-released/
  * (bsc#1179139) os/bluestore: fix "end reached" check in collection_list_legacy
    Upstream 14.2.14 release
    see https://ceph.io/releases/v14-2-14-nautilus-released/
  + (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608292800">- Update to 14.2.16-402-g7d47dbaf4d:
  + rebase on top of upstream 14.2.16 release
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation
    possible via ceph_volume_client Python interface
  + (bsc#1180118) bluestore: provide a different name for fallback allocator</changelog>
  <changelog author="ncutler@suse.com" date="1615809600">- Update to 14.2.17-398-ge4ac8c76b3:
  + rebase on top of upstream 14.2.17 release
    (see https://ceph.io/releases/v14-2-17-nautilus-released/ for more information)
  * (bsc#1178905) - (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1179997) - (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1145463) mgr/dashboard: prometheus alerting: add some leeway for package drops and errors
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177200) rpm: ceph-mgr-dashboard recommends python3-saml on SUSE
  * (bsc#1178235) mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1180118) bluestore: provide a different name for fallback allocator
  * (bsc#1181378) test/run-cli-tests: use cram from github
  + (bsc#1183487) mgr/dashboard: fix "Python2 Cookie module import fails on Python3"
  + Dropped downstream patches:
  * common: make ms_bind_msgr2 default to 'false' (bsc#1180594)
  * Revert: "rgw_file: introduce fast S3 Unix stats (immutable)" (feature has
    baked upstream for several releases already)</changelog>
  <changelog author="ncutler@suse.com" date="1617710400">- Update to 14.2.19-398-gcc56198fca:
  + rebase on top of upstream 14.2.19 release
  * https://ceph.io/releases/v14-2-19-nautilus-released/
    (fixes a regression introduced in 14.2.17)
  * https://ceph.io/releases/v14-2-18-nautilus-released/</changelog>
  <changelog author="ncutler@suse.com" date="1617710401">- Update to 14.2.19-401-gadd8adc54d:
  + fix ceph-test build breakage
  * cmake: only link against necessary libs
  * cmake: SKIP_RPATH if RPATH is not necessary
  * cmake: set empty RPATH for some test executables</changelog>
  <changelog author="ncutler@suse.com" date="1618315200">- _constraints: raise s390x disk constraint to 42G after seeing a build fail
  with "write error: No space left on device"</changelog>
  <changelog author="ncutler@suse.com" date="1618920000">- Update to 14.2.20-402-g6aa76c6815:
  + rebase on top of Ceph 14.2.20 release
  * https://ceph.io/releases/v14-2-20-nautilus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + mgr: add mon metadata using type of "mon"</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 14.2.21-403-g69ab6ea274d:
  + rebase on top of Ceph v14.2.21 tag
    https://ceph.io/releases/v14-2-21-nautilus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1623240000">- Update to 14.2.21-410-gdf7b47d7dfd:
  + (bsc#1183760) os/FileStore: don't propagate split/merge error to "create"/"remove"
  + (bsc#1185049) os/FileStore: fix to handle readdir error correctly</changelog>
  <changelog author="ncutler@suse.com" date="1625313600">- Update to 14.2.22-403-g54cdaf6e510:
  + rebase on top of Ceph v14.2.22 tag
    https://ceph.io/releases/v14-2-22-nautilus-released/
  * (bsc#1175086) mgr/dashboard: show partially deleted RBDs
  * (bsc#1184517) cls/rgw: look for plain entries in non-ascii plain namespace too
  + mgr/dashboard: fix monitoring menu item in downstream branding</changelog>
  <changelog author="ncutler@suse.com" date="1627473600">- Update to 14.2.22-404-gf74e15c2e55:
  + (bsc#1187584) osd: fix scrub reschedule bug</changelog>
</package>
<package pkgid="5029c168e995c86bdd971d325fd071451de201898eb54ba99ae6d0f7860d3cda" name="ceph" arch="src">
  <version epoch="0" ver="14.2.22.445+ga68959d39a6" rel="3.72.1"/>
  <changelog author="ncutler@suse.com" date="1592136000">- Update to 14.2.9-970-ged84cae0c9:
  + rgw: sanitize newlines in s3 CORSConfiguration's ExposeHeader
    (bsc#1171921, CVE-2020-10753)</changelog>
  <changelog author="ncutler@suse.com" date="1593172800">- Update to 14.2.10-392-gb3a13b81cb:
  + Upstream 14.2.10 release
    see https://ceph.io/releases/v14-2-10-nautilus-released/
  * mgr: Improve internal python to c++ interface (bsc#1167477)</changelog>
  <changelog author="ncutler@suse.com" date="1597406400">- Update to 14.2.11-394-g9cbbc473c0:
  + Upstream 14.2.11 release
    see https://ceph.io/releases/v14-2-11-nautilus-released/
  * mgr/progress: Skip pg_summary update if _events dict is empty
    (bsc#1167477) (bsc#1172142) (bsc#1171956)
  * mgr/dashboard: Allow to edit iSCSI target with active session
    (bsc#1173339)</changelog>
  <changelog author="ncutler@suse.com" date="1603368000">- Update to 14.2.12-436-g6feab505b7:
  + Upstream 14.2.12 release
    see https://ceph.io/releases/v14-2-12-nautilus-released/
  * (bsc#1169134) mgr/dashboard: document Prometheus' security model
  * (bsc#1170487) monclient: schedule first tick using mon_client_hunt_interval
  * (bsc#1172546) os/bluestore: fix collection_list ordering
  * (bsc#1174591) mgr/dashboard: Unable to edit iSCSI logged-in client
  * (bsc#1174591) mgr/dashboard: Allow editing iSCSI targets with initiators logged-in
  * (bsc#1175061) os/bluestore: dump onode that has too many spanning blobs
  * (bsc#1175240) pybind/mgr/restful: use dict.items() for py3 compatible
  * (bsc#1175585) mgr/dashboard: Fix many-to-many issue in host-details Grafana dashboard
  + (bsc#1175781) ceph-volume: lvmcache: print help correctly
  + spec: move python-enum34 into rhel 7 conditional</changelog>
  <changelog author="ncutler@suse.com" date="1604404800">- Update to 14.2.13-398-gb6c514eec7:
  + Upstream 14.2.13 release
    see https://ceph.io/releases/v14-2-13-nautilus-released/
  * (bsc#1151612, bsc#1158257) ceph-volume: major batch refactor</changelog>
  <changelog author="ncutler@suse.com" date="1605182400">- Update to 14.2.13-447-g4d9ac2b00a:
  + rebase on top of upstream nautilus branch, SHA1 04747f7b3800889f24311e0ef15e0531a2cc4d8d
  * rbd: rbd-nbd: don't ignore namespace when unmapping by image spec
  * rbd: librbd: ignore -ENOENT error when disabling object-map
  * rgw: radosgw-admin should paginate internally when listing bucket
  * rgw: fix expiration header returned even if there is only one tag in the
    object the same as the rule
  * rgw: fix S3 API KeyCount incorrect return
  * osdc/ObjectCacher: overwrite might cause stray read request callbacks
  * mgr/dashboard: redirect to original URL after successful login
  * mgr/dashboard: Strange iSCSI discovery auth behavior
  * mgr/prometheus: add pool compression stats
  * bluestore: BlockDevice.cc: use pending_aios instead of iovec size as ios num
  * bluestore: test/objectstore/store_test: kill ExcessiveFragmentation test case
  * bluestore: Support flock retry
  * bluestore: attach csum for compressed blobs
  * mgr: fix race between module load and notify
  * mon: set session_timeout when adding to session_map</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 14.2.13-450-g65ea1b614d:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1607342400">- Update to 14.2.15-400-gee47c9760b:
  + rebase on top of upstream nautilus branch, SHA1 afdd217ae5fb1ed3f60e16bd62357ca58cc650e5
    Upstream 14.2.15 release
    see https://ceph.io/releases/v14-2-15-nautilus-released/
  * (bsc#1179139) os/bluestore: fix "end reached" check in collection_list_legacy
    Upstream 14.2.14 release
    see https://ceph.io/releases/v14-2-14-nautilus-released/
  + (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608292800">- Update to 14.2.16-402-g7d47dbaf4d:
  + rebase on top of upstream 14.2.16 release
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation
    possible via ceph_volume_client Python interface
  + (bsc#1180118) bluestore: provide a different name for fallback allocator</changelog>
  <changelog author="ncutler@suse.com" date="1615809600">- Update to 14.2.17-398-ge4ac8c76b3:
  + rebase on top of upstream 14.2.17 release
    (see https://ceph.io/releases/v14-2-17-nautilus-released/ for more information)
  * (bsc#1178905) - (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1179997) - (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1145463) mgr/dashboard: prometheus alerting: add some leeway for package drops and errors
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177200) rpm: ceph-mgr-dashboard recommends python3-saml on SUSE
  * (bsc#1178235) mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1180118) bluestore: provide a different name for fallback allocator
  * (bsc#1181378) test/run-cli-tests: use cram from github
  + (bsc#1183487) mgr/dashboard: fix "Python2 Cookie module import fails on Python3"
  + Dropped downstream patches:
  * common: make ms_bind_msgr2 default to 'false' (bsc#1180594)
  * Revert: "rgw_file: introduce fast S3 Unix stats (immutable)" (feature has
    baked upstream for several releases already)</changelog>
  <changelog author="ncutler@suse.com" date="1617710400">- Update to 14.2.19-398-gcc56198fca:
  + rebase on top of upstream 14.2.19 release
  * https://ceph.io/releases/v14-2-19-nautilus-released/
    (fixes a regression introduced in 14.2.17)
  * https://ceph.io/releases/v14-2-18-nautilus-released/</changelog>
  <changelog author="ncutler@suse.com" date="1617710401">- Update to 14.2.19-401-gadd8adc54d:
  + fix ceph-test build breakage
  * cmake: only link against necessary libs
  * cmake: SKIP_RPATH if RPATH is not necessary
  * cmake: set empty RPATH for some test executables</changelog>
  <changelog author="ncutler@suse.com" date="1618315200">- _constraints: raise s390x disk constraint to 42G after seeing a build fail
  with "write error: No space left on device"</changelog>
  <changelog author="ncutler@suse.com" date="1618920000">- Update to 14.2.20-402-g6aa76c6815:
  + rebase on top of Ceph 14.2.20 release
  * https://ceph.io/releases/v14-2-20-nautilus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + mgr: add mon metadata using type of "mon"</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 14.2.21-403-g69ab6ea274d:
  + rebase on top of Ceph v14.2.21 tag
    https://ceph.io/releases/v14-2-21-nautilus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1623240000">- Update to 14.2.21-410-gdf7b47d7dfd:
  + (bsc#1183760) os/FileStore: don't propagate split/merge error to "create"/"remove"
  + (bsc#1185049) os/FileStore: fix to handle readdir error correctly</changelog>
  <changelog author="ncutler@suse.com" date="1625313600">- Update to 14.2.22-403-g54cdaf6e510:
  + rebase on top of Ceph v14.2.22 tag
    https://ceph.io/releases/v14-2-22-nautilus-released/
  * (bsc#1175086) mgr/dashboard: show partially deleted RBDs
  * (bsc#1184517) cls/rgw: look for plain entries in non-ascii plain namespace too
  + mgr/dashboard: fix monitoring menu item in downstream branding</changelog>
  <changelog author="ncutler@suse.com" date="1627473600">- Update to 14.2.22-404-gf74e15c2e55:
  + (bsc#1187584) osd: fix scrub reschedule bug</changelog>
  <changelog author="ncutler@suse.com" date="1635249600">- Update to 14.2.22-444-gdd017abf74a:
  + rebase on top of upstream commit 7fd0bec58c1caa46bc30e3eb65cc1287335c2703
  * (bsc#1187709) osd: move down peers out from peer_purged (PR#42240)
  * (bsc#1187584) osd: fix scrub reschedule bug (PR#41973)
  * pybind/mgr/insights: Don't persist report data (PR#43431)
  * os/bluestore: fix erroneous SharedBlob record removal during repair (PR#43365)
  * mgr/dashboard/api: set a UTF-8 locale when running pip (PR#43608)
  * common/options: Set osd_client_message_cap to 256 (PR#42617)
  * mgr/DaemonServer: skip redundant update of pgp_num_actual (PR#42240)
  * os/bluestore: Remove possibility of replay log and file inconsistency (PR#43135)
  * spec: drop use of DISABLE_RESTART_ON_UPDATE (PR#42441)
  * spec: drop %service_del_postun_without_restart (PR#42441)
  * spec: drop useless conditional block in %postun base (PR#42441)
  * pybind/ceph_volume_client: use cephfs mkdirs api (PR#42162)
  + cherry-pick additional fixes that are still pending upstream:
  * (bsc#1185747) rgw: allow to set ssl options and ciphers for beast frontend (PR#42399)
  * (bsc#1188911) OSD marked down causes wrong backfill_toofull (PR#43439)
  * (bsc#1190415) L3: OSD panic occur repeatedly when recovery an object after
    disk replacement (PR#43547)
  * (bsc#1191357) L3: bucket removal operation fails (PR#43432)</changelog>
  <changelog author="ncutler@suse.com" date="1635508800">- Update to 14.2.22-445-ga68959d39a6:
  + common: fix build failure caused by updated mozilla-nss</changelog>
</package>
<package pkgid="d497fecfb99be71bfdfce72b8277d2c496ce82b70b1fb9627914c586aef93a54" name="ceph" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="5c648ad31c684672abb59eb5998f9edfce411cd10bf2adab11807c7f6eb69c67" name="ceph" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="a4ef0c10d5d59211861a4150feee759773febcf5d4fc16e8a9d3df4e1f603d5e" name="ceph" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="ae94f247135551828ab8e815059098bbbb33d4df0b8fbdc74e60d715fa66554a" name="ceph" arch="src">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="c4741ed744a9af710487e99a514f51645778a7b6b3745eff03e8d180b5c144d9" name="ceph" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="70275a3054acbf56e960c407b5d5efe087744ef8ebe0ade4be98d25b5f79b1aa" name="ceph" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="64f15f7f3abbb5094f4f6ca8c3a18de23163ff811d742a97e59b3c284fd9945f" name="ceph" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="28312401675c5e94ab36ec86410feed1557d4375ddd961cb1fbfc655f01fc9e2" name="ceph" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="4e890b578ab1f5b1e9d490967a270d41f46b18ea51c2d3b5ceebf9b32c66466c" name="ceph" arch="src">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="007cd6f34d4ec99638f10cf0813aa9cc13a7c01a54f9afaf8c1298347fe8a798" name="ceph" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="b05d1f79e2ca74080da0fd917d2361bbe1139f0cbcb97adc9e553821f1626379" name="ceph" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="2617edaeb42fe21f54737e33d856fff49f40ab05d08d726ac78db168d2c83956" name="ceph" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="8174dc7d5b6a13d8a973238526498453e796509eb6aab6690f7231bd79ff69e7" name="ceph" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="69905e6a0884f262e17259c67ed17c968dff74c2a67715103af2e77467361020" name="ceph" arch="src">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="d8112befe17bc6a49c1a704b77eb041707f09e9605311c2c09d48bb1e9ef8952" name="ceph" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="d3c856df5ed6cb3e060dbbf2c43becad24ee94dd79c36b917e84144b6398b2f2" name="ceph-base" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="583b0aa56bf71b4edc17d77cb798325189f30d0a35d5e3d8cedc6309a03d869b" name="ceph-base" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="58352676522070ccf35113093851a1849e1dd99a70ccc4ea05fd76b9213509b4" name="ceph-base" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="cf8ca10556c6e783c2d1373d718c11a417e58088ea50648d40dc9cb2355e867f" name="ceph-base" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="27ab223673bfa47092eaf08c306d7b91083b108d14aa4d9e23a80eb790ab0ef6" name="ceph-base" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="2bc9ee65901be6b8f2d6798fa3753d3cdddfa2faa33b1e43c28f5ed141010c91" name="ceph-base" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="ce02f0fae9af42cc186339f20361dde29f4cef4aa5336f71ed7dc653fbb3fb20" name="ceph-base" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="ff0ccfbd51a884a47dae35a55981ef97795cbe8a6436d24e0377b8d986575e70" name="ceph-base" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="d5b27384ecd557f924f2fa4ce855aac4f5ae3152ddee2526a489e2f057ef878a" name="ceph-base" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="27f7e434b82c56dd7145d49984f77dbc9c8ae88f924ed5f3de5c6dce1d50edbb" name="ceph-base" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="e42869f4bd806a1c2a705c0597394f015ddc6a3595a05549c4d7201ee6d22405" name="ceph-base" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="24eb09e8d3c67957b38b3da2ef0217369164a544b0f9091abfae017556fcc200" name="ceph-base" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="d8f7dc3be048989466723ab64ecff1fd95faaa90476d66c61ebdae963530a994" name="ceph-common" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="ff43a824bd29d0746c97ff158f21d152a9dec650c1735eb77755f9843929396e" name="ceph-common" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="ad4e9e531059f0c85c3e9b4432b2d6771a8c71db0bd18a1b320c9ffa203db751" name="ceph-common" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="f179935aece025026b57eb963482d42c70322a16389f6f9c433cbaff920f8a0b" name="ceph-common" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="741e4cc3c2bfaf71ead4d18b62f21bff21ed287b64c87b1e8bade8c596198ad5" name="ceph-common" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="c5b7048320b889d5529faecff3840c798d191e27e202834e71eba459c8935262" name="ceph-common" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="64396b05fa8f8d9dcb88993a7830d2ec2305681d46f2e6895383db5000fa5957" name="ceph-common" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="67f011377c3f679cbe7c9859717ddadc16fea28281fd5ed45803dabc9ee556f7" name="ceph-common" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="406bdd82d6303718515b6955c61d0d68c6e8a5e16209762f25503788f1f99711" name="ceph-common" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="64a17a7b396efb914ea6928099c1f4f790c01e2ec2e2501b255ffd73ef2344b2" name="ceph-common" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="690e84e5b1fede43d6ad67922af10e91f0cf0a297922a6a0804bf3f0f39a3d2c" name="ceph-common" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="90a7a8b0a883086ade1d8386fd8563572c51b9c48ed5aaf34456b17d8c212895" name="ceph-common" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="1c4657bce66a3939056bc215f8c706e20264fa55457ff43c29604208faca46b6" name="ceph-dashboard-e2e" arch="noarch">
  <version epoch="0" ver="14.2.22.404+gf74e15c2e55" rel="3.69.2"/>
  <changelog author="ncutler@suse.com" date="1585310400">- Update to 14.2.5-389-gb0f23ac248:
  + fix Nonce reuse in msgr V2 secure mode (bsc#1166403, CVE-2020-1759)
  + prevent RGW GetObject header-splitting XSS (bsc#1166484, CVE-2020-1760)</changelog>
  <changelog author="ncutler@suse.com" date="1590408000">- Update to 14.2.9-969-g9917342dc8d:
  * rebase on top of upstream nautilus, SHA1 ccd9c04f88e53aef7e4f1068ce1221fa3b97450d
  * cmake: Improve test for 16-byte atomic support on IBM Z
  * (jsc#SES-680) monitoring: add details to Prometheus alerts
  * (bsc#1155045) mgr/dashboard: add debug mode, and accept expected exception when SSL handshaking
  * (bsc#1152100) monitoring: alert for prediction of disk and pool fill up broken
  * (bsc#1155262) mgr/dashboard: iSCSI targets not available if any gateway is down
  * (bsc#1159689) os/bluestore: more flexible DB volume space usage
  * (bsc#1156087) ceph-volume: make get_devices fs location independent
  * (bsc#1156409) monitoring: wait before firing osd full alert
  * (bsc#1160626) mgr/dashboard: Unable to remove an iSCSI gateway that is already in use
  * (bsc#1161718) mount.ceph: remove arbitrary limit on size of name= option
  * (bsc#1162553) ceph-volume: strip _dmcrypt suffix in simple scan json output
  * (bsc#1163119) mgr/dashboard: Not able to restrict bucket creation for new user
  * (bsc#1164571) mgr/dashboard: Prevent iSCSI target recreation when editing controls
  * (bsc#1165713) mgr/dashboard: Repair broken grafana panels
  * (bsc#1165835) rgw: get barbican secret key request maybe return error code
  * (bsc#1165840) rgw: making implicit_tenants backwards compatible
  * (bsc#1166297) mgr/dashboard: Repair broken grafana panels
  * (bsc#1166393) mgr/dashboard: KeyError on dashboard reload
  * (bsc#1166624) mgr/dashboard: Fix iSCSI's username and password validation
  * (bsc#1166670) monitoring: root volume full alert fires false positives
  * (bsc#1166932) mgr: synchronize ClusterState's health and mon_status
  * (bsc#1168403) mgr/dashboard: Add more debug information to Dashboard RGW backend
  * (bsc#1169356) rgw: reshard: skip stale bucket id entries from reshard queue
  * (bsc#1170938) mon/OSDMonitor: allow trimming maps even if osds are down
  * (bsc#1171367) Set OSD's bluefs-buffered-io param to false by default</changelog>
  <changelog author="ncutler@suse.com" date="1592136000">- Update to 14.2.9-970-ged84cae0c9:
  + rgw: sanitize newlines in s3 CORSConfiguration's ExposeHeader
    (bsc#1171921, CVE-2020-10753)</changelog>
  <changelog author="ncutler@suse.com" date="1593172800">- Update to 14.2.10-392-gb3a13b81cb:
  + Upstream 14.2.10 release
    see https://ceph.io/releases/v14-2-10-nautilus-released/
  * mgr: Improve internal python to c++ interface (bsc#1167477)</changelog>
  <changelog author="ncutler@suse.com" date="1597406400">- Update to 14.2.11-394-g9cbbc473c0:
  + Upstream 14.2.11 release
    see https://ceph.io/releases/v14-2-11-nautilus-released/
  * mgr/progress: Skip pg_summary update if _events dict is empty
    (bsc#1167477) (bsc#1172142) (bsc#1171956)
  * mgr/dashboard: Allow to edit iSCSI target with active session
    (bsc#1173339)</changelog>
  <changelog author="ncutler@suse.com" date="1603368000">- Update to 14.2.12-436-g6feab505b7:
  + Upstream 14.2.12 release
    see https://ceph.io/releases/v14-2-12-nautilus-released/
  * (bsc#1169134) mgr/dashboard: document Prometheus' security model
  * (bsc#1170487) monclient: schedule first tick using mon_client_hunt_interval
  * (bsc#1172546) os/bluestore: fix collection_list ordering
  * (bsc#1174591) mgr/dashboard: Unable to edit iSCSI logged-in client
  * (bsc#1174591) mgr/dashboard: Allow editing iSCSI targets with initiators logged-in
  * (bsc#1175061) os/bluestore: dump onode that has too many spanning blobs
  * (bsc#1175240) pybind/mgr/restful: use dict.items() for py3 compatible
  * (bsc#1175585) mgr/dashboard: Fix many-to-many issue in host-details Grafana dashboard
  + (bsc#1175781) ceph-volume: lvmcache: print help correctly
  + spec: move python-enum34 into rhel 7 conditional</changelog>
  <changelog author="ncutler@suse.com" date="1604404800">- Update to 14.2.13-398-gb6c514eec7:
  + Upstream 14.2.13 release
    see https://ceph.io/releases/v14-2-13-nautilus-released/
  * (bsc#1151612, bsc#1158257) ceph-volume: major batch refactor</changelog>
  <changelog author="ncutler@suse.com" date="1605182400">- Update to 14.2.13-447-g4d9ac2b00a:
  + rebase on top of upstream nautilus branch, SHA1 04747f7b3800889f24311e0ef15e0531a2cc4d8d
  * rbd: rbd-nbd: don't ignore namespace when unmapping by image spec
  * rbd: librbd: ignore -ENOENT error when disabling object-map
  * rgw: radosgw-admin should paginate internally when listing bucket
  * rgw: fix expiration header returned even if there is only one tag in the
    object the same as the rule
  * rgw: fix S3 API KeyCount incorrect return
  * osdc/ObjectCacher: overwrite might cause stray read request callbacks
  * mgr/dashboard: redirect to original URL after successful login
  * mgr/dashboard: Strange iSCSI discovery auth behavior
  * mgr/prometheus: add pool compression stats
  * bluestore: BlockDevice.cc: use pending_aios instead of iovec size as ios num
  * bluestore: test/objectstore/store_test: kill ExcessiveFragmentation test case
  * bluestore: Support flock retry
  * bluestore: attach csum for compressed blobs
  * mgr: fix race between module load and notify
  * mon: set session_timeout when adding to session_map</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 14.2.13-450-g65ea1b614d:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1607342400">- Update to 14.2.15-400-gee47c9760b:
  + rebase on top of upstream nautilus branch, SHA1 afdd217ae5fb1ed3f60e16bd62357ca58cc650e5
    Upstream 14.2.15 release
    see https://ceph.io/releases/v14-2-15-nautilus-released/
  * (bsc#1179139) os/bluestore: fix "end reached" check in collection_list_legacy
    Upstream 14.2.14 release
    see https://ceph.io/releases/v14-2-14-nautilus-released/
  + (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608292800">- Update to 14.2.16-402-g7d47dbaf4d:
  + rebase on top of upstream 14.2.16 release
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation
    possible via ceph_volume_client Python interface
  + (bsc#1180118) bluestore: provide a different name for fallback allocator</changelog>
  <changelog author="ncutler@suse.com" date="1615809600">- Update to 14.2.17-398-ge4ac8c76b3:
  + rebase on top of upstream 14.2.17 release
    (see https://ceph.io/releases/v14-2-17-nautilus-released/ for more information)
  * (bsc#1178905) - (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1179997) - (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1145463) mgr/dashboard: prometheus alerting: add some leeway for package drops and errors
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177200) rpm: ceph-mgr-dashboard recommends python3-saml on SUSE
  * (bsc#1178235) mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1180118) bluestore: provide a different name for fallback allocator
  * (bsc#1181378) test/run-cli-tests: use cram from github
  + (bsc#1183487) mgr/dashboard: fix "Python2 Cookie module import fails on Python3"
  + Dropped downstream patches:
  * common: make ms_bind_msgr2 default to 'false' (bsc#1180594)
  * Revert: "rgw_file: introduce fast S3 Unix stats (immutable)" (feature has
    baked upstream for several releases already)</changelog>
  <changelog author="ncutler@suse.com" date="1617710400">- Update to 14.2.19-398-gcc56198fca:
  + rebase on top of upstream 14.2.19 release
  * https://ceph.io/releases/v14-2-19-nautilus-released/
    (fixes a regression introduced in 14.2.17)
  * https://ceph.io/releases/v14-2-18-nautilus-released/</changelog>
  <changelog author="ncutler@suse.com" date="1617710401">- Update to 14.2.19-401-gadd8adc54d:
  + fix ceph-test build breakage
  * cmake: only link against necessary libs
  * cmake: SKIP_RPATH if RPATH is not necessary
  * cmake: set empty RPATH for some test executables</changelog>
  <changelog author="ncutler@suse.com" date="1618315200">- _constraints: raise s390x disk constraint to 42G after seeing a build fail
  with "write error: No space left on device"</changelog>
  <changelog author="ncutler@suse.com" date="1618920000">- Update to 14.2.20-402-g6aa76c6815:
  + rebase on top of Ceph 14.2.20 release
  * https://ceph.io/releases/v14-2-20-nautilus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + mgr: add mon metadata using type of "mon"</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 14.2.21-403-g69ab6ea274d:
  + rebase on top of Ceph v14.2.21 tag
    https://ceph.io/releases/v14-2-21-nautilus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1623240000">- Update to 14.2.21-410-gdf7b47d7dfd:
  + (bsc#1183760) os/FileStore: don't propagate split/merge error to "create"/"remove"
  + (bsc#1185049) os/FileStore: fix to handle readdir error correctly</changelog>
  <changelog author="ncutler@suse.com" date="1625313600">- Update to 14.2.22-403-g54cdaf6e510:
  + rebase on top of Ceph v14.2.22 tag
    https://ceph.io/releases/v14-2-22-nautilus-released/
  * (bsc#1175086) mgr/dashboard: show partially deleted RBDs
  * (bsc#1184517) cls/rgw: look for plain entries in non-ascii plain namespace too
  + mgr/dashboard: fix monitoring menu item in downstream branding</changelog>
  <changelog author="ncutler@suse.com" date="1627473600">- Update to 14.2.22-404-gf74e15c2e55:
  + (bsc#1187584) osd: fix scrub reschedule bug</changelog>
</package>
<package pkgid="3a4a869dc503cc66cc8b0c237e227d047ab0218b90cccf33d4c3e9a516031010" name="ceph-dashboard-e2e" arch="noarch">
  <version epoch="0" ver="14.2.22.445+ga68959d39a6" rel="3.72.1"/>
  <changelog author="ncutler@suse.com" date="1592136000">- Update to 14.2.9-970-ged84cae0c9:
  + rgw: sanitize newlines in s3 CORSConfiguration's ExposeHeader
    (bsc#1171921, CVE-2020-10753)</changelog>
  <changelog author="ncutler@suse.com" date="1593172800">- Update to 14.2.10-392-gb3a13b81cb:
  + Upstream 14.2.10 release
    see https://ceph.io/releases/v14-2-10-nautilus-released/
  * mgr: Improve internal python to c++ interface (bsc#1167477)</changelog>
  <changelog author="ncutler@suse.com" date="1597406400">- Update to 14.2.11-394-g9cbbc473c0:
  + Upstream 14.2.11 release
    see https://ceph.io/releases/v14-2-11-nautilus-released/
  * mgr/progress: Skip pg_summary update if _events dict is empty
    (bsc#1167477) (bsc#1172142) (bsc#1171956)
  * mgr/dashboard: Allow to edit iSCSI target with active session
    (bsc#1173339)</changelog>
  <changelog author="ncutler@suse.com" date="1603368000">- Update to 14.2.12-436-g6feab505b7:
  + Upstream 14.2.12 release
    see https://ceph.io/releases/v14-2-12-nautilus-released/
  * (bsc#1169134) mgr/dashboard: document Prometheus' security model
  * (bsc#1170487) monclient: schedule first tick using mon_client_hunt_interval
  * (bsc#1172546) os/bluestore: fix collection_list ordering
  * (bsc#1174591) mgr/dashboard: Unable to edit iSCSI logged-in client
  * (bsc#1174591) mgr/dashboard: Allow editing iSCSI targets with initiators logged-in
  * (bsc#1175061) os/bluestore: dump onode that has too many spanning blobs
  * (bsc#1175240) pybind/mgr/restful: use dict.items() for py3 compatible
  * (bsc#1175585) mgr/dashboard: Fix many-to-many issue in host-details Grafana dashboard
  + (bsc#1175781) ceph-volume: lvmcache: print help correctly
  + spec: move python-enum34 into rhel 7 conditional</changelog>
  <changelog author="ncutler@suse.com" date="1604404800">- Update to 14.2.13-398-gb6c514eec7:
  + Upstream 14.2.13 release
    see https://ceph.io/releases/v14-2-13-nautilus-released/
  * (bsc#1151612, bsc#1158257) ceph-volume: major batch refactor</changelog>
  <changelog author="ncutler@suse.com" date="1605182400">- Update to 14.2.13-447-g4d9ac2b00a:
  + rebase on top of upstream nautilus branch, SHA1 04747f7b3800889f24311e0ef15e0531a2cc4d8d
  * rbd: rbd-nbd: don't ignore namespace when unmapping by image spec
  * rbd: librbd: ignore -ENOENT error when disabling object-map
  * rgw: radosgw-admin should paginate internally when listing bucket
  * rgw: fix expiration header returned even if there is only one tag in the
    object the same as the rule
  * rgw: fix S3 API KeyCount incorrect return
  * osdc/ObjectCacher: overwrite might cause stray read request callbacks
  * mgr/dashboard: redirect to original URL after successful login
  * mgr/dashboard: Strange iSCSI discovery auth behavior
  * mgr/prometheus: add pool compression stats
  * bluestore: BlockDevice.cc: use pending_aios instead of iovec size as ios num
  * bluestore: test/objectstore/store_test: kill ExcessiveFragmentation test case
  * bluestore: Support flock retry
  * bluestore: attach csum for compressed blobs
  * mgr: fix race between module load and notify
  * mon: set session_timeout when adding to session_map</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 14.2.13-450-g65ea1b614d:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1607342400">- Update to 14.2.15-400-gee47c9760b:
  + rebase on top of upstream nautilus branch, SHA1 afdd217ae5fb1ed3f60e16bd62357ca58cc650e5
    Upstream 14.2.15 release
    see https://ceph.io/releases/v14-2-15-nautilus-released/
  * (bsc#1179139) os/bluestore: fix "end reached" check in collection_list_legacy
    Upstream 14.2.14 release
    see https://ceph.io/releases/v14-2-14-nautilus-released/
  + (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608292800">- Update to 14.2.16-402-g7d47dbaf4d:
  + rebase on top of upstream 14.2.16 release
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation
    possible via ceph_volume_client Python interface
  + (bsc#1180118) bluestore: provide a different name for fallback allocator</changelog>
  <changelog author="ncutler@suse.com" date="1615809600">- Update to 14.2.17-398-ge4ac8c76b3:
  + rebase on top of upstream 14.2.17 release
    (see https://ceph.io/releases/v14-2-17-nautilus-released/ for more information)
  * (bsc#1178905) - (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1179997) - (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1145463) mgr/dashboard: prometheus alerting: add some leeway for package drops and errors
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177200) rpm: ceph-mgr-dashboard recommends python3-saml on SUSE
  * (bsc#1178235) mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1180118) bluestore: provide a different name for fallback allocator
  * (bsc#1181378) test/run-cli-tests: use cram from github
  + (bsc#1183487) mgr/dashboard: fix "Python2 Cookie module import fails on Python3"
  + Dropped downstream patches:
  * common: make ms_bind_msgr2 default to 'false' (bsc#1180594)
  * Revert: "rgw_file: introduce fast S3 Unix stats (immutable)" (feature has
    baked upstream for several releases already)</changelog>
  <changelog author="ncutler@suse.com" date="1617710400">- Update to 14.2.19-398-gcc56198fca:
  + rebase on top of upstream 14.2.19 release
  * https://ceph.io/releases/v14-2-19-nautilus-released/
    (fixes a regression introduced in 14.2.17)
  * https://ceph.io/releases/v14-2-18-nautilus-released/</changelog>
  <changelog author="ncutler@suse.com" date="1617710401">- Update to 14.2.19-401-gadd8adc54d:
  + fix ceph-test build breakage
  * cmake: only link against necessary libs
  * cmake: SKIP_RPATH if RPATH is not necessary
  * cmake: set empty RPATH for some test executables</changelog>
  <changelog author="ncutler@suse.com" date="1618315200">- _constraints: raise s390x disk constraint to 42G after seeing a build fail
  with "write error: No space left on device"</changelog>
  <changelog author="ncutler@suse.com" date="1618920000">- Update to 14.2.20-402-g6aa76c6815:
  + rebase on top of Ceph 14.2.20 release
  * https://ceph.io/releases/v14-2-20-nautilus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + mgr: add mon metadata using type of "mon"</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 14.2.21-403-g69ab6ea274d:
  + rebase on top of Ceph v14.2.21 tag
    https://ceph.io/releases/v14-2-21-nautilus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1623240000">- Update to 14.2.21-410-gdf7b47d7dfd:
  + (bsc#1183760) os/FileStore: don't propagate split/merge error to "create"/"remove"
  + (bsc#1185049) os/FileStore: fix to handle readdir error correctly</changelog>
  <changelog author="ncutler@suse.com" date="1625313600">- Update to 14.2.22-403-g54cdaf6e510:
  + rebase on top of Ceph v14.2.22 tag
    https://ceph.io/releases/v14-2-22-nautilus-released/
  * (bsc#1175086) mgr/dashboard: show partially deleted RBDs
  * (bsc#1184517) cls/rgw: look for plain entries in non-ascii plain namespace too
  + mgr/dashboard: fix monitoring menu item in downstream branding</changelog>
  <changelog author="ncutler@suse.com" date="1627473600">- Update to 14.2.22-404-gf74e15c2e55:
  + (bsc#1187584) osd: fix scrub reschedule bug</changelog>
  <changelog author="ncutler@suse.com" date="1635249600">- Update to 14.2.22-444-gdd017abf74a:
  + rebase on top of upstream commit 7fd0bec58c1caa46bc30e3eb65cc1287335c2703
  * (bsc#1187709) osd: move down peers out from peer_purged (PR#42240)
  * (bsc#1187584) osd: fix scrub reschedule bug (PR#41973)
  * pybind/mgr/insights: Don't persist report data (PR#43431)
  * os/bluestore: fix erroneous SharedBlob record removal during repair (PR#43365)
  * mgr/dashboard/api: set a UTF-8 locale when running pip (PR#43608)
  * common/options: Set osd_client_message_cap to 256 (PR#42617)
  * mgr/DaemonServer: skip redundant update of pgp_num_actual (PR#42240)
  * os/bluestore: Remove possibility of replay log and file inconsistency (PR#43135)
  * spec: drop use of DISABLE_RESTART_ON_UPDATE (PR#42441)
  * spec: drop %service_del_postun_without_restart (PR#42441)
  * spec: drop useless conditional block in %postun base (PR#42441)
  * pybind/ceph_volume_client: use cephfs mkdirs api (PR#42162)
  + cherry-pick additional fixes that are still pending upstream:
  * (bsc#1185747) rgw: allow to set ssl options and ciphers for beast frontend (PR#42399)
  * (bsc#1188911) OSD marked down causes wrong backfill_toofull (PR#43439)
  * (bsc#1190415) L3: OSD panic occur repeatedly when recovery an object after
    disk replacement (PR#43547)
  * (bsc#1191357) L3: bucket removal operation fails (PR#43432)</changelog>
  <changelog author="ncutler@suse.com" date="1635508800">- Update to 14.2.22-445-ga68959d39a6:
  + common: fix build failure caused by updated mozilla-nss</changelog>
</package>
<package pkgid="7ed0914062c5f34ca402ba59ecb4a712627ca75f17b0ba41f9a9268afbeac1ea" name="ceph-fuse" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="842f02862bbf2859e22a751636241f85b26d70c7cf888f91739790d66fe2e616" name="ceph-fuse" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="6a29026ff365d03ebefbb17537afb2a99b536b4563f916fd127e888f6dd050e8" name="ceph-fuse" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="0616840d433d9e4ec48373680cbe8203373d9bd302096c1c3e3e028302342e0c" name="ceph-fuse" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="60907ac4551cc6fa8e29e9369b32738ec0e44a1d075b777feaf70e0570d959b5" name="ceph-fuse" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="be44980ad3df432f85d9ecd380948fa9c202e3d5d6f99cb52fb8288be9cc8a78" name="ceph-fuse" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="692db2c267909613df19f12ba2f05cf639ec5be5bd3ee9c3988d3433b5cbeec6" name="ceph-fuse" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="1c0c953142fba036437a7e667d12ee4066b376e16479cf78d96925a76dabe3f9" name="ceph-fuse" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="2e372c3ae077fe1c319de827ad10341ceafd866eed3983de9925c06ae18cddd3" name="ceph-fuse" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="a02113bfc8d941b4b4b6b1293dfe4d431978a66648f5829d8a7fb0847db98b44" name="ceph-fuse" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="b4cfb61780d7f623299cbf3b731ff0c2a82849bec0cf16afb2b5e2e5fc46e856" name="ceph-fuse" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="a37ef717a810b0974c746d538aefde9dbecfdd33804b70bf55883b67f7856d5f" name="ceph-fuse" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="2a6fa905cb0ca91857d35415a3702a4c53d4acedae461f88b41fb3fcc07d548c" name="ceph-grafana-dashboards" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="5562a2cede27a881a6e90e7e369f9af013357ca4069388bbd5f8a91c68c1a3d0" name="ceph-grafana-dashboards" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="9182677d91e1fa48f8a0f4b729262bab58025aa1c488fb14e1563c1382c1782e" name="ceph-grafana-dashboards" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="edf7ee77a7e47deb0e973882868a5b7cf1449990638074d73c145644ffa0645e" name="ceph-immutable-object-cache" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="e7d764e6cf6b3ee7c64efd57db6e44aecaa4232901d9339ad7b79a84cb46064c" name="ceph-immutable-object-cache" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="ac1a2848341c807a481dbf46fcc51772b90ff0cd45c0284da9df0601088e7844" name="ceph-immutable-object-cache" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="f3d23b7e5ed2662ae6a95b7daff4a7f75c64e7686973b560c050eaa6dd8fde72" name="ceph-immutable-object-cache" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="fa765a4c39b056d06dc99fea7232304057d470246e7bb0ccddcc6d2b5b6377ad" name="ceph-immutable-object-cache" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="79c89390e77f769fa9386adaff1fc66909ff03c89f45117a004740d8e081ae01" name="ceph-immutable-object-cache" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="604847d583b95ae57efbbd07c9e5ced60beb084388326e1d87e6571aa6ab65af" name="ceph-immutable-object-cache" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="ce9b574ca5ee0ebd940b9d94f4f93c2b8f0844a7f2c4072da26e416e9d1d3cb8" name="ceph-immutable-object-cache" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="51a288baad2121676cfac5beb4244ab88a15cf278ffb4402c1f1976180260f5c" name="ceph-immutable-object-cache" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="1d99c521bf9203d1dfba5f63c05cd263bc2fd46b2426223843e5ee325a669374" name="ceph-immutable-object-cache" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="3e09d7c8c07d88bbba5417767a32ee6ad7e47495c84c28ef39aece6d74c1f09a" name="ceph-immutable-object-cache" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="5d3d040aefdd7247bd8cc5afe46f268010798857d18eb1c12eeb54efb32749d8" name="ceph-immutable-object-cache" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="4be275e97b4bb9a84021f867b4b2259890d79cd667ee66eeccd4c3c1b0a158ff" name="ceph-mds" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="2f6e0e895b98be8474e41f687179f69aaa2de9243a7920581faf1a90dedd9708" name="ceph-mds" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="756f0e954632c945d36d1dd7d90cf1e120a05cd87bf4ae1a2a9b7c81db1c16ef" name="ceph-mds" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="fb7cc53aa2d3359dad1f51c137550c3abfa25bee20785bed0a14e2ee76eb1d19" name="ceph-mds" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="e7b10137bb50982ffc4e08a478465deaa8534f38863ef4cac3c0bebb856d24a3" name="ceph-mds" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="d1b21c22eca60aa30e903e821ce5ed0d0227b99e57cc1cd55062af5388021ffc" name="ceph-mds" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="f44db1bca38cfe0123f958fbc47437d8f0db2ca68ffcaf244b78f4138a508fe5" name="ceph-mds" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="d8805fabe644fe46198412838381a8dae9565eb714678f7ef4edde8d6c2087b8" name="ceph-mds" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="15be4aa0011174bfd9ce2f4116afcbf7e3b5ea2e816bc1b8f4d83a4df43e4b38" name="ceph-mds" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="254db31b29c29668fc5f29b5a0ee172f3b7b40ed708797eedc1dc69addcfb8fa" name="ceph-mds" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="7ff77a91a45b888df9217ddb8568ea33bedaa8f7a41ab7c84a934fb723023351" name="ceph-mds" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="5d154939e99c88ffe976eb2c9d0fb9267ef1528a349f81932e10179c914516de" name="ceph-mds" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="9c47f82645b0c982b94f45a2e0b6815b5264a84c8b5829be814c1e45c57e6c02" name="ceph-mgr" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="4b1e0dc9acc08eaf9802088d98c5b31e9dc1a09c5f6f8e3e88e6dee28766f0ba" name="ceph-mgr" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="3c0a81a6efde0f6a5a0b916cf7d64d15b716f94cde31d7262fbca5e9d58de0e8" name="ceph-mgr" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="0e13e71326dc905f27a4bd50adb07f084402a7f52e2122aac58d41849789862f" name="ceph-mgr" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="4b4bf319a9a47afe8ad299cbb36bb8caf96346f34c21f8eee048332daa6d6b65" name="ceph-mgr" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="d892262f34fd4a3fa904be680cc0c8bf895d64614a3f8c00571c1189f37a7779" name="ceph-mgr" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="4de8ef7f81b69835885eee666640beba25a2ff7f33598f60a736ea801d77f165" name="ceph-mgr" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="40e0a4b545d2a026cd57e66955dbdaae572596e7faca3b964d18ed30efaf068c" name="ceph-mgr" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="543cbf715227f4e93c51b030ef39416f44e63b2be037333068dc1781d8f18f1e" name="ceph-mgr" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="edf254f93c77ba9afd02c421bf7f602b2a740ba880c9d7fbf9b7cdcef937d761" name="ceph-mgr" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="df17394669fd5520f324266ddb94d5045a1ede857e85f38cec79138142593e50" name="ceph-mgr" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="3610038f8f992cef60f2735bd2a35fd53f875aeb4277a3aed152102801920568" name="ceph-mgr" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="ead20acf9e3cb48a7516465bcfd216cbad765f3ca95ecc61f60d033e3af35a0b" name="ceph-mgr-cephadm" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="7b566fe65b87a8b038b51d1ad884ccd85f8cfdab0e6a0c17fe0695afdde3ec54" name="ceph-mgr-cephadm" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="e4df8e55c6d9fa340726052ad72a4641e08533bd2cf340529b8f3c64e822c117" name="ceph-mgr-cephadm" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="a2a82a1762fd9358b8561a8759f3e1ad50c873bd6c0d8d9a981ea6b0b38abc1a" name="ceph-mgr-dashboard" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="9e58dc0d0a3ecf948c94d17abc2ad3fc41b6dadad24c78fcf0c230c361434e13" name="ceph-mgr-dashboard" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="37bac66fe328d4db8a3dfb48fa492aef6bb53b55339faa13f4b2755f4983b96a" name="ceph-mgr-dashboard" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="e4744a1675dda73fd566a5ae7cb4bef06c5dae1082174951e65aeaae3c797af6" name="ceph-mgr-diskprediction-cloud" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="bcafcfba411c2b9916886371326fe7fa2d4d645bd379faa444371267a70ee9e4" name="ceph-mgr-diskprediction-cloud" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="abd7f6ae80af08e2c10c2ec5f961894f8c06025da17e39211cbd3585ec9a949a" name="ceph-mgr-diskprediction-cloud" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="345b4cad61e13346efd7874c6570a352bb969f0e6ad53201a71bbab809a33fa9" name="ceph-mgr-diskprediction-local" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="ea53aa335db6c8903277929586943ad4d16e849a13f9ad6fed461b95fb8289ea" name="ceph-mgr-diskprediction-local" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="562fca7ec74fac0655498b71a7b1095c154533a0d0a38d17a7d43f873ae2f126" name="ceph-mgr-diskprediction-local" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="858132db3f8fcb422e0eb84e2936f28bf9f504266927ac7250e9827482e9777c" name="ceph-mgr-k8sevents" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="7b2b57d9118e2675d05ceb263742cf6f35572c65ecc9f481716e5e0c339b87ef" name="ceph-mgr-k8sevents" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="b4eb7bee1778ed37447818f3dff00a05aeb0b648d99c41bbf9277297a9980479" name="ceph-mgr-k8sevents" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="18a6896b3c69076ec1e14754151f35dbcfd494a151bfde2055929177e9bdf22b" name="ceph-mgr-modules-core" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="07d4d1dc59e388955d6314caf33fafcccb6745b6af767d2a481e53137b44a52e" name="ceph-mgr-modules-core" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="7dc61581a034c3e3264df8a2771e74ef3ba2f7ee593d4e53f65d0aeee621aff6" name="ceph-mgr-modules-core" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="dce5ad28e3b3cd093b592526b89693f9371442accfdf15fef70822d112144d70" name="ceph-mgr-rook" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="9d2001e3eb2b90474536369adb53db925b3fff5726a5a9b673419115496ea0e7" name="ceph-mgr-rook" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="168954344b7d0322eba0aa7a8f388eb04fc297e992fba709463be9bdaf5e9982" name="ceph-mgr-rook" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="f64b6452ce5411306671c9b108eecfb37bcd8c04a2678b87c4db6fef49288936" name="ceph-mgr-ssh" arch="noarch">
  <version epoch="0" ver="14.2.22.404+gf74e15c2e55" rel="3.69.2"/>
  <changelog author="ncutler@suse.com" date="1585310400">- Update to 14.2.5-389-gb0f23ac248:
  + fix Nonce reuse in msgr V2 secure mode (bsc#1166403, CVE-2020-1759)
  + prevent RGW GetObject header-splitting XSS (bsc#1166484, CVE-2020-1760)</changelog>
  <changelog author="ncutler@suse.com" date="1590408000">- Update to 14.2.9-969-g9917342dc8d:
  * rebase on top of upstream nautilus, SHA1 ccd9c04f88e53aef7e4f1068ce1221fa3b97450d
  * cmake: Improve test for 16-byte atomic support on IBM Z
  * (jsc#SES-680) monitoring: add details to Prometheus alerts
  * (bsc#1155045) mgr/dashboard: add debug mode, and accept expected exception when SSL handshaking
  * (bsc#1152100) monitoring: alert for prediction of disk and pool fill up broken
  * (bsc#1155262) mgr/dashboard: iSCSI targets not available if any gateway is down
  * (bsc#1159689) os/bluestore: more flexible DB volume space usage
  * (bsc#1156087) ceph-volume: make get_devices fs location independent
  * (bsc#1156409) monitoring: wait before firing osd full alert
  * (bsc#1160626) mgr/dashboard: Unable to remove an iSCSI gateway that is already in use
  * (bsc#1161718) mount.ceph: remove arbitrary limit on size of name= option
  * (bsc#1162553) ceph-volume: strip _dmcrypt suffix in simple scan json output
  * (bsc#1163119) mgr/dashboard: Not able to restrict bucket creation for new user
  * (bsc#1164571) mgr/dashboard: Prevent iSCSI target recreation when editing controls
  * (bsc#1165713) mgr/dashboard: Repair broken grafana panels
  * (bsc#1165835) rgw: get barbican secret key request maybe return error code
  * (bsc#1165840) rgw: making implicit_tenants backwards compatible
  * (bsc#1166297) mgr/dashboard: Repair broken grafana panels
  * (bsc#1166393) mgr/dashboard: KeyError on dashboard reload
  * (bsc#1166624) mgr/dashboard: Fix iSCSI's username and password validation
  * (bsc#1166670) monitoring: root volume full alert fires false positives
  * (bsc#1166932) mgr: synchronize ClusterState's health and mon_status
  * (bsc#1168403) mgr/dashboard: Add more debug information to Dashboard RGW backend
  * (bsc#1169356) rgw: reshard: skip stale bucket id entries from reshard queue
  * (bsc#1170938) mon/OSDMonitor: allow trimming maps even if osds are down
  * (bsc#1171367) Set OSD's bluefs-buffered-io param to false by default</changelog>
  <changelog author="ncutler@suse.com" date="1592136000">- Update to 14.2.9-970-ged84cae0c9:
  + rgw: sanitize newlines in s3 CORSConfiguration's ExposeHeader
    (bsc#1171921, CVE-2020-10753)</changelog>
  <changelog author="ncutler@suse.com" date="1593172800">- Update to 14.2.10-392-gb3a13b81cb:
  + Upstream 14.2.10 release
    see https://ceph.io/releases/v14-2-10-nautilus-released/
  * mgr: Improve internal python to c++ interface (bsc#1167477)</changelog>
  <changelog author="ncutler@suse.com" date="1597406400">- Update to 14.2.11-394-g9cbbc473c0:
  + Upstream 14.2.11 release
    see https://ceph.io/releases/v14-2-11-nautilus-released/
  * mgr/progress: Skip pg_summary update if _events dict is empty
    (bsc#1167477) (bsc#1172142) (bsc#1171956)
  * mgr/dashboard: Allow to edit iSCSI target with active session
    (bsc#1173339)</changelog>
  <changelog author="ncutler@suse.com" date="1603368000">- Update to 14.2.12-436-g6feab505b7:
  + Upstream 14.2.12 release
    see https://ceph.io/releases/v14-2-12-nautilus-released/
  * (bsc#1169134) mgr/dashboard: document Prometheus' security model
  * (bsc#1170487) monclient: schedule first tick using mon_client_hunt_interval
  * (bsc#1172546) os/bluestore: fix collection_list ordering
  * (bsc#1174591) mgr/dashboard: Unable to edit iSCSI logged-in client
  * (bsc#1174591) mgr/dashboard: Allow editing iSCSI targets with initiators logged-in
  * (bsc#1175061) os/bluestore: dump onode that has too many spanning blobs
  * (bsc#1175240) pybind/mgr/restful: use dict.items() for py3 compatible
  * (bsc#1175585) mgr/dashboard: Fix many-to-many issue in host-details Grafana dashboard
  + (bsc#1175781) ceph-volume: lvmcache: print help correctly
  + spec: move python-enum34 into rhel 7 conditional</changelog>
  <changelog author="ncutler@suse.com" date="1604404800">- Update to 14.2.13-398-gb6c514eec7:
  + Upstream 14.2.13 release
    see https://ceph.io/releases/v14-2-13-nautilus-released/
  * (bsc#1151612, bsc#1158257) ceph-volume: major batch refactor</changelog>
  <changelog author="ncutler@suse.com" date="1605182400">- Update to 14.2.13-447-g4d9ac2b00a:
  + rebase on top of upstream nautilus branch, SHA1 04747f7b3800889f24311e0ef15e0531a2cc4d8d
  * rbd: rbd-nbd: don't ignore namespace when unmapping by image spec
  * rbd: librbd: ignore -ENOENT error when disabling object-map
  * rgw: radosgw-admin should paginate internally when listing bucket
  * rgw: fix expiration header returned even if there is only one tag in the
    object the same as the rule
  * rgw: fix S3 API KeyCount incorrect return
  * osdc/ObjectCacher: overwrite might cause stray read request callbacks
  * mgr/dashboard: redirect to original URL after successful login
  * mgr/dashboard: Strange iSCSI discovery auth behavior
  * mgr/prometheus: add pool compression stats
  * bluestore: BlockDevice.cc: use pending_aios instead of iovec size as ios num
  * bluestore: test/objectstore/store_test: kill ExcessiveFragmentation test case
  * bluestore: Support flock retry
  * bluestore: attach csum for compressed blobs
  * mgr: fix race between module load and notify
  * mon: set session_timeout when adding to session_map</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 14.2.13-450-g65ea1b614d:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1607342400">- Update to 14.2.15-400-gee47c9760b:
  + rebase on top of upstream nautilus branch, SHA1 afdd217ae5fb1ed3f60e16bd62357ca58cc650e5
    Upstream 14.2.15 release
    see https://ceph.io/releases/v14-2-15-nautilus-released/
  * (bsc#1179139) os/bluestore: fix "end reached" check in collection_list_legacy
    Upstream 14.2.14 release
    see https://ceph.io/releases/v14-2-14-nautilus-released/
  + (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608292800">- Update to 14.2.16-402-g7d47dbaf4d:
  + rebase on top of upstream 14.2.16 release
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation
    possible via ceph_volume_client Python interface
  + (bsc#1180118) bluestore: provide a different name for fallback allocator</changelog>
  <changelog author="ncutler@suse.com" date="1615809600">- Update to 14.2.17-398-ge4ac8c76b3:
  + rebase on top of upstream 14.2.17 release
    (see https://ceph.io/releases/v14-2-17-nautilus-released/ for more information)
  * (bsc#1178905) - (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1179997) - (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1145463) mgr/dashboard: prometheus alerting: add some leeway for package drops and errors
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177200) rpm: ceph-mgr-dashboard recommends python3-saml on SUSE
  * (bsc#1178235) mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1180118) bluestore: provide a different name for fallback allocator
  * (bsc#1181378) test/run-cli-tests: use cram from github
  + (bsc#1183487) mgr/dashboard: fix "Python2 Cookie module import fails on Python3"
  + Dropped downstream patches:
  * common: make ms_bind_msgr2 default to 'false' (bsc#1180594)
  * Revert: "rgw_file: introduce fast S3 Unix stats (immutable)" (feature has
    baked upstream for several releases already)</changelog>
  <changelog author="ncutler@suse.com" date="1617710400">- Update to 14.2.19-398-gcc56198fca:
  + rebase on top of upstream 14.2.19 release
  * https://ceph.io/releases/v14-2-19-nautilus-released/
    (fixes a regression introduced in 14.2.17)
  * https://ceph.io/releases/v14-2-18-nautilus-released/</changelog>
  <changelog author="ncutler@suse.com" date="1617710401">- Update to 14.2.19-401-gadd8adc54d:
  + fix ceph-test build breakage
  * cmake: only link against necessary libs
  * cmake: SKIP_RPATH if RPATH is not necessary
  * cmake: set empty RPATH for some test executables</changelog>
  <changelog author="ncutler@suse.com" date="1618315200">- _constraints: raise s390x disk constraint to 42G after seeing a build fail
  with "write error: No space left on device"</changelog>
  <changelog author="ncutler@suse.com" date="1618920000">- Update to 14.2.20-402-g6aa76c6815:
  + rebase on top of Ceph 14.2.20 release
  * https://ceph.io/releases/v14-2-20-nautilus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + mgr: add mon metadata using type of "mon"</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 14.2.21-403-g69ab6ea274d:
  + rebase on top of Ceph v14.2.21 tag
    https://ceph.io/releases/v14-2-21-nautilus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1623240000">- Update to 14.2.21-410-gdf7b47d7dfd:
  + (bsc#1183760) os/FileStore: don't propagate split/merge error to "create"/"remove"
  + (bsc#1185049) os/FileStore: fix to handle readdir error correctly</changelog>
  <changelog author="ncutler@suse.com" date="1625313600">- Update to 14.2.22-403-g54cdaf6e510:
  + rebase on top of Ceph v14.2.22 tag
    https://ceph.io/releases/v14-2-22-nautilus-released/
  * (bsc#1175086) mgr/dashboard: show partially deleted RBDs
  * (bsc#1184517) cls/rgw: look for plain entries in non-ascii plain namespace too
  + mgr/dashboard: fix monitoring menu item in downstream branding</changelog>
  <changelog author="ncutler@suse.com" date="1627473600">- Update to 14.2.22-404-gf74e15c2e55:
  + (bsc#1187584) osd: fix scrub reschedule bug</changelog>
</package>
<package pkgid="74bf475f6b1eef70d2c505ef43a42d20f7ab3f9225f353e793e86a54d25e1dff" name="ceph-mgr-ssh" arch="noarch">
  <version epoch="0" ver="14.2.22.445+ga68959d39a6" rel="3.72.1"/>
  <changelog author="ncutler@suse.com" date="1592136000">- Update to 14.2.9-970-ged84cae0c9:
  + rgw: sanitize newlines in s3 CORSConfiguration's ExposeHeader
    (bsc#1171921, CVE-2020-10753)</changelog>
  <changelog author="ncutler@suse.com" date="1593172800">- Update to 14.2.10-392-gb3a13b81cb:
  + Upstream 14.2.10 release
    see https://ceph.io/releases/v14-2-10-nautilus-released/
  * mgr: Improve internal python to c++ interface (bsc#1167477)</changelog>
  <changelog author="ncutler@suse.com" date="1597406400">- Update to 14.2.11-394-g9cbbc473c0:
  + Upstream 14.2.11 release
    see https://ceph.io/releases/v14-2-11-nautilus-released/
  * mgr/progress: Skip pg_summary update if _events dict is empty
    (bsc#1167477) (bsc#1172142) (bsc#1171956)
  * mgr/dashboard: Allow to edit iSCSI target with active session
    (bsc#1173339)</changelog>
  <changelog author="ncutler@suse.com" date="1603368000">- Update to 14.2.12-436-g6feab505b7:
  + Upstream 14.2.12 release
    see https://ceph.io/releases/v14-2-12-nautilus-released/
  * (bsc#1169134) mgr/dashboard: document Prometheus' security model
  * (bsc#1170487) monclient: schedule first tick using mon_client_hunt_interval
  * (bsc#1172546) os/bluestore: fix collection_list ordering
  * (bsc#1174591) mgr/dashboard: Unable to edit iSCSI logged-in client
  * (bsc#1174591) mgr/dashboard: Allow editing iSCSI targets with initiators logged-in
  * (bsc#1175061) os/bluestore: dump onode that has too many spanning blobs
  * (bsc#1175240) pybind/mgr/restful: use dict.items() for py3 compatible
  * (bsc#1175585) mgr/dashboard: Fix many-to-many issue in host-details Grafana dashboard
  + (bsc#1175781) ceph-volume: lvmcache: print help correctly
  + spec: move python-enum34 into rhel 7 conditional</changelog>
  <changelog author="ncutler@suse.com" date="1604404800">- Update to 14.2.13-398-gb6c514eec7:
  + Upstream 14.2.13 release
    see https://ceph.io/releases/v14-2-13-nautilus-released/
  * (bsc#1151612, bsc#1158257) ceph-volume: major batch refactor</changelog>
  <changelog author="ncutler@suse.com" date="1605182400">- Update to 14.2.13-447-g4d9ac2b00a:
  + rebase on top of upstream nautilus branch, SHA1 04747f7b3800889f24311e0ef15e0531a2cc4d8d
  * rbd: rbd-nbd: don't ignore namespace when unmapping by image spec
  * rbd: librbd: ignore -ENOENT error when disabling object-map
  * rgw: radosgw-admin should paginate internally when listing bucket
  * rgw: fix expiration header returned even if there is only one tag in the
    object the same as the rule
  * rgw: fix S3 API KeyCount incorrect return
  * osdc/ObjectCacher: overwrite might cause stray read request callbacks
  * mgr/dashboard: redirect to original URL after successful login
  * mgr/dashboard: Strange iSCSI discovery auth behavior
  * mgr/prometheus: add pool compression stats
  * bluestore: BlockDevice.cc: use pending_aios instead of iovec size as ios num
  * bluestore: test/objectstore/store_test: kill ExcessiveFragmentation test case
  * bluestore: Support flock retry
  * bluestore: attach csum for compressed blobs
  * mgr: fix race between module load and notify
  * mon: set session_timeout when adding to session_map</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 14.2.13-450-g65ea1b614d:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1607342400">- Update to 14.2.15-400-gee47c9760b:
  + rebase on top of upstream nautilus branch, SHA1 afdd217ae5fb1ed3f60e16bd62357ca58cc650e5
    Upstream 14.2.15 release
    see https://ceph.io/releases/v14-2-15-nautilus-released/
  * (bsc#1179139) os/bluestore: fix "end reached" check in collection_list_legacy
    Upstream 14.2.14 release
    see https://ceph.io/releases/v14-2-14-nautilus-released/
  + (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608292800">- Update to 14.2.16-402-g7d47dbaf4d:
  + rebase on top of upstream 14.2.16 release
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation
    possible via ceph_volume_client Python interface
  + (bsc#1180118) bluestore: provide a different name for fallback allocator</changelog>
  <changelog author="ncutler@suse.com" date="1615809600">- Update to 14.2.17-398-ge4ac8c76b3:
  + rebase on top of upstream 14.2.17 release
    (see https://ceph.io/releases/v14-2-17-nautilus-released/ for more information)
  * (bsc#1178905) - (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1179997) - (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1145463) mgr/dashboard: prometheus alerting: add some leeway for package drops and errors
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177200) rpm: ceph-mgr-dashboard recommends python3-saml on SUSE
  * (bsc#1178235) mgr/dashboard: Display a warning message in Dashboard when debug mode is enabled
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1180118) bluestore: provide a different name for fallback allocator
  * (bsc#1181378) test/run-cli-tests: use cram from github
  + (bsc#1183487) mgr/dashboard: fix "Python2 Cookie module import fails on Python3"
  + Dropped downstream patches:
  * common: make ms_bind_msgr2 default to 'false' (bsc#1180594)
  * Revert: "rgw_file: introduce fast S3 Unix stats (immutable)" (feature has
    baked upstream for several releases already)</changelog>
  <changelog author="ncutler@suse.com" date="1617710400">- Update to 14.2.19-398-gcc56198fca:
  + rebase on top of upstream 14.2.19 release
  * https://ceph.io/releases/v14-2-19-nautilus-released/
    (fixes a regression introduced in 14.2.17)
  * https://ceph.io/releases/v14-2-18-nautilus-released/</changelog>
  <changelog author="ncutler@suse.com" date="1617710401">- Update to 14.2.19-401-gadd8adc54d:
  + fix ceph-test build breakage
  * cmake: only link against necessary libs
  * cmake: SKIP_RPATH if RPATH is not necessary
  * cmake: set empty RPATH for some test executables</changelog>
  <changelog author="ncutler@suse.com" date="1618315200">- _constraints: raise s390x disk constraint to 42G after seeing a build fail
  with "write error: No space left on device"</changelog>
  <changelog author="ncutler@suse.com" date="1618920000">- Update to 14.2.20-402-g6aa76c6815:
  + rebase on top of Ceph 14.2.20 release
  * https://ceph.io/releases/v14-2-20-nautilus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + mgr: add mon metadata using type of "mon"</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 14.2.21-403-g69ab6ea274d:
  + rebase on top of Ceph v14.2.21 tag
    https://ceph.io/releases/v14-2-21-nautilus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1623240000">- Update to 14.2.21-410-gdf7b47d7dfd:
  + (bsc#1183760) os/FileStore: don't propagate split/merge error to "create"/"remove"
  + (bsc#1185049) os/FileStore: fix to handle readdir error correctly</changelog>
  <changelog author="ncutler@suse.com" date="1625313600">- Update to 14.2.22-403-g54cdaf6e510:
  + rebase on top of Ceph v14.2.22 tag
    https://ceph.io/releases/v14-2-22-nautilus-released/
  * (bsc#1175086) mgr/dashboard: show partially deleted RBDs
  * (bsc#1184517) cls/rgw: look for plain entries in non-ascii plain namespace too
  + mgr/dashboard: fix monitoring menu item in downstream branding</changelog>
  <changelog author="ncutler@suse.com" date="1627473600">- Update to 14.2.22-404-gf74e15c2e55:
  + (bsc#1187584) osd: fix scrub reschedule bug</changelog>
  <changelog author="ncutler@suse.com" date="1635249600">- Update to 14.2.22-444-gdd017abf74a:
  + rebase on top of upstream commit 7fd0bec58c1caa46bc30e3eb65cc1287335c2703
  * (bsc#1187709) osd: move down peers out from peer_purged (PR#42240)
  * (bsc#1187584) osd: fix scrub reschedule bug (PR#41973)
  * pybind/mgr/insights: Don't persist report data (PR#43431)
  * os/bluestore: fix erroneous SharedBlob record removal during repair (PR#43365)
  * mgr/dashboard/api: set a UTF-8 locale when running pip (PR#43608)
  * common/options: Set osd_client_message_cap to 256 (PR#42617)
  * mgr/DaemonServer: skip redundant update of pgp_num_actual (PR#42240)
  * os/bluestore: Remove possibility of replay log and file inconsistency (PR#43135)
  * spec: drop use of DISABLE_RESTART_ON_UPDATE (PR#42441)
  * spec: drop %service_del_postun_without_restart (PR#42441)
  * spec: drop useless conditional block in %postun base (PR#42441)
  * pybind/ceph_volume_client: use cephfs mkdirs api (PR#42162)
  + cherry-pick additional fixes that are still pending upstream:
  * (bsc#1185747) rgw: allow to set ssl options and ciphers for beast frontend (PR#42399)
  * (bsc#1188911) OSD marked down causes wrong backfill_toofull (PR#43439)
  * (bsc#1190415) L3: OSD panic occur repeatedly when recovery an object after
    disk replacement (PR#43547)
  * (bsc#1191357) L3: bucket removal operation fails (PR#43432)</changelog>
  <changelog author="ncutler@suse.com" date="1635508800">- Update to 14.2.22-445-ga68959d39a6:
  + common: fix build failure caused by updated mozilla-nss</changelog>
</package>
<package pkgid="b1d8658e18e9588411b73f8c683632059e64118d3ab9b85045c5feee961554b4" name="ceph-mon" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="07963f6051dce5a58bb6e9f6af2246de136ef05e8608b868939e2aec299c6ffd" name="ceph-mon" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="338f81636019883290222757032d2a467afdd4bba1540672d29e487a99ea4c2f" name="ceph-mon" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="762e9e52e7761c1e7a6f37e21e34841c15991125d826a1b8a0ccd53d78887024" name="ceph-mon" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="8a388cb4989d1caa722b1d2f480b10c54a5fe92229650a4ee0b865f6fde1eb40" name="ceph-mon" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="9cd37590c8079b98c13b05e0c78acad4f62264089e5242cd3269d31fa6c97b10" name="ceph-mon" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="5bc071268467fa3a678942c0f1bd82278e95eaa442931a52eb3f886b842074bc" name="ceph-mon" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="7cfd2ac6c34ad547f757b2a84bdb2df6d6923ade34c5f5856313c52181ee3f2d" name="ceph-mon" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="fa3068b32cf1352cdd86c29f1be26102b4389b01783570703360a263c2a4647f" name="ceph-mon" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="0f6fdb5aa6d9f28b6ea05476d127d5a653293f4c0a7f5b47ac525e0a35a75ca8" name="ceph-mon" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="2e26d4ca5d28ebf5ec0a81d47d9156aa269d15c73ff6af68629efbb52859ffe4" name="ceph-mon" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="9fbad83f4759a4fe69ba1ef327c2e8e2b2b2794aa63998e18a6ffd537c5de25d" name="ceph-mon" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="0d4f6756520527c6c76e6620deebd49648ee8fa4ebee4907b5322f2b9c3eb9fd" name="ceph-osd" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="93d6891042a102853422b645faa1410d748c93f1d78cd2b4d12569c067bd3520" name="ceph-osd" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="4a3f06c075d210d6e21eb4aa59d02b4af14d2e7fca678323009850c0a6941dbe" name="ceph-osd" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="06d232b921bc29b0ad941ca2196fa317f90cf878071123543856c9e1b83b8ba6" name="ceph-osd" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="2c5465917be26d9e6033dc28dac9b1c2910101584bd936d3c27deb96e635a674" name="ceph-osd" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="180bee8d1fd7c69723ad3d676578edfbce6e75a95125310e102cc18179b9ecfa" name="ceph-osd" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="19797aed268d49f637d53a42c6af6b23d11fb51f97fa670f85c33ed30844fa01" name="ceph-osd" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="917848c07794d550ff1a6c894fddc259d52c26e63c42675baed09b1565a3ba15" name="ceph-osd" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="5b4bb295bea0bce32de01bdcc1ca1eaee49e9483a4c1dc5c99cadae48783ea4c" name="ceph-osd" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="4110e66463cd893efb66d83701e57a9225795d78ac4d1d2f5fcb8a340ea117d3" name="ceph-osd" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="e6756a9d01cba93623b001b0e94731bb8e3a459a3a8bdf310389c77e1502cf52" name="ceph-osd" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="8bfa37a65bf67cd46eaa941e28eb45ff75752d3cb3c739088269a77a0bf107aa" name="ceph-osd" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="b6ed354071d392fd31651d2c37a77f6ea8cc54c4584e1c7761d97d239a33f7fc" name="ceph-prometheus-alerts" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="af1db133263b6fc41493ffead3345f82c9ff93551097b285a1a4270452cbc316" name="ceph-prometheus-alerts" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="a207563e73254e19bccf31335ecc6b41e5d763d889b99bd2bdc9a6cfe6670b96" name="ceph-prometheus-alerts" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="a1f30998e870c778604e664b73b5fc2014757836dbc94d3be212b39e42f9326c" name="ceph-radosgw" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="e7cdd64c7ac0d2b720f1ff6a74501b79c22933ca2d994b78d2a18dd40fcb1083" name="ceph-radosgw" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="e28a5a185a15b5845abd91e6bc93518d8c5183eac47e5f2fb5428c5b029eb7af" name="ceph-radosgw" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="6adbca70826bdf3641e934448d8cd63f4e53dadc24e9c2c5c0dc0c744bdcf598" name="ceph-radosgw" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="b019a281bd4fa57bd1b4af5c0b590355bfc5f79b5054e364793224edf0c241ff" name="ceph-radosgw" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="b7dd5f80958f4decac38eab30385598b0567b40bfc447ca936b64e8e189d7f6e" name="ceph-radosgw" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="ad1b6a19e9047ed0bf38bb307cd3598456387b1a3f0dd1442530f3a7999e75c4" name="ceph-radosgw" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="9a92b51555ebbdca1246d5e009bb385015fafecd229a51e5f964c43ba265ff22" name="ceph-radosgw" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="0ec593d6114c6753ddea140dc16cc95266a30895a36680d4717666e0a990928f" name="ceph-radosgw" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="220f22949784009926f11f95169d9ef0dc40a75eb63b20597eb493d0681abe84" name="ceph-radosgw" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="7f1689ea12480af7014dbdf875c5dd14b5f0d7a5cfcf708240910eb01f9619e7" name="ceph-radosgw" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="9662c978b05ed30fffcdf8c593f7b45e7113deb5c43856b741a34705e848892e" name="ceph-radosgw" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="a302359d59603e03f4e95b457795d55661bca8b4661c33858873008831c769b1" name="ceph-test" arch="src">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="6766ecd41fdf367943d70d3e0a88b5320d4d3909ee591e298b28a04df2a0a8b1" name="ceph-test" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="fd7719bf86b2da62376637af0c49f7f3fcc277aea3f72d1f166ecdde06be9181" name="ceph-test" arch="src">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="95fc589c6d348f9f9dc5d2f20d5719bd1f37824eef1351f81266a08597301dd0" name="ceph-test" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="68ce6b214a2882985c592bef56be23379bfa2e0258ae56bbf6cc5de31dbfc4c5" name="ceph-test" arch="src">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="a545463b39f409f80d30b13acf8e6db04248b2973d37790a96d40b54375e1c36" name="ceph-test" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="900a292ae8ad2685b1fa97db8831c41125af2d8695fb37de2f147a74c8f6a5a4" name="cephadm" arch="noarch">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="74de89eb67442cd605639e0815f386eaac7a3e2487c5c90e8daa8f9a0075e4fe" name="cephadm" arch="noarch">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="6487866902328d81ea04a23a6a27dec9fc1b1c500dc62e91729cfd180f05135e" name="cephadm" arch="noarch">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="3ffeface111699ef28558326b5fb26a01a5749382ad8197d70ba9b2c65d3a6e8" name="cephfs-shell" arch="aarch64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="2ae3fbd82c137d9ddb62c986706dd4530b9125f6516696149323ad749ee1fb9b" name="cephfs-shell" arch="ppc64le">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="3920626d14c89571ac37536a458a083d8ab0e4fd818d9ba8af7191fef867ecf1" name="cephfs-shell" arch="s390x">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="bc69712ccdfdc24200cc783f867a326bde5ec6d3b8007eceab2ded2f17d0ff0b" name="cephfs-shell" arch="x86_64">
  <version epoch="0" ver="15.2.12.83+g528da226523" rel="3.25.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-222-g3a105ce6a4:
  + cherry-pick --container-init feature and follow-on fix from upstream
    (bsc#1163764) (bsc#1177319)
  * cephadm: Fix error setting 'mgr/cephadm/container_init' config
  * mgr/cephadm: Call cephadm with --container-image
  * cephadm: Add --container-image</changelog>
  <changelog author="ncutler@suse.com" date="1602072001">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
</package>
<package pkgid="339abe7837068c9967c7e310edf59d263cd2073c52e5e539376cf3d25f4c539f" name="cephfs-shell" arch="aarch64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="df733e66d6bb88da38263053d797cba11fd473ed8f6e5335036b0fa98a6264b3" name="cephfs-shell" arch="ppc64le">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="8ce226d9e3647e7778abebafb0458ae451549b3ccb092b508b1acce3b9c1535f" name="cephfs-shell" arch="s390x">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="1cf2e199baf618e265fbc6fb19c42798e2da613a8c113fa9c6dad8f21f8bbb41" name="cephfs-shell" arch="x86_64">
  <version epoch="0" ver="15.2.13.79+g51835b62d61" rel="3.28.1"/>
  <changelog author="ncutler@suse.com" date="1602072000">- Update to 15.2.5-352-gf4a94295a4:
  + Rebase on tip of upstream "octopus" branch, SHA1 e819e7280dd64d9f2d54359067056fe0e342c10d
  + Drop patch "rpm: on SUSE, podman is required for cephadm to work"
    (bsc#1176451)
  + Re-cherry-pick "ceph-volume: major batch refactor" upstream octopus backport PR
  * (bsc#1177151) python-common: do not skip unavailable devices</changelog>
  <changelog author="ncutler@suse.com" date="1602158400">- Update to 15.2.5-355-g33a4cd4ce3:
  + Rebase on tip of upstream "octopus" branch, SHA1 be28449139148fb00086e11185abeebd3cb5b5b8
  + ceph-volume: don't exit before empty report can be printed (bsc#1177450)</changelog>
  <changelog author="ncutler@suse.com" date="1602158401">- Update to 15.2.5-411-g6432ac8c37:
  + Rebase on tip of upstream "octopus" branch, SHA1 72e846aa6fb25df05a17ded0287ff0a59c579d7f
  * (bsc#1174644) cephadm: log to file
  * (bsc#1176499) mgr/cephadm: fix RemoveUtil.load_from_store()</changelog>
  <changelog author="ncutler@suse.com" date="1602244800">- Update to 15.2.5-429-g96b264c584:
  + Rebase on tip of upstream "octopus" branch, SHA1 82793ade49526d7d5674e488fba88e7568888ebb
  * (bsc#1173079) mgr/devicehealth: device_health_metrics pool gets created
    even without any OSDs in the cluster</changelog>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
</package>
<package pkgid="838c3a07bbdbab86127537fcd4ee3cd26ee5e04fa4f94b1a8d5915f1b3d047fa" name="cephfs-shell" arch="aarch64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="58fcdaba43a08954a93fe56142b6feb95f9d532fac04390790f2bca1703199dd" name="cephfs-shell" arch="ppc64le">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="19911569853067eb5f7cf559af2bfc99f4652ff3abd48f195b3777bfc2a3367e" name="cephfs-shell" arch="s390x">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="db87888347bed72569f68d73444ce7cdd109b6007e40c0c36e689af0ea00a29d" name="cephfs-shell" arch="x86_64">
  <version epoch="0" ver="15.2.14.84+gb6e5642e260" rel="3.31.1"/>
  <changelog author="ncutler@suse.com" date="1602590400">- Update to 15.2.5-430-g652d1d1e54:
  + Revert "spec: Podman (temporarily) requires apparmor-abstractions on suse"
    (bsc#1177643)</changelog>
  <changelog author="ncutler@suse.com" date="1602676800">- Update to 15.2.5-432-g0ead4ca479:
  + cephadm: allow uid/gid == 0 in copy_tree, copy_files, move_files (bsc#1177676)</changelog>
  <changelog author="ncutler@suse.com" date="1603281600">- Update to 15.2.5-514-g7a2bcdb091:
  + Rebase on tip of upstream "octopus" branch, SHA1 afe740393a17dc80a91f8baca4ef92d0135c4525
  + (bsc#1177319) mgr/cephadm: make --container-init a global option
  + (bsc#1177933) cephadm: configure journald as the logdriver</changelog>
  <changelog author="ncutler@suse.com" date="1605268800">- Update to 15.2.5-664-gfbc9fa98aa:
  + Rebase on tip of upstream "octopus" branch, SHA1 31d4e76d0d584790763b4b1146b29ea4cfc2e9af
  * (bsc#1170200) mgr/dashboard: Fix for CrushMap viewer items getting compressed vertically
  * (bsc#1174466) mon: have 'mon stat' output json as well
  * (bsc#1177344) mgr/dashboard: support Orchestrator and user-defined Ganesha cluster
  * (bsc#1178073) mgr/dashboard: fix downstream NFS doc links
  * (bsc#1178531) cephadm: set default container_image to registry.suse.com/ses/7/ceph/ceph</changelog>
  <changelog author="ncutler@suse.com" date="1605268801">- Update to 15.2.5-667-g1a579d5bf2:
  + Fix CVE-2020-25660 (bsc#1177843)
  * mon/MonClient: bring back CEPHX_V2 authorizer challenges
  * msg/async/ProtocolV1: resurrect "implement cephx_*require_version options"
  * msg/async/ProtocolV1: resurrect "include MGR as service when applying cephx settings"</changelog>
  <changelog author="ncutler@suse.com" date="1606392000">- Update to 15.2.6-684-gd472d0011a:
  + Rebase on tip of upstream "octopus" branch, SHA1 ad83229f58142c7c9e23b931df437dfdbc9a9f68
  * upstream Octopus v15.2.6 release, see https://ceph.io/releases/v15-2-6-octopus-released/
  + qa/task/cephadm: run cephadm only on bootstrap_remote</changelog>
  <changelog author="ncutler@suse.com" date="1606910400">- Update to 15.2.7-689-g2c35e99e0a:
  + Rebase on tip of upstream "octopus" branch, SHA1 bf8c93ed52f9fc8b0ead7434383bfc40f78d4204
  * upstream Octopus v15.2.7 release, see https://ceph.io/releases/v15-2-7-octopus-released/
  * (bsc#1179526) rgw: during GC defer, prevent new GC enqueue
  + (bsc#1179452) mgr/insights: Test environment requires 'six'</changelog>
  <changelog author="ncutler@suse.com" date="1608120000">- Update to 15.2.7-776-g343cd10fe5:
  + Rebase on tip of upstream "octopus" branch, SHA1 1b8a634fdcd94dfb3ba650793fb1b6d09af65e05
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  + (bsc#1179016) rpm: require smartmontools on SUSE
  + (bsc#1180107) ceph-volume: pass --filter-for-batch from drive-group subcommand</changelog>
  <changelog author="ncutler@suse.com" date="1608206400">- Update to 15.2.8-80-g1f4b6229ca:
  + Rebase on tip of upstream "octopus" branch, SHA1 bdf3eebcd22d7d0b3dd4d5501bee5bac354d5b55
  * upstream Octopus v15.2.8 release, see https://ceph.io/releases/v15-2-8-octopus-released/
  * (bsc#1179802, bsc#1180155, CVE-2020-27781) cephx privilege escalation possible via
    ceph_volume_client Python interface</changelog>
  <changelog author="ncutler@suse.com" date="1614254400">- Update to 15.2.9-82-gee18977364:
  + upstream Octopus v15.2.9 release, see https://ceph.io/releases/v15-2-9-octopus-released/
  * (bsc#1179997) (CVE-2020-27839) mgr/dashboard: Use secure cookies to store JWT Token
  * (bsc#1178905) (CVE-2020-25678) Do not add sensitive information in Ceph log files
  * (bsc#1172926) mgr/orchestrator: Sort 'ceph orch device ls' by host
  * (bsc#1176390, bsc#1176679) mgr/dashboard: enable different URL for users
    of browser to Grafana
  * (bsc#1176489) mgr/cephadm: lock multithreaded access to OSDRemovalQueue
  * (bsc#1176828) cephadm: command_unit: call systemctl with verbose=True
  * (bsc#1177360) cephadm: silence "Failed to evict container" log msg
  * (bsc#1177857) mgr/cephadm: upgrade: fail gracefully, if daemon redeploy fails
  * (bsc#1178837) rgw: cls/user: set from_index for reset stats calls
  * (bsc#1178860) mgr/dashboard: Disable TLS 1.0 and 1.1
  * (bsc#1178932, bsc#1179569) cephadm: reference the last local image by digest</changelog>
  <changelog author="ncutler@suse.com" date="1614600000">- Update to 15.2.9-83-g4275378de0:
  + cephadm: fix 'inspect' and 'pull' (bsc#1182766)</changelog>
  <changelog author="ncutler@suse.com" date="1616500800">- Update to 15.2.10-81-g29303934a5:
  + upstream Octopus v15.2.10 release, see https://ceph.io/releases/v15-2-10-octopus-released/
  * bluestore: fix huge reads/writes at BlueFS (bsc#1183899)</changelog>
  <changelog author="ncutler@suse.com" date="1619179200">- Update to 15.2.11-82-g7c6356e178:
  + upstream Octopus v15.2.11 release
    see https://ceph.io/releases/v15-2-11-octopus-released/
  * (bsc#1183074) - (CVE-2021-20288) ceph: Unauthorized global_id reuse
  + cephadm: Update Grafana container image from 7.0.3 to 7.3.1</changelog>
  <changelog author="ncutler@suse.com" date="1619524800">- Update to 15.2.11-83-g8a15f484c2:
  + (bsc#1184231) cephadm: Allow to use paths in all &lt;_devices&gt; drivegroup sections</changelog>
  <changelog author="ncutler@suse.com" date="1620993600">- Update to 15.2.12-83-g528da226523:
  + rebase on top of Ceph v15.2.12 tag
    https://ceph.io/releases/v15-2-12-octopus-released/
  * mgr/dashboard: fix base-href: revert it to previous approach
  * (bsc#1186021) mgr/dashboard: fix cookie injection issue (CVE-2021-3509)
  * (bsc#1186020) rgw: RGWSwiftWebsiteHandler::is_web_dir checks empty subdir_name (CVE-2021-3531)
  * (bsc#1185619) rgw: sanitize \r in s3 CORSConfiguration?s ExposeHeader (CVE-2021-3524)</changelog>
  <changelog author="ncutler@suse.com" date="1622116800">- Update to 15.2.13-79-g51835b62d61:
  + rebase on top of Ceph v15.2.13 tag
    https://ceph.io/releases/v15-2-13-octopus-released/
  * (bsc#1174526) mgr/dashboard: allow getting fresh inventory data from the orchestrator
  + drop obsolete downstream patches:
  * cephadm: add global flag --container-init
  * mgr/cephadm: append --container-init to basecommand
  * cephadm: remove container-init subparser from "deploy"</changelog>
  <changelog author="ncutler@suse.com" date="1624536000">- Update _constraints: only honor physical memory, not 'any memory'
  (e.g. swap). But then, be happy with 8GB (bumping the current
  x86_64 worker pool from 16 to 64). (Dominique Leuenberger)</changelog>
  <changelog author="ncutler@suse.com" date="1626868800">- Additional bugs fixed by 15.2.13-79-g51835b62d61:
  + (bsc#1181291) mgr/cephadm: alias rgw-nfs -&gt; nfs
  + (bsc#1183561) mgr/cephadm: on ssh connection error, advice chmod 0600</changelog>
  <changelog author="ncutler@suse.com" date="1627992000">- Update to 15.2.13-85-g18a335e0360:
  + qa/tasks/salt_manager: allow gatherlogs for files in subdir
  + qa/tasks/ceph_salt: gather /var/log/ceph/cephadm.out
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) Revert "cephadm: default container_init to False"</changelog>
  <changelog author="ncutler@suse.com" date="1628683200">- Update to 15.2.14-84-gb6e5642e260:
  + rebase on top of Ceph v15.2.14 tag
    https://ceph.io/releases/v15-2-14-octopus-released/
  * (bsc#1184517) cls/rgw: look for plane entries in non-ascii plain namespace too
  * (bsc#1185246) rgw: check object locks in multi-object delete
  + (bsc#1186348) mgr/zabbix: adapt zabbix_sender default path
  + (bsc#1188979) mgr/cephadm: pass --container-init to "cephadm deploy" if specified
  + (bsc#1189173) mgr/dashboard: Downstream branding: Adapt latest upstream
    changes to branded navigation component</changelog>
</package>
<package pkgid="325045bf6a805076a675beb0cfb09a8e234a4267a05e21de0739ae45e729571f" name="certmonger" arch="aarch64">
  <version epoch="0" ver="0.79.13" rel="7.3.1"/>
  <changelog author="stasiek@michalski.cc" date="1586692800">- Initial package</changelog>
  <changelog author="dmueller@suse.com" date="1598875200">- update to 0.79.11:
  - Fix crash bug when generating thumbprints
  - dogtag: use POST for profileProcess requests
  - Improve logging in SCEP helper
  - Add verbose option to SCEP CA if requested in add-scep-ca
  - Re-order the way the SCEP signing and CA certs are collected
  - Add new option to allow overriding the detected SCEP CA chain
  - template_profile, issuer and MS certificate template are single-value
  - Ensure that files read in have a trailing new-line
  - Adapt to the new behavior of disconnect in dbus-broker
  - Add long command-line options to CLI and man pages
  - Include &amp;message=CA-IDENT with GetCACaps and GetCACert requests
  - Address issues uncovered by clang and Coverity
  - Handle an uninitialized token when adding CA certs to an NSS db
  - tests: Parametrize 025-casave with NSS db types</changelog>
  <changelog author="hel@lcp.world" date="1614513600">- Update to 0.79.13</changelog>
  <changelog author="william.brown@suse.com" date="1627300800">- Add buildrequires on systemd which is required for correct installation
  of the .service file.</changelog>
  <changelog author="ngompa13@gmail.com" date="1627300801">- Use "pkgconfig(systemd)" for the BR to allow hacksaw systemd-mini
  package to satisfy dependencies in the openSUSE Build Service.</changelog>
</package>
<package pkgid="ca62ee54df4ecf2a6c03e5256f8bf798a1a7e4ea6701d21afc4e2dfa295b9bba" name="certmonger" arch="ppc64le">
  <version epoch="0" ver="0.79.13" rel="7.3.1"/>
  <changelog author="stasiek@michalski.cc" date="1586692800">- Initial package</changelog>
  <changelog author="dmueller@suse.com" date="1598875200">- update to 0.79.11:
  - Fix crash bug when generating thumbprints
  - dogtag: use POST for profileProcess requests
  - Improve logging in SCEP helper
  - Add verbose option to SCEP CA if requested in add-scep-ca
  - Re-order the way the SCEP signing and CA certs are collected
  - Add new option to allow overriding the detected SCEP CA chain
  - template_profile, issuer and MS certificate template are single-value
  - Ensure that files read in have a trailing new-line
  - Adapt to the new behavior of disconnect in dbus-broker
  - Add long command-line options to CLI and man pages
  - Include &amp;message=CA-IDENT with GetCACaps and GetCACert requests
  - Address issues uncovered by clang and Coverity
  - Handle an uninitialized token when adding CA certs to an NSS db
  - tests: Parametrize 025-casave with NSS db types</changelog>
  <changelog author="hel@lcp.world" date="1614513600">- Update to 0.79.13</changelog>
  <changelog author="william.brown@suse.com" date="1627300800">- Add buildrequires on systemd which is required for correct installation
  of the .service file.</changelog>
  <changelog author="ngompa13@gmail.com" date="1627300801">- Use "pkgconfig(systemd)" for the BR to allow hacksaw systemd-mini
  package to satisfy dependencies in the openSUSE Build Service.</changelog>
</package>
<package pkgid="45c7aa1c561d391ac2b724dc8acf7eefd4a69159b8ae710c4f04f1a55ce48ede" name="certmonger" arch="s390x">
  <version epoch="0" ver="0.79.13" rel="7.3.1"/>
  <changelog author="stasiek@michalski.cc" date="1586692800">- Initial package</changelog>
  <changelog author="dmueller@suse.com" date="1598875200">- update to 0.79.11:
  - Fix crash bug when generating thumbprints
  - dogtag: use POST for profileProcess requests
  - Improve logging in SCEP helper
  - Add verbose option to SCEP CA if requested in add-scep-ca
  - Re-order the way the SCEP signing and CA certs are collected
  - Add new option to allow overriding the detected SCEP CA chain
  - template_profile, issuer and MS certificate template are single-value
  - Ensure that files read in have a trailing new-line
  - Adapt to the new behavior of disconnect in dbus-broker
  - Add long command-line options to CLI and man pages
  - Include &amp;message=CA-IDENT with GetCACaps and GetCACert requests
  - Address issues uncovered by clang and Coverity
  - Handle an uninitialized token when adding CA certs to an NSS db
  - tests: Parametrize 025-casave with NSS db types</changelog>
  <changelog author="hel@lcp.world" date="1614513600">- Update to 0.79.13</changelog>
  <changelog author="william.brown@suse.com" date="1627300800">- Add buildrequires on systemd which is required for correct installation
  of the .service file.</changelog>
  <changelog author="ngompa13@gmail.com" date="1627300801">- Use "pkgconfig(systemd)" for the BR to allow hacksaw systemd-mini
  package to satisfy dependencies in the openSUSE Build Service.</changelog>
</package>
<package pkgid="7d66a77f208d32b94101babdb065d4c8ec5780cf9482f0f723e53effb62aaae9" name="certmonger" arch="src">
  <version epoch="0" ver="0.79.13" rel="7.3.1"/>
  <changelog author="stasiek@michalski.cc" date="1586692800">- Initial package</changelog>
  <changelog author="dmueller@suse.com" date="1598875200">- update to 0.79.11:
  - Fix crash bug when generating thumbprints
  - dogtag: use POST for profileProcess requests
  - Improve logging in SCEP helper
  - Add verbose option to SCEP CA if requested in add-scep-ca
  - Re-order the way the SCEP signing and CA certs are collected
  - Add new option to allow overriding the detected SCEP CA chain
  - template_profile, issuer and MS certificate template are single-value
  - Ensure that files read in have a trailing new-line
  - Adapt to the new behavior of disconnect in dbus-broker
  - Add long command-line options to CLI and man pages
  - Include &amp;message=CA-IDENT with GetCACaps and GetCACert requests
  - Address issues uncovered by clang and Coverity
  - Handle an uninitialized token when adding CA certs to an NSS db
  - tests: Parametrize 025-casave with NSS db types</changelog>
  <changelog author="hel@lcp.world" date="1614513600">- Update to 0.79.13</changelog>
  <changelog author="william.brown@suse.com" date="1627300800">- Add buildrequires on systemd which is required for correct installation
  of the .service file.</changelog>
  <changelog author="ngompa13@gmail.com" date="1627300801">- Use "pkgconfig(systemd)" for the BR to allow hacksaw systemd-mini
  package to satisfy dependencies in the openSUSE Build Service.</changelog>
</package>
<package pkgid="05cbb047998c0b3ba8ff1f78aac54f1010543a4cfb5947549c056c714ec2a33c" name="certmonger" arch="x86_64">
  <version epoch="0" ver="0.79.13" rel="7.3.1"/>
  <changelog author="stasiek@michalski.cc" date="1586692800">- Initial package</changelog>
  <changelog author="dmueller@suse.com" date="1598875200">- update to 0.79.11:
  - Fix crash bug when generating thumbprints
  - dogtag: use POST for profileProcess requests
  - Improve logging in SCEP helper
  - Add verbose option to SCEP CA if requested in add-scep-ca
  - Re-order the way the SCEP signing and CA certs are collected
  - Add new option to allow overriding the detected SCEP CA chain
  - template_profile, issuer and MS certificate template are single-value
  - Ensure that files read in have a trailing new-line
  - Adapt to the new behavior of disconnect in dbus-broker
  - Add long command-line options to CLI and man pages
  - Include &amp;message=CA-IDENT with GetCACaps and GetCACert requests
  - Address issues uncovered by clang and Coverity
  - Handle an uninitialized token when adding CA certs to an NSS db
  - tests: Parametrize 025-casave with NSS db types</changelog>
  <changelog author="hel@lcp.world" date="1614513600">- Update to 0.79.13</changelog>
  <changelog author="william.brown@suse.com" date="1627300800">- Add buildrequires on systemd which is required for correct installation
  of the .service file.</changelog>
  <changelog author="ngompa13@gmail.com" date="1627300801">- Use "pkgconfig(systemd)" for the BR to allow hacksaw systemd-mini
  package to satisfy dependencies in the openSUSE Build Service.</changelog>
</package>
<package pkgid="dcd869e668932115711369aaf5c23ca78c58252fea57e123df4d0218b5d6bd1e" name="chrony" arch="aarch64">
  <version epoch="0" ver="3.2" rel="9.24.2"/>
  <changelog author="mpost@suse.com" date="1480420800">- Upgraded to version 2.4.1:
  - Bug fixes
  - Fix processing of kernel timestamps on non-Linux systems
  - Fix crash with smoothtime directive
  - Fix validation of refclock sample times
  - Fix parsing of refclock directive</changelog>
  <changelog author="mpost@suse.com" date="1484568000">- Upgraded to version 3.0:
  - Enhancements
  - Add support for software and hardware timestamping on Linux
  - Add support for client/server and symmetric interleaved modes
  - Add support for MS-SNTP authentication in Samba
  - Add support for truncated MACs in NTPv4 packets
  - Estimate and correct for asymmetric network jitter
  - Increase default minsamples and polltarget to improve stability with very low jitter
  - Add maxjitter directive to limit source selection by jitter
  - Add offset option to server/pool/peer directive
  - Add maxlockage option to refclock directive
  - Add -t option to chronyd to exit after specified time
  - Add partial protection against replay attacks on symmetric mode
  - Don't reset polling interval when switching sources to online state
  - Allow rate limiting with very short intervals
  - Improve maximum server throughput on Linux and NetBSD
  - Remove dump files after start
  - Add tab-completion to chronyc with libedit/readline
  - Add ntpdata command to print details about NTP measurements
  - Allow all source options to be set in add server/peer command
  - Indicate truncated addresses/hostnames in chronyc output
  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses
  - Bug fixes
  - Fix crash with disabled asynchronous name resolving
- Upgraded clknetsim to version 6bb6519.</changelog>
  <changelog author="mpost@suse.com" date="1485864000">- Upgraded to version 3.1:
  - Enhancements
  - Add support for precise cross timestamping of PHC on Linux
  - Add minpoll, precision, nocrossts options to hwtimestamp directive
  - Add rawmeasurements option to log directive and modify measurements
    option to log only valid measurements from synchronised sources
  - Allow sub-second polling interval with NTP sources
  - Bug fixes
  - Fix time smoothing in interleaved mode
- Upgraded clknetsim to version ce89a1b.
- Reworked the following patches to fit the new versions
  - chrony-config.patch
  - chrony-service-helper.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1505908800">- Upgraded to version 3.2:
  Enhancements
  * Improve stability with NTP sources and reference clocks
  * Improve stability with hardware timestamping
  * Improve support for NTP interleaved modes
  * Control frequency of system clock on macOS 10.13 and later
  * Set TAI-UTC offset of system clock with leapsectz directive
  * Minimise data in client requests to improve privacy
  * Allow transmit-only hardware timestamping
  * Add support for new timestamping options introduced in Linux 4.13
  * Add root delay, root dispersion and maximum error to tracking log
  * Add mindelay and asymmetry options to server/peer/pool directive
  * Add extpps option to PHC refclock to timestamp external PPS signal
  * Add pps option to refclock directive to treat any refclock as PPS
  * Add width option to refclock directive to filter wrong pulse edges
  * Add rxfilter option to hwtimestamp directive
  * Add -x option to disable control of system clock
  * Add -l option to log to specified file instead of syslog
  * Allow multiple command-line options to be specified together
  * Allow starting without root privileges with -Q option
  * Update seccomp filter for new glibc versions
  * Dump history on exit by default with dumpdir directive
  * Use hardening compiler options by default
  Bug fixes
  * Don't drop PHC samples with low-resolution system clock
  * Ignore outliers in PHC tracking, RTC tracking, manual input
  * Increase polling interval when peer is not responding
  * Exit with error message when include directive fails
  * Don't allow slash after hostname in allow/deny directive/command
  * Try to connect to all addresses in chronyc before giving up
- Upgraded clknetsim to version 71dbbc5.
- Reworked chrony-fix-open.patch to fit the new version</changelog>
  <changelog author="mrueckert@suse.de" date="1506600000">- refresh patches to apply cleanly again
  - chrony-config.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1508846400">- Modified the spec file to comment out the pool statement
  in chrony.conf if _not_ building for openSUSE. (bsc#1063704).</changelog>
  <changelog author="mpluskal@suse.com" date="1509019200">- Cleanup spec file:
  * Drop pre systemd support
  * Run spec-cleaner</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mpluskal@suse.com" date="1518177600">- Enable pps support</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Fix name of fillup template (was never installed before)
- Fix Requires for fillup, it's used in post, not pre.</changelog>
  <changelog author="kukuk@suse.de" date="1522065600">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mpost@suse.com" date="1524052800">- Added /etc/chrony.d/ directory to the package (bsc#1083597)
  Modifed default chrony.conf to add "include /etc/chrony.d/*"</changelog>
  <changelog author="mpluskal@suse.com" date="1544788800">- Make sure to generate correct sysconfig file (boo#1117147)</changelog>
  <changelog author="max@suse.com" date="1553083200">- Fix ordering and dependencies of chronyd.service, so that it is
  started after name resolution is up (bsc#1129914).
- Add chrony-service-ordering.patch</changelog>
  <changelog author="max@suse.com" date="1578484800">- bsc#1159840: Add chrony-ntp-era-split.patch from upstream to fix
  "make check" builds made after 2019-12-20. Existing installations
  do not need to be updated as the bug only affects the test, but
  not chrony itself.</changelog>
  <changelog author="max@suse.com" date="1585310400">- Read runtime servers from /var/run/netconfig/chrony.servers to
  fix bsc#1099272 and bsc#1161119.
- Move chrony-helper to /usr/lib/chrony/helper, because there
  should be no executables in /usr/share.
- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.</changelog>
  <changelog author="max@suse.com" date="1590580800">- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="max@suse.com" date="1601380800">- Integrate three upstream patches to fix an infinite loop in
  chronyc (bsc#1171806).
  * chrony-select-timeout.patch
  * chrony-gettimeofday.patch
  * chrony-urandom.patch</changelog>
  <changelog author="max@suse.com" date="1617883200">- boo#1162964, bsc#1183783, clknetsim-glibc-2.31.patch:
  Fix build with glibc-2.31
- bsc#1184400, chrony-pidfile.patch:
  Use /run instead of /var/run for PIDFile in chronyd.service.</changelog>
  <changelog author="max@suse.com" date="1621771200">- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
</package>
<package pkgid="2917844f65e49c6d426dcdfc5b40b732bd5e3053c80e392d4cc00aaebe3c597b" name="chrony" arch="ppc64le">
  <version epoch="0" ver="3.2" rel="9.24.2"/>
  <changelog author="mpost@suse.com" date="1480420800">- Upgraded to version 2.4.1:
  - Bug fixes
  - Fix processing of kernel timestamps on non-Linux systems
  - Fix crash with smoothtime directive
  - Fix validation of refclock sample times
  - Fix parsing of refclock directive</changelog>
  <changelog author="mpost@suse.com" date="1484568000">- Upgraded to version 3.0:
  - Enhancements
  - Add support for software and hardware timestamping on Linux
  - Add support for client/server and symmetric interleaved modes
  - Add support for MS-SNTP authentication in Samba
  - Add support for truncated MACs in NTPv4 packets
  - Estimate and correct for asymmetric network jitter
  - Increase default minsamples and polltarget to improve stability with very low jitter
  - Add maxjitter directive to limit source selection by jitter
  - Add offset option to server/pool/peer directive
  - Add maxlockage option to refclock directive
  - Add -t option to chronyd to exit after specified time
  - Add partial protection against replay attacks on symmetric mode
  - Don't reset polling interval when switching sources to online state
  - Allow rate limiting with very short intervals
  - Improve maximum server throughput on Linux and NetBSD
  - Remove dump files after start
  - Add tab-completion to chronyc with libedit/readline
  - Add ntpdata command to print details about NTP measurements
  - Allow all source options to be set in add server/peer command
  - Indicate truncated addresses/hostnames in chronyc output
  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses
  - Bug fixes
  - Fix crash with disabled asynchronous name resolving
- Upgraded clknetsim to version 6bb6519.</changelog>
  <changelog author="mpost@suse.com" date="1485864000">- Upgraded to version 3.1:
  - Enhancements
  - Add support for precise cross timestamping of PHC on Linux
  - Add minpoll, precision, nocrossts options to hwtimestamp directive
  - Add rawmeasurements option to log directive and modify measurements
    option to log only valid measurements from synchronised sources
  - Allow sub-second polling interval with NTP sources
  - Bug fixes
  - Fix time smoothing in interleaved mode
- Upgraded clknetsim to version ce89a1b.
- Reworked the following patches to fit the new versions
  - chrony-config.patch
  - chrony-service-helper.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1505908800">- Upgraded to version 3.2:
  Enhancements
  * Improve stability with NTP sources and reference clocks
  * Improve stability with hardware timestamping
  * Improve support for NTP interleaved modes
  * Control frequency of system clock on macOS 10.13 and later
  * Set TAI-UTC offset of system clock with leapsectz directive
  * Minimise data in client requests to improve privacy
  * Allow transmit-only hardware timestamping
  * Add support for new timestamping options introduced in Linux 4.13
  * Add root delay, root dispersion and maximum error to tracking log
  * Add mindelay and asymmetry options to server/peer/pool directive
  * Add extpps option to PHC refclock to timestamp external PPS signal
  * Add pps option to refclock directive to treat any refclock as PPS
  * Add width option to refclock directive to filter wrong pulse edges
  * Add rxfilter option to hwtimestamp directive
  * Add -x option to disable control of system clock
  * Add -l option to log to specified file instead of syslog
  * Allow multiple command-line options to be specified together
  * Allow starting without root privileges with -Q option
  * Update seccomp filter for new glibc versions
  * Dump history on exit by default with dumpdir directive
  * Use hardening compiler options by default
  Bug fixes
  * Don't drop PHC samples with low-resolution system clock
  * Ignore outliers in PHC tracking, RTC tracking, manual input
  * Increase polling interval when peer is not responding
  * Exit with error message when include directive fails
  * Don't allow slash after hostname in allow/deny directive/command
  * Try to connect to all addresses in chronyc before giving up
- Upgraded clknetsim to version 71dbbc5.
- Reworked chrony-fix-open.patch to fit the new version</changelog>
  <changelog author="mrueckert@suse.de" date="1506600000">- refresh patches to apply cleanly again
  - chrony-config.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1508846400">- Modified the spec file to comment out the pool statement
  in chrony.conf if _not_ building for openSUSE. (bsc#1063704).</changelog>
  <changelog author="mpluskal@suse.com" date="1509019200">- Cleanup spec file:
  * Drop pre systemd support
  * Run spec-cleaner</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mpluskal@suse.com" date="1518177600">- Enable pps support</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Fix name of fillup template (was never installed before)
- Fix Requires for fillup, it's used in post, not pre.</changelog>
  <changelog author="kukuk@suse.de" date="1522065600">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mpost@suse.com" date="1524052800">- Added /etc/chrony.d/ directory to the package (bsc#1083597)
  Modifed default chrony.conf to add "include /etc/chrony.d/*"</changelog>
  <changelog author="mpluskal@suse.com" date="1544788800">- Make sure to generate correct sysconfig file (boo#1117147)</changelog>
  <changelog author="max@suse.com" date="1553083200">- Fix ordering and dependencies of chronyd.service, so that it is
  started after name resolution is up (bsc#1129914).
- Add chrony-service-ordering.patch</changelog>
  <changelog author="max@suse.com" date="1578484800">- bsc#1159840: Add chrony-ntp-era-split.patch from upstream to fix
  "make check" builds made after 2019-12-20. Existing installations
  do not need to be updated as the bug only affects the test, but
  not chrony itself.</changelog>
  <changelog author="max@suse.com" date="1585310400">- Read runtime servers from /var/run/netconfig/chrony.servers to
  fix bsc#1099272 and bsc#1161119.
- Move chrony-helper to /usr/lib/chrony/helper, because there
  should be no executables in /usr/share.
- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.</changelog>
  <changelog author="max@suse.com" date="1590580800">- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="max@suse.com" date="1601380800">- Integrate three upstream patches to fix an infinite loop in
  chronyc (bsc#1171806).
  * chrony-select-timeout.patch
  * chrony-gettimeofday.patch
  * chrony-urandom.patch</changelog>
  <changelog author="max@suse.com" date="1617883200">- boo#1162964, bsc#1183783, clknetsim-glibc-2.31.patch:
  Fix build with glibc-2.31
- bsc#1184400, chrony-pidfile.patch:
  Use /run instead of /var/run for PIDFile in chronyd.service.</changelog>
  <changelog author="max@suse.com" date="1621771200">- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
</package>
<package pkgid="a8435e4f30faabae3e4a183476444bcc1f418f7f1050648f11de743840770677" name="chrony" arch="s390x">
  <version epoch="0" ver="3.2" rel="9.24.2"/>
  <changelog author="mpost@suse.com" date="1480420800">- Upgraded to version 2.4.1:
  - Bug fixes
  - Fix processing of kernel timestamps on non-Linux systems
  - Fix crash with smoothtime directive
  - Fix validation of refclock sample times
  - Fix parsing of refclock directive</changelog>
  <changelog author="mpost@suse.com" date="1484568000">- Upgraded to version 3.0:
  - Enhancements
  - Add support for software and hardware timestamping on Linux
  - Add support for client/server and symmetric interleaved modes
  - Add support for MS-SNTP authentication in Samba
  - Add support for truncated MACs in NTPv4 packets
  - Estimate and correct for asymmetric network jitter
  - Increase default minsamples and polltarget to improve stability with very low jitter
  - Add maxjitter directive to limit source selection by jitter
  - Add offset option to server/pool/peer directive
  - Add maxlockage option to refclock directive
  - Add -t option to chronyd to exit after specified time
  - Add partial protection against replay attacks on symmetric mode
  - Don't reset polling interval when switching sources to online state
  - Allow rate limiting with very short intervals
  - Improve maximum server throughput on Linux and NetBSD
  - Remove dump files after start
  - Add tab-completion to chronyc with libedit/readline
  - Add ntpdata command to print details about NTP measurements
  - Allow all source options to be set in add server/peer command
  - Indicate truncated addresses/hostnames in chronyc output
  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses
  - Bug fixes
  - Fix crash with disabled asynchronous name resolving
- Upgraded clknetsim to version 6bb6519.</changelog>
  <changelog author="mpost@suse.com" date="1485864000">- Upgraded to version 3.1:
  - Enhancements
  - Add support for precise cross timestamping of PHC on Linux
  - Add minpoll, precision, nocrossts options to hwtimestamp directive
  - Add rawmeasurements option to log directive and modify measurements
    option to log only valid measurements from synchronised sources
  - Allow sub-second polling interval with NTP sources
  - Bug fixes
  - Fix time smoothing in interleaved mode
- Upgraded clknetsim to version ce89a1b.
- Reworked the following patches to fit the new versions
  - chrony-config.patch
  - chrony-service-helper.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1505908800">- Upgraded to version 3.2:
  Enhancements
  * Improve stability with NTP sources and reference clocks
  * Improve stability with hardware timestamping
  * Improve support for NTP interleaved modes
  * Control frequency of system clock on macOS 10.13 and later
  * Set TAI-UTC offset of system clock with leapsectz directive
  * Minimise data in client requests to improve privacy
  * Allow transmit-only hardware timestamping
  * Add support for new timestamping options introduced in Linux 4.13
  * Add root delay, root dispersion and maximum error to tracking log
  * Add mindelay and asymmetry options to server/peer/pool directive
  * Add extpps option to PHC refclock to timestamp external PPS signal
  * Add pps option to refclock directive to treat any refclock as PPS
  * Add width option to refclock directive to filter wrong pulse edges
  * Add rxfilter option to hwtimestamp directive
  * Add -x option to disable control of system clock
  * Add -l option to log to specified file instead of syslog
  * Allow multiple command-line options to be specified together
  * Allow starting without root privileges with -Q option
  * Update seccomp filter for new glibc versions
  * Dump history on exit by default with dumpdir directive
  * Use hardening compiler options by default
  Bug fixes
  * Don't drop PHC samples with low-resolution system clock
  * Ignore outliers in PHC tracking, RTC tracking, manual input
  * Increase polling interval when peer is not responding
  * Exit with error message when include directive fails
  * Don't allow slash after hostname in allow/deny directive/command
  * Try to connect to all addresses in chronyc before giving up
- Upgraded clknetsim to version 71dbbc5.
- Reworked chrony-fix-open.patch to fit the new version</changelog>
  <changelog author="mrueckert@suse.de" date="1506600000">- refresh patches to apply cleanly again
  - chrony-config.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1508846400">- Modified the spec file to comment out the pool statement
  in chrony.conf if _not_ building for openSUSE. (bsc#1063704).</changelog>
  <changelog author="mpluskal@suse.com" date="1509019200">- Cleanup spec file:
  * Drop pre systemd support
  * Run spec-cleaner</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mpluskal@suse.com" date="1518177600">- Enable pps support</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Fix name of fillup template (was never installed before)
- Fix Requires for fillup, it's used in post, not pre.</changelog>
  <changelog author="kukuk@suse.de" date="1522065600">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mpost@suse.com" date="1524052800">- Added /etc/chrony.d/ directory to the package (bsc#1083597)
  Modifed default chrony.conf to add "include /etc/chrony.d/*"</changelog>
  <changelog author="mpluskal@suse.com" date="1544788800">- Make sure to generate correct sysconfig file (boo#1117147)</changelog>
  <changelog author="max@suse.com" date="1553083200">- Fix ordering and dependencies of chronyd.service, so that it is
  started after name resolution is up (bsc#1129914).
- Add chrony-service-ordering.patch</changelog>
  <changelog author="max@suse.com" date="1578484800">- bsc#1159840: Add chrony-ntp-era-split.patch from upstream to fix
  "make check" builds made after 2019-12-20. Existing installations
  do not need to be updated as the bug only affects the test, but
  not chrony itself.</changelog>
  <changelog author="max@suse.com" date="1585310400">- Read runtime servers from /var/run/netconfig/chrony.servers to
  fix bsc#1099272 and bsc#1161119.
- Move chrony-helper to /usr/lib/chrony/helper, because there
  should be no executables in /usr/share.
- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.</changelog>
  <changelog author="max@suse.com" date="1590580800">- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="max@suse.com" date="1601380800">- Integrate three upstream patches to fix an infinite loop in
  chronyc (bsc#1171806).
  * chrony-select-timeout.patch
  * chrony-gettimeofday.patch
  * chrony-urandom.patch</changelog>
  <changelog author="max@suse.com" date="1617883200">- boo#1162964, bsc#1183783, clknetsim-glibc-2.31.patch:
  Fix build with glibc-2.31
- bsc#1184400, chrony-pidfile.patch:
  Use /run instead of /var/run for PIDFile in chronyd.service.</changelog>
  <changelog author="max@suse.com" date="1621771200">- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
</package>
<package pkgid="27268f3e76fea3fc9f9432eb543e6fb8af2daf1d3679f257aeee343488f4680a" name="chrony" arch="src">
  <version epoch="0" ver="3.2" rel="9.24.2"/>
  <changelog author="mpost@suse.com" date="1480420800">- Upgraded to version 2.4.1:
  - Bug fixes
  - Fix processing of kernel timestamps on non-Linux systems
  - Fix crash with smoothtime directive
  - Fix validation of refclock sample times
  - Fix parsing of refclock directive</changelog>
  <changelog author="mpost@suse.com" date="1484568000">- Upgraded to version 3.0:
  - Enhancements
  - Add support for software and hardware timestamping on Linux
  - Add support for client/server and symmetric interleaved modes
  - Add support for MS-SNTP authentication in Samba
  - Add support for truncated MACs in NTPv4 packets
  - Estimate and correct for asymmetric network jitter
  - Increase default minsamples and polltarget to improve stability with very low jitter
  - Add maxjitter directive to limit source selection by jitter
  - Add offset option to server/pool/peer directive
  - Add maxlockage option to refclock directive
  - Add -t option to chronyd to exit after specified time
  - Add partial protection against replay attacks on symmetric mode
  - Don't reset polling interval when switching sources to online state
  - Allow rate limiting with very short intervals
  - Improve maximum server throughput on Linux and NetBSD
  - Remove dump files after start
  - Add tab-completion to chronyc with libedit/readline
  - Add ntpdata command to print details about NTP measurements
  - Allow all source options to be set in add server/peer command
  - Indicate truncated addresses/hostnames in chronyc output
  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses
  - Bug fixes
  - Fix crash with disabled asynchronous name resolving
- Upgraded clknetsim to version 6bb6519.</changelog>
  <changelog author="mpost@suse.com" date="1485864000">- Upgraded to version 3.1:
  - Enhancements
  - Add support for precise cross timestamping of PHC on Linux
  - Add minpoll, precision, nocrossts options to hwtimestamp directive
  - Add rawmeasurements option to log directive and modify measurements
    option to log only valid measurements from synchronised sources
  - Allow sub-second polling interval with NTP sources
  - Bug fixes
  - Fix time smoothing in interleaved mode
- Upgraded clknetsim to version ce89a1b.
- Reworked the following patches to fit the new versions
  - chrony-config.patch
  - chrony-service-helper.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1505908800">- Upgraded to version 3.2:
  Enhancements
  * Improve stability with NTP sources and reference clocks
  * Improve stability with hardware timestamping
  * Improve support for NTP interleaved modes
  * Control frequency of system clock on macOS 10.13 and later
  * Set TAI-UTC offset of system clock with leapsectz directive
  * Minimise data in client requests to improve privacy
  * Allow transmit-only hardware timestamping
  * Add support for new timestamping options introduced in Linux 4.13
  * Add root delay, root dispersion and maximum error to tracking log
  * Add mindelay and asymmetry options to server/peer/pool directive
  * Add extpps option to PHC refclock to timestamp external PPS signal
  * Add pps option to refclock directive to treat any refclock as PPS
  * Add width option to refclock directive to filter wrong pulse edges
  * Add rxfilter option to hwtimestamp directive
  * Add -x option to disable control of system clock
  * Add -l option to log to specified file instead of syslog
  * Allow multiple command-line options to be specified together
  * Allow starting without root privileges with -Q option
  * Update seccomp filter for new glibc versions
  * Dump history on exit by default with dumpdir directive
  * Use hardening compiler options by default
  Bug fixes
  * Don't drop PHC samples with low-resolution system clock
  * Ignore outliers in PHC tracking, RTC tracking, manual input
  * Increase polling interval when peer is not responding
  * Exit with error message when include directive fails
  * Don't allow slash after hostname in allow/deny directive/command
  * Try to connect to all addresses in chronyc before giving up
- Upgraded clknetsim to version 71dbbc5.
- Reworked chrony-fix-open.patch to fit the new version</changelog>
  <changelog author="mrueckert@suse.de" date="1506600000">- refresh patches to apply cleanly again
  - chrony-config.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1508846400">- Modified the spec file to comment out the pool statement
  in chrony.conf if _not_ building for openSUSE. (bsc#1063704).</changelog>
  <changelog author="mpluskal@suse.com" date="1509019200">- Cleanup spec file:
  * Drop pre systemd support
  * Run spec-cleaner</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mpluskal@suse.com" date="1518177600">- Enable pps support</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Fix name of fillup template (was never installed before)
- Fix Requires for fillup, it's used in post, not pre.</changelog>
  <changelog author="kukuk@suse.de" date="1522065600">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mpost@suse.com" date="1524052800">- Added /etc/chrony.d/ directory to the package (bsc#1083597)
  Modifed default chrony.conf to add "include /etc/chrony.d/*"</changelog>
  <changelog author="mpluskal@suse.com" date="1544788800">- Make sure to generate correct sysconfig file (boo#1117147)</changelog>
  <changelog author="max@suse.com" date="1553083200">- Fix ordering and dependencies of chronyd.service, so that it is
  started after name resolution is up (bsc#1129914).
- Add chrony-service-ordering.patch</changelog>
  <changelog author="max@suse.com" date="1578484800">- bsc#1159840: Add chrony-ntp-era-split.patch from upstream to fix
  "make check" builds made after 2019-12-20. Existing installations
  do not need to be updated as the bug only affects the test, but
  not chrony itself.</changelog>
  <changelog author="max@suse.com" date="1585310400">- Read runtime servers from /var/run/netconfig/chrony.servers to
  fix bsc#1099272 and bsc#1161119.
- Move chrony-helper to /usr/lib/chrony/helper, because there
  should be no executables in /usr/share.
- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.</changelog>
  <changelog author="max@suse.com" date="1590580800">- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="max@suse.com" date="1601380800">- Integrate three upstream patches to fix an infinite loop in
  chronyc (bsc#1171806).
  * chrony-select-timeout.patch
  * chrony-gettimeofday.patch
  * chrony-urandom.patch</changelog>
  <changelog author="max@suse.com" date="1617883200">- boo#1162964, bsc#1183783, clknetsim-glibc-2.31.patch:
  Fix build with glibc-2.31
- bsc#1184400, chrony-pidfile.patch:
  Use /run instead of /var/run for PIDFile in chronyd.service.</changelog>
  <changelog author="max@suse.com" date="1621771200">- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
</package>
<package pkgid="b5ec7fafb382136f8399d6bcf6e5f5ac2449fafac26b421a0f7d29d8410a5e2f" name="chrony" arch="x86_64">
  <version epoch="0" ver="3.2" rel="9.24.2"/>
  <changelog author="mpost@suse.com" date="1480420800">- Upgraded to version 2.4.1:
  - Bug fixes
  - Fix processing of kernel timestamps on non-Linux systems
  - Fix crash with smoothtime directive
  - Fix validation of refclock sample times
  - Fix parsing of refclock directive</changelog>
  <changelog author="mpost@suse.com" date="1484568000">- Upgraded to version 3.0:
  - Enhancements
  - Add support for software and hardware timestamping on Linux
  - Add support for client/server and symmetric interleaved modes
  - Add support for MS-SNTP authentication in Samba
  - Add support for truncated MACs in NTPv4 packets
  - Estimate and correct for asymmetric network jitter
  - Increase default minsamples and polltarget to improve stability with very low jitter
  - Add maxjitter directive to limit source selection by jitter
  - Add offset option to server/pool/peer directive
  - Add maxlockage option to refclock directive
  - Add -t option to chronyd to exit after specified time
  - Add partial protection against replay attacks on symmetric mode
  - Don't reset polling interval when switching sources to online state
  - Allow rate limiting with very short intervals
  - Improve maximum server throughput on Linux and NetBSD
  - Remove dump files after start
  - Add tab-completion to chronyc with libedit/readline
  - Add ntpdata command to print details about NTP measurements
  - Allow all source options to be set in add server/peer command
  - Indicate truncated addresses/hostnames in chronyc output
  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses
  - Bug fixes
  - Fix crash with disabled asynchronous name resolving
- Upgraded clknetsim to version 6bb6519.</changelog>
  <changelog author="mpost@suse.com" date="1485864000">- Upgraded to version 3.1:
  - Enhancements
  - Add support for precise cross timestamping of PHC on Linux
  - Add minpoll, precision, nocrossts options to hwtimestamp directive
  - Add rawmeasurements option to log directive and modify measurements
    option to log only valid measurements from synchronised sources
  - Allow sub-second polling interval with NTP sources
  - Bug fixes
  - Fix time smoothing in interleaved mode
- Upgraded clknetsim to version ce89a1b.
- Reworked the following patches to fit the new versions
  - chrony-config.patch
  - chrony-service-helper.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1505908800">- Upgraded to version 3.2:
  Enhancements
  * Improve stability with NTP sources and reference clocks
  * Improve stability with hardware timestamping
  * Improve support for NTP interleaved modes
  * Control frequency of system clock on macOS 10.13 and later
  * Set TAI-UTC offset of system clock with leapsectz directive
  * Minimise data in client requests to improve privacy
  * Allow transmit-only hardware timestamping
  * Add support for new timestamping options introduced in Linux 4.13
  * Add root delay, root dispersion and maximum error to tracking log
  * Add mindelay and asymmetry options to server/peer/pool directive
  * Add extpps option to PHC refclock to timestamp external PPS signal
  * Add pps option to refclock directive to treat any refclock as PPS
  * Add width option to refclock directive to filter wrong pulse edges
  * Add rxfilter option to hwtimestamp directive
  * Add -x option to disable control of system clock
  * Add -l option to log to specified file instead of syslog
  * Allow multiple command-line options to be specified together
  * Allow starting without root privileges with -Q option
  * Update seccomp filter for new glibc versions
  * Dump history on exit by default with dumpdir directive
  * Use hardening compiler options by default
  Bug fixes
  * Don't drop PHC samples with low-resolution system clock
  * Ignore outliers in PHC tracking, RTC tracking, manual input
  * Increase polling interval when peer is not responding
  * Exit with error message when include directive fails
  * Don't allow slash after hostname in allow/deny directive/command
  * Try to connect to all addresses in chronyc before giving up
- Upgraded clknetsim to version 71dbbc5.
- Reworked chrony-fix-open.patch to fit the new version</changelog>
  <changelog author="mrueckert@suse.de" date="1506600000">- refresh patches to apply cleanly again
  - chrony-config.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1508846400">- Modified the spec file to comment out the pool statement
  in chrony.conf if _not_ building for openSUSE. (bsc#1063704).</changelog>
  <changelog author="mpluskal@suse.com" date="1509019200">- Cleanup spec file:
  * Drop pre systemd support
  * Run spec-cleaner</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mpluskal@suse.com" date="1518177600">- Enable pps support</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Fix name of fillup template (was never installed before)
- Fix Requires for fillup, it's used in post, not pre.</changelog>
  <changelog author="kukuk@suse.de" date="1522065600">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mpost@suse.com" date="1524052800">- Added /etc/chrony.d/ directory to the package (bsc#1083597)
  Modifed default chrony.conf to add "include /etc/chrony.d/*"</changelog>
  <changelog author="mpluskal@suse.com" date="1544788800">- Make sure to generate correct sysconfig file (boo#1117147)</changelog>
  <changelog author="max@suse.com" date="1553083200">- Fix ordering and dependencies of chronyd.service, so that it is
  started after name resolution is up (bsc#1129914).
- Add chrony-service-ordering.patch</changelog>
  <changelog author="max@suse.com" date="1578484800">- bsc#1159840: Add chrony-ntp-era-split.patch from upstream to fix
  "make check" builds made after 2019-12-20. Existing installations
  do not need to be updated as the bug only affects the test, but
  not chrony itself.</changelog>
  <changelog author="max@suse.com" date="1585310400">- Read runtime servers from /var/run/netconfig/chrony.servers to
  fix bsc#1099272 and bsc#1161119.
- Move chrony-helper to /usr/lib/chrony/helper, because there
  should be no executables in /usr/share.
- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.</changelog>
  <changelog author="max@suse.com" date="1590580800">- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="max@suse.com" date="1601380800">- Integrate three upstream patches to fix an infinite loop in
  chronyc (bsc#1171806).
  * chrony-select-timeout.patch
  * chrony-gettimeofday.patch
  * chrony-urandom.patch</changelog>
  <changelog author="max@suse.com" date="1617883200">- boo#1162964, bsc#1183783, clknetsim-glibc-2.31.patch:
  Fix build with glibc-2.31
- bsc#1184400, chrony-pidfile.patch:
  Use /run instead of /var/run for PIDFile in chronyd.service.</changelog>
  <changelog author="max@suse.com" date="1621771200">- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
</package>
<package pkgid="b36ed40e54e1689f520a61ebfb5167577b542dea7534448bd674b75bebd14406" name="chrony-pool-empty" arch="noarch">
  <version epoch="0" ver="3.2" rel="9.24.2"/>
  <changelog author="mpost@suse.com" date="1480420800">- Upgraded to version 2.4.1:
  - Bug fixes
  - Fix processing of kernel timestamps on non-Linux systems
  - Fix crash with smoothtime directive
  - Fix validation of refclock sample times
  - Fix parsing of refclock directive</changelog>
  <changelog author="mpost@suse.com" date="1484568000">- Upgraded to version 3.0:
  - Enhancements
  - Add support for software and hardware timestamping on Linux
  - Add support for client/server and symmetric interleaved modes
  - Add support for MS-SNTP authentication in Samba
  - Add support for truncated MACs in NTPv4 packets
  - Estimate and correct for asymmetric network jitter
  - Increase default minsamples and polltarget to improve stability with very low jitter
  - Add maxjitter directive to limit source selection by jitter
  - Add offset option to server/pool/peer directive
  - Add maxlockage option to refclock directive
  - Add -t option to chronyd to exit after specified time
  - Add partial protection against replay attacks on symmetric mode
  - Don't reset polling interval when switching sources to online state
  - Allow rate limiting with very short intervals
  - Improve maximum server throughput on Linux and NetBSD
  - Remove dump files after start
  - Add tab-completion to chronyc with libedit/readline
  - Add ntpdata command to print details about NTP measurements
  - Allow all source options to be set in add server/peer command
  - Indicate truncated addresses/hostnames in chronyc output
  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses
  - Bug fixes
  - Fix crash with disabled asynchronous name resolving
- Upgraded clknetsim to version 6bb6519.</changelog>
  <changelog author="mpost@suse.com" date="1485864000">- Upgraded to version 3.1:
  - Enhancements
  - Add support for precise cross timestamping of PHC on Linux
  - Add minpoll, precision, nocrossts options to hwtimestamp directive
  - Add rawmeasurements option to log directive and modify measurements
    option to log only valid measurements from synchronised sources
  - Allow sub-second polling interval with NTP sources
  - Bug fixes
  - Fix time smoothing in interleaved mode
- Upgraded clknetsim to version ce89a1b.
- Reworked the following patches to fit the new versions
  - chrony-config.patch
  - chrony-service-helper.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1505908800">- Upgraded to version 3.2:
  Enhancements
  * Improve stability with NTP sources and reference clocks
  * Improve stability with hardware timestamping
  * Improve support for NTP interleaved modes
  * Control frequency of system clock on macOS 10.13 and later
  * Set TAI-UTC offset of system clock with leapsectz directive
  * Minimise data in client requests to improve privacy
  * Allow transmit-only hardware timestamping
  * Add support for new timestamping options introduced in Linux 4.13
  * Add root delay, root dispersion and maximum error to tracking log
  * Add mindelay and asymmetry options to server/peer/pool directive
  * Add extpps option to PHC refclock to timestamp external PPS signal
  * Add pps option to refclock directive to treat any refclock as PPS
  * Add width option to refclock directive to filter wrong pulse edges
  * Add rxfilter option to hwtimestamp directive
  * Add -x option to disable control of system clock
  * Add -l option to log to specified file instead of syslog
  * Allow multiple command-line options to be specified together
  * Allow starting without root privileges with -Q option
  * Update seccomp filter for new glibc versions
  * Dump history on exit by default with dumpdir directive
  * Use hardening compiler options by default
  Bug fixes
  * Don't drop PHC samples with low-resolution system clock
  * Ignore outliers in PHC tracking, RTC tracking, manual input
  * Increase polling interval when peer is not responding
  * Exit with error message when include directive fails
  * Don't allow slash after hostname in allow/deny directive/command
  * Try to connect to all addresses in chronyc before giving up
- Upgraded clknetsim to version 71dbbc5.
- Reworked chrony-fix-open.patch to fit the new version</changelog>
  <changelog author="mrueckert@suse.de" date="1506600000">- refresh patches to apply cleanly again
  - chrony-config.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1508846400">- Modified the spec file to comment out the pool statement
  in chrony.conf if _not_ building for openSUSE. (bsc#1063704).</changelog>
  <changelog author="mpluskal@suse.com" date="1509019200">- Cleanup spec file:
  * Drop pre systemd support
  * Run spec-cleaner</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mpluskal@suse.com" date="1518177600">- Enable pps support</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Fix name of fillup template (was never installed before)
- Fix Requires for fillup, it's used in post, not pre.</changelog>
  <changelog author="kukuk@suse.de" date="1522065600">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mpost@suse.com" date="1524052800">- Added /etc/chrony.d/ directory to the package (bsc#1083597)
  Modifed default chrony.conf to add "include /etc/chrony.d/*"</changelog>
  <changelog author="mpluskal@suse.com" date="1544788800">- Make sure to generate correct sysconfig file (boo#1117147)</changelog>
  <changelog author="max@suse.com" date="1553083200">- Fix ordering and dependencies of chronyd.service, so that it is
  started after name resolution is up (bsc#1129914).
- Add chrony-service-ordering.patch</changelog>
  <changelog author="max@suse.com" date="1578484800">- bsc#1159840: Add chrony-ntp-era-split.patch from upstream to fix
  "make check" builds made after 2019-12-20. Existing installations
  do not need to be updated as the bug only affects the test, but
  not chrony itself.</changelog>
  <changelog author="max@suse.com" date="1585310400">- Read runtime servers from /var/run/netconfig/chrony.servers to
  fix bsc#1099272 and bsc#1161119.
- Move chrony-helper to /usr/lib/chrony/helper, because there
  should be no executables in /usr/share.
- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.</changelog>
  <changelog author="max@suse.com" date="1590580800">- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="max@suse.com" date="1601380800">- Integrate three upstream patches to fix an infinite loop in
  chronyc (bsc#1171806).
  * chrony-select-timeout.patch
  * chrony-gettimeofday.patch
  * chrony-urandom.patch</changelog>
  <changelog author="max@suse.com" date="1617883200">- boo#1162964, bsc#1183783, clknetsim-glibc-2.31.patch:
  Fix build with glibc-2.31
- bsc#1184400, chrony-pidfile.patch:
  Use /run instead of /var/run for PIDFile in chronyd.service.</changelog>
  <changelog author="max@suse.com" date="1621771200">- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
</package>
<package pkgid="294e582ea022c53dc759f6c6fd3581897ad022be3d39294fc8eae26bbc055a4b" name="chrony-pool-openSUSE" arch="noarch">
  <version epoch="0" ver="3.2" rel="9.24.2"/>
  <changelog author="mpost@suse.com" date="1480420800">- Upgraded to version 2.4.1:
  - Bug fixes
  - Fix processing of kernel timestamps on non-Linux systems
  - Fix crash with smoothtime directive
  - Fix validation of refclock sample times
  - Fix parsing of refclock directive</changelog>
  <changelog author="mpost@suse.com" date="1484568000">- Upgraded to version 3.0:
  - Enhancements
  - Add support for software and hardware timestamping on Linux
  - Add support for client/server and symmetric interleaved modes
  - Add support for MS-SNTP authentication in Samba
  - Add support for truncated MACs in NTPv4 packets
  - Estimate and correct for asymmetric network jitter
  - Increase default minsamples and polltarget to improve stability with very low jitter
  - Add maxjitter directive to limit source selection by jitter
  - Add offset option to server/pool/peer directive
  - Add maxlockage option to refclock directive
  - Add -t option to chronyd to exit after specified time
  - Add partial protection against replay attacks on symmetric mode
  - Don't reset polling interval when switching sources to online state
  - Allow rate limiting with very short intervals
  - Improve maximum server throughput on Linux and NetBSD
  - Remove dump files after start
  - Add tab-completion to chronyc with libedit/readline
  - Add ntpdata command to print details about NTP measurements
  - Allow all source options to be set in add server/peer command
  - Indicate truncated addresses/hostnames in chronyc output
  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses
  - Bug fixes
  - Fix crash with disabled asynchronous name resolving
- Upgraded clknetsim to version 6bb6519.</changelog>
  <changelog author="mpost@suse.com" date="1485864000">- Upgraded to version 3.1:
  - Enhancements
  - Add support for precise cross timestamping of PHC on Linux
  - Add minpoll, precision, nocrossts options to hwtimestamp directive
  - Add rawmeasurements option to log directive and modify measurements
    option to log only valid measurements from synchronised sources
  - Allow sub-second polling interval with NTP sources
  - Bug fixes
  - Fix time smoothing in interleaved mode
- Upgraded clknetsim to version ce89a1b.
- Reworked the following patches to fit the new versions
  - chrony-config.patch
  - chrony-service-helper.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1505908800">- Upgraded to version 3.2:
  Enhancements
  * Improve stability with NTP sources and reference clocks
  * Improve stability with hardware timestamping
  * Improve support for NTP interleaved modes
  * Control frequency of system clock on macOS 10.13 and later
  * Set TAI-UTC offset of system clock with leapsectz directive
  * Minimise data in client requests to improve privacy
  * Allow transmit-only hardware timestamping
  * Add support for new timestamping options introduced in Linux 4.13
  * Add root delay, root dispersion and maximum error to tracking log
  * Add mindelay and asymmetry options to server/peer/pool directive
  * Add extpps option to PHC refclock to timestamp external PPS signal
  * Add pps option to refclock directive to treat any refclock as PPS
  * Add width option to refclock directive to filter wrong pulse edges
  * Add rxfilter option to hwtimestamp directive
  * Add -x option to disable control of system clock
  * Add -l option to log to specified file instead of syslog
  * Allow multiple command-line options to be specified together
  * Allow starting without root privileges with -Q option
  * Update seccomp filter for new glibc versions
  * Dump history on exit by default with dumpdir directive
  * Use hardening compiler options by default
  Bug fixes
  * Don't drop PHC samples with low-resolution system clock
  * Ignore outliers in PHC tracking, RTC tracking, manual input
  * Increase polling interval when peer is not responding
  * Exit with error message when include directive fails
  * Don't allow slash after hostname in allow/deny directive/command
  * Try to connect to all addresses in chronyc before giving up
- Upgraded clknetsim to version 71dbbc5.
- Reworked chrony-fix-open.patch to fit the new version</changelog>
  <changelog author="mrueckert@suse.de" date="1506600000">- refresh patches to apply cleanly again
  - chrony-config.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1508846400">- Modified the spec file to comment out the pool statement
  in chrony.conf if _not_ building for openSUSE. (bsc#1063704).</changelog>
  <changelog author="mpluskal@suse.com" date="1509019200">- Cleanup spec file:
  * Drop pre systemd support
  * Run spec-cleaner</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mpluskal@suse.com" date="1518177600">- Enable pps support</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Fix name of fillup template (was never installed before)
- Fix Requires for fillup, it's used in post, not pre.</changelog>
  <changelog author="kukuk@suse.de" date="1522065600">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mpost@suse.com" date="1524052800">- Added /etc/chrony.d/ directory to the package (bsc#1083597)
  Modifed default chrony.conf to add "include /etc/chrony.d/*"</changelog>
  <changelog author="mpluskal@suse.com" date="1544788800">- Make sure to generate correct sysconfig file (boo#1117147)</changelog>
  <changelog author="max@suse.com" date="1553083200">- Fix ordering and dependencies of chronyd.service, so that it is
  started after name resolution is up (bsc#1129914).
- Add chrony-service-ordering.patch</changelog>
  <changelog author="max@suse.com" date="1578484800">- bsc#1159840: Add chrony-ntp-era-split.patch from upstream to fix
  "make check" builds made after 2019-12-20. Existing installations
  do not need to be updated as the bug only affects the test, but
  not chrony itself.</changelog>
  <changelog author="max@suse.com" date="1585310400">- Read runtime servers from /var/run/netconfig/chrony.servers to
  fix bsc#1099272 and bsc#1161119.
- Move chrony-helper to /usr/lib/chrony/helper, because there
  should be no executables in /usr/share.
- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.</changelog>
  <changelog author="max@suse.com" date="1590580800">- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="max@suse.com" date="1601380800">- Integrate three upstream patches to fix an infinite loop in
  chronyc (bsc#1171806).
  * chrony-select-timeout.patch
  * chrony-gettimeofday.patch
  * chrony-urandom.patch</changelog>
  <changelog author="max@suse.com" date="1617883200">- boo#1162964, bsc#1183783, clknetsim-glibc-2.31.patch:
  Fix build with glibc-2.31
- bsc#1184400, chrony-pidfile.patch:
  Use /run instead of /var/run for PIDFile in chronyd.service.</changelog>
  <changelog author="max@suse.com" date="1621771200">- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
</package>
<package pkgid="b115cffb7773a55ab86891563823b1dc5f3b4617a15837e5f7125f45108c67d7" name="chrony-pool-suse" arch="noarch">
  <version epoch="0" ver="3.2" rel="9.24.2"/>
  <changelog author="mpost@suse.com" date="1480420800">- Upgraded to version 2.4.1:
  - Bug fixes
  - Fix processing of kernel timestamps on non-Linux systems
  - Fix crash with smoothtime directive
  - Fix validation of refclock sample times
  - Fix parsing of refclock directive</changelog>
  <changelog author="mpost@suse.com" date="1484568000">- Upgraded to version 3.0:
  - Enhancements
  - Add support for software and hardware timestamping on Linux
  - Add support for client/server and symmetric interleaved modes
  - Add support for MS-SNTP authentication in Samba
  - Add support for truncated MACs in NTPv4 packets
  - Estimate and correct for asymmetric network jitter
  - Increase default minsamples and polltarget to improve stability with very low jitter
  - Add maxjitter directive to limit source selection by jitter
  - Add offset option to server/pool/peer directive
  - Add maxlockage option to refclock directive
  - Add -t option to chronyd to exit after specified time
  - Add partial protection against replay attacks on symmetric mode
  - Don't reset polling interval when switching sources to online state
  - Allow rate limiting with very short intervals
  - Improve maximum server throughput on Linux and NetBSD
  - Remove dump files after start
  - Add tab-completion to chronyc with libedit/readline
  - Add ntpdata command to print details about NTP measurements
  - Allow all source options to be set in add server/peer command
  - Indicate truncated addresses/hostnames in chronyc output
  - Print reference IDs as hexadecimal numbers to avoid confusion with IPv4 addresses
  - Bug fixes
  - Fix crash with disabled asynchronous name resolving
- Upgraded clknetsim to version 6bb6519.</changelog>
  <changelog author="mpost@suse.com" date="1485864000">- Upgraded to version 3.1:
  - Enhancements
  - Add support for precise cross timestamping of PHC on Linux
  - Add minpoll, precision, nocrossts options to hwtimestamp directive
  - Add rawmeasurements option to log directive and modify measurements
    option to log only valid measurements from synchronised sources
  - Allow sub-second polling interval with NTP sources
  - Bug fixes
  - Fix time smoothing in interleaved mode
- Upgraded clknetsim to version ce89a1b.
- Reworked the following patches to fit the new versions
  - chrony-config.patch
  - chrony-service-helper.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1505908800">- Upgraded to version 3.2:
  Enhancements
  * Improve stability with NTP sources and reference clocks
  * Improve stability with hardware timestamping
  * Improve support for NTP interleaved modes
  * Control frequency of system clock on macOS 10.13 and later
  * Set TAI-UTC offset of system clock with leapsectz directive
  * Minimise data in client requests to improve privacy
  * Allow transmit-only hardware timestamping
  * Add support for new timestamping options introduced in Linux 4.13
  * Add root delay, root dispersion and maximum error to tracking log
  * Add mindelay and asymmetry options to server/peer/pool directive
  * Add extpps option to PHC refclock to timestamp external PPS signal
  * Add pps option to refclock directive to treat any refclock as PPS
  * Add width option to refclock directive to filter wrong pulse edges
  * Add rxfilter option to hwtimestamp directive
  * Add -x option to disable control of system clock
  * Add -l option to log to specified file instead of syslog
  * Allow multiple command-line options to be specified together
  * Allow starting without root privileges with -Q option
  * Update seccomp filter for new glibc versions
  * Dump history on exit by default with dumpdir directive
  * Use hardening compiler options by default
  Bug fixes
  * Don't drop PHC samples with low-resolution system clock
  * Ignore outliers in PHC tracking, RTC tracking, manual input
  * Increase polling interval when peer is not responding
  * Exit with error message when include directive fails
  * Don't allow slash after hostname in allow/deny directive/command
  * Try to connect to all addresses in chronyc before giving up
- Upgraded clknetsim to version 71dbbc5.
- Reworked chrony-fix-open.patch to fit the new version</changelog>
  <changelog author="mrueckert@suse.de" date="1506600000">- refresh patches to apply cleanly again
  - chrony-config.patch
  - chrony-fix-open.patch</changelog>
  <changelog author="mpost@suse.com" date="1508846400">- Modified the spec file to comment out the pool statement
  in chrony.conf if _not_ building for openSUSE. (bsc#1063704).</changelog>
  <changelog author="mpluskal@suse.com" date="1509019200">- Cleanup spec file:
  * Drop pre systemd support
  * Run spec-cleaner</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mpluskal@suse.com" date="1518177600">- Enable pps support</changelog>
  <changelog author="kukuk@suse.de" date="1521028800">- Fix name of fillup template (was never installed before)
- Fix Requires for fillup, it's used in post, not pre.</changelog>
  <changelog author="kukuk@suse.de" date="1522065600">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="mpost@suse.com" date="1524052800">- Added /etc/chrony.d/ directory to the package (bsc#1083597)
  Modifed default chrony.conf to add "include /etc/chrony.d/*"</changelog>
  <changelog author="mpluskal@suse.com" date="1544788800">- Make sure to generate correct sysconfig file (boo#1117147)</changelog>
  <changelog author="max@suse.com" date="1553083200">- Fix ordering and dependencies of chronyd.service, so that it is
  started after name resolution is up (bsc#1129914).
- Add chrony-service-ordering.patch</changelog>
  <changelog author="max@suse.com" date="1578484800">- bsc#1159840: Add chrony-ntp-era-split.patch from upstream to fix
  "make check" builds made after 2019-12-20. Existing installations
  do not need to be updated as the bug only affects the test, but
  not chrony itself.</changelog>
  <changelog author="max@suse.com" date="1585310400">- Read runtime servers from /var/run/netconfig/chrony.servers to
  fix bsc#1099272 and bsc#1161119.
- Move chrony-helper to /usr/lib/chrony/helper, because there
  should be no executables in /usr/share.
- Add chrony-pool-suse and chrony-pool-openSUSE subpackages that
  preconfigure chrony to use NTP servers from the  respective
  pools for SUSE and openSUSE (bsc#1156884, SLE-11424).
- Add chrony-pool-empty to still allow installing chrony without
  preconfigured servers.</changelog>
  <changelog author="max@suse.com" date="1590580800">- Use iburst in the default pool statements to speed up initial
  synchronisation (bsc#1172113).</changelog>
  <changelog author="max@suse.com" date="1601380800">- Integrate three upstream patches to fix an infinite loop in
  chronyc (bsc#1171806).
  * chrony-select-timeout.patch
  * chrony-gettimeofday.patch
  * chrony-urandom.patch</changelog>
  <changelog author="max@suse.com" date="1617883200">- boo#1162964, bsc#1183783, clknetsim-glibc-2.31.patch:
  Fix build with glibc-2.31
- bsc#1184400, chrony-pidfile.patch:
  Use /run instead of /var/run for PIDFile in chronyd.service.</changelog>
  <changelog author="max@suse.com" date="1621771200">- bsc#1173760: MD5 is not available from mozilla-nss in FIPS mode,
  but needed for calculating refids from IPv6 addresses as part of
  the NTP protocol (rfc5905). As this is a non-cryptographic use of
  MD5 we can use our own implementation without violating FIPS
  rules: chrony-refid-internal-md5.patch .</changelog>
</package>
<package pkgid="2b2b2d6e820e76ea90c9236373293d33caf7114bc2d2fda3f40fef0e0fd0758b" name="clamav" arch="aarch64">
  <version epoch="0" ver="0.103.2" rel="3.29.1"/>
  <changelog author="max@suse.com" date="1533038400">- bsc#1101654: Disable YARA support for licensing reasons
  (clamav-disable-yara.patch).
- Do not ignore errors from useradd et al.
- Unclutter the spec file.</changelog>
  <changelog author="max@suse.com" date="1538654400">- Update to version 0.100.2:
  * bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
    unpacking feature that could allow an unauthenticated, remote
    attacker to cause a denial of service (DoS) condition on an
    affected device.
  * bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
    more fixes for embedded libmspack.
  * Make freshclam more robust against lagging signature mirrors.
  * On-Access "Extra Scanning", an opt-in minor feature of
    OnAccess scanning on Linux systems, has been disabled due to a
    known issue with resource cleanup OnAccessExtraScanning will
    be re-enabled in a future release when the issue is
    resolved. In the mean-time, users who enabled the feature in
    clamd.conf will see a warning informing them that the feature
    is not active. For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
  0.100.0 when the virus database is already up to date
  (bsc#1104457, clamav-freshclam-exit.patch).</changelog>
  <changelog author="max@suse.com" date="1548072000">- Update to version 0.101.1:
  * Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
  (clamav-str-h.patch)</changelog>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
</package>
<package pkgid="fcbb2af854e3d5423e7d8a0b2f1d951267831299be177e45065d7cb754c6adab" name="clamav" arch="ppc64le">
  <version epoch="0" ver="0.103.2" rel="3.29.1"/>
  <changelog author="max@suse.com" date="1533038400">- bsc#1101654: Disable YARA support for licensing reasons
  (clamav-disable-yara.patch).
- Do not ignore errors from useradd et al.
- Unclutter the spec file.</changelog>
  <changelog author="max@suse.com" date="1538654400">- Update to version 0.100.2:
  * bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
    unpacking feature that could allow an unauthenticated, remote
    attacker to cause a denial of service (DoS) condition on an
    affected device.
  * bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
    more fixes for embedded libmspack.
  * Make freshclam more robust against lagging signature mirrors.
  * On-Access "Extra Scanning", an opt-in minor feature of
    OnAccess scanning on Linux systems, has been disabled due to a
    known issue with resource cleanup OnAccessExtraScanning will
    be re-enabled in a future release when the issue is
    resolved. In the mean-time, users who enabled the feature in
    clamd.conf will see a warning informing them that the feature
    is not active. For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
  0.100.0 when the virus database is already up to date
  (bsc#1104457, clamav-freshclam-exit.patch).</changelog>
  <changelog author="max@suse.com" date="1548072000">- Update to version 0.101.1:
  * Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
  (clamav-str-h.patch)</changelog>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
</package>
<package pkgid="d0fde9314355c58a1e7ae4a0186833a7acd7b0a56d2d1fc35a83c008fe3f3fe3" name="clamav" arch="s390x">
  <version epoch="0" ver="0.103.2" rel="3.29.1"/>
  <changelog author="max@suse.com" date="1533038400">- bsc#1101654: Disable YARA support for licensing reasons
  (clamav-disable-yara.patch).
- Do not ignore errors from useradd et al.
- Unclutter the spec file.</changelog>
  <changelog author="max@suse.com" date="1538654400">- Update to version 0.100.2:
  * bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
    unpacking feature that could allow an unauthenticated, remote
    attacker to cause a denial of service (DoS) condition on an
    affected device.
  * bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
    more fixes for embedded libmspack.
  * Make freshclam more robust against lagging signature mirrors.
  * On-Access "Extra Scanning", an opt-in minor feature of
    OnAccess scanning on Linux systems, has been disabled due to a
    known issue with resource cleanup OnAccessExtraScanning will
    be re-enabled in a future release when the issue is
    resolved. In the mean-time, users who enabled the feature in
    clamd.conf will see a warning informing them that the feature
    is not active. For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
  0.100.0 when the virus database is already up to date
  (bsc#1104457, clamav-freshclam-exit.patch).</changelog>
  <changelog author="max@suse.com" date="1548072000">- Update to version 0.101.1:
  * Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
  (clamav-str-h.patch)</changelog>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
</package>
<package pkgid="8f57ee70ffb8eca7893ffc6b4bca9684a2f64d1ef78eb10ed109c7e8fd0653e2" name="clamav" arch="src">
  <version epoch="0" ver="0.103.2" rel="3.29.1"/>
  <changelog author="max@suse.com" date="1533038400">- bsc#1101654: Disable YARA support for licensing reasons
  (clamav-disable-yara.patch).
- Do not ignore errors from useradd et al.
- Unclutter the spec file.</changelog>
  <changelog author="max@suse.com" date="1538654400">- Update to version 0.100.2:
  * bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
    unpacking feature that could allow an unauthenticated, remote
    attacker to cause a denial of service (DoS) condition on an
    affected device.
  * bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
    more fixes for embedded libmspack.
  * Make freshclam more robust against lagging signature mirrors.
  * On-Access "Extra Scanning", an opt-in minor feature of
    OnAccess scanning on Linux systems, has been disabled due to a
    known issue with resource cleanup OnAccessExtraScanning will
    be re-enabled in a future release when the issue is
    resolved. In the mean-time, users who enabled the feature in
    clamd.conf will see a warning informing them that the feature
    is not active. For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
  0.100.0 when the virus database is already up to date
  (bsc#1104457, clamav-freshclam-exit.patch).</changelog>
  <changelog author="max@suse.com" date="1548072000">- Update to version 0.101.1:
  * Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
  (clamav-str-h.patch)</changelog>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
</package>
<package pkgid="8d0945856ce04e858917b4f28ecfcfa67ae7a3e04e925e873f57d6f4c5ea3b9a" name="clamav" arch="x86_64">
  <version epoch="0" ver="0.103.2" rel="3.29.1"/>
  <changelog author="max@suse.com" date="1533038400">- bsc#1101654: Disable YARA support for licensing reasons
  (clamav-disable-yara.patch).
- Do not ignore errors from useradd et al.
- Unclutter the spec file.</changelog>
  <changelog author="max@suse.com" date="1538654400">- Update to version 0.100.2:
  * bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
    unpacking feature that could allow an unauthenticated, remote
    attacker to cause a denial of service (DoS) condition on an
    affected device.
  * bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
    more fixes for embedded libmspack.
  * Make freshclam more robust against lagging signature mirrors.
  * On-Access "Extra Scanning", an opt-in minor feature of
    OnAccess scanning on Linux systems, has been disabled due to a
    known issue with resource cleanup OnAccessExtraScanning will
    be re-enabled in a future release when the issue is
    resolved. In the mean-time, users who enabled the feature in
    clamd.conf will see a warning informing them that the feature
    is not active. For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
  0.100.0 when the virus database is already up to date
  (bsc#1104457, clamav-freshclam-exit.patch).</changelog>
  <changelog author="max@suse.com" date="1548072000">- Update to version 0.101.1:
  * Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
  (clamav-str-h.patch)</changelog>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
</package>
<package pkgid="b3e04d8599b17490b7a0a66d48724c35deac4ac4588d5a8c48ff2779edc0acd7" name="clamav-devel" arch="aarch64">
  <version epoch="0" ver="0.103.2" rel="3.29.1"/>
  <changelog author="max@suse.com" date="1533038400">- bsc#1101654: Disable YARA support for licensing reasons
  (clamav-disable-yara.patch).
- Do not ignore errors from useradd et al.
- Unclutter the spec file.</changelog>
  <changelog author="max@suse.com" date="1538654400">- Update to version 0.100.2:
  * bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
    unpacking feature that could allow an unauthenticated, remote
    attacker to cause a denial of service (DoS) condition on an
    affected device.
  * bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
    more fixes for embedded libmspack.
  * Make freshclam more robust against lagging signature mirrors.
  * On-Access "Extra Scanning", an opt-in minor feature of
    OnAccess scanning on Linux systems, has been disabled due to a
    known issue with resource cleanup OnAccessExtraScanning will
    be re-enabled in a future release when the issue is
    resolved. In the mean-time, users who enabled the feature in
    clamd.conf will see a warning informing them that the feature
    is not active. For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
  0.100.0 when the virus database is already up to date
  (bsc#1104457, clamav-freshclam-exit.patch).</changelog>
  <changelog author="max@suse.com" date="1548072000">- Update to version 0.101.1:
  * Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
  (clamav-str-h.patch)</changelog>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
</package>
<package pkgid="7abbfef6f7f0f3b002fc8143a0cb2c35c983498a2b5ee6f38ae226271d459d51" name="clamav-devel" arch="ppc64le">
  <version epoch="0" ver="0.103.2" rel="3.29.1"/>
  <changelog author="max@suse.com" date="1533038400">- bsc#1101654: Disable YARA support for licensing reasons
  (clamav-disable-yara.patch).
- Do not ignore errors from useradd et al.
- Unclutter the spec file.</changelog>
  <changelog author="max@suse.com" date="1538654400">- Update to version 0.100.2:
  * bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
    unpacking feature that could allow an unauthenticated, remote
    attacker to cause a denial of service (DoS) condition on an
    affected device.
  * bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
    more fixes for embedded libmspack.
  * Make freshclam more robust against lagging signature mirrors.
  * On-Access "Extra Scanning", an opt-in minor feature of
    OnAccess scanning on Linux systems, has been disabled due to a
    known issue with resource cleanup OnAccessExtraScanning will
    be re-enabled in a future release when the issue is
    resolved. In the mean-time, users who enabled the feature in
    clamd.conf will see a warning informing them that the feature
    is not active. For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
  0.100.0 when the virus database is already up to date
  (bsc#1104457, clamav-freshclam-exit.patch).</changelog>
  <changelog author="max@suse.com" date="1548072000">- Update to version 0.101.1:
  * Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
  (clamav-str-h.patch)</changelog>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
</package>
<package pkgid="4fca336ce270ac84f3f5c8a8afa282319cf4aee3b6ba719f7d02f94903b8ddff" name="clamav-devel" arch="s390x">
  <version epoch="0" ver="0.103.2" rel="3.29.1"/>
  <changelog author="max@suse.com" date="1533038400">- bsc#1101654: Disable YARA support for licensing reasons
  (clamav-disable-yara.patch).
- Do not ignore errors from useradd et al.
- Unclutter the spec file.</changelog>
  <changelog author="max@suse.com" date="1538654400">- Update to version 0.100.2:
  * bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
    unpacking feature that could allow an unauthenticated, remote
    attacker to cause a denial of service (DoS) condition on an
    affected device.
  * bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
    more fixes for embedded libmspack.
  * Make freshclam more robust against lagging signature mirrors.
  * On-Access "Extra Scanning", an opt-in minor feature of
    OnAccess scanning on Linux systems, has been disabled due to a
    known issue with resource cleanup OnAccessExtraScanning will
    be re-enabled in a future release when the issue is
    resolved. In the mean-time, users who enabled the feature in
    clamd.conf will see a warning informing them that the feature
    is not active. For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
  0.100.0 when the virus database is already up to date
  (bsc#1104457, clamav-freshclam-exit.patch).</changelog>
  <changelog author="max@suse.com" date="1548072000">- Update to version 0.101.1:
  * Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
  (clamav-str-h.patch)</changelog>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
</package>
<package pkgid="10396a5357ad51c1309a6623fcaca68ce3b547002584ac14a3c412ebe77e2903" name="clamav-devel" arch="x86_64">
  <version epoch="0" ver="0.103.2" rel="3.29.1"/>
  <changelog author="max@suse.com" date="1533038400">- bsc#1101654: Disable YARA support for licensing reasons
  (clamav-disable-yara.patch).
- Do not ignore errors from useradd et al.
- Unclutter the spec file.</changelog>
  <changelog author="max@suse.com" date="1538654400">- Update to version 0.100.2:
  * bsc#1110723, CVE-2018-15378: Vulnerability in ClamAV's MEW
    unpacking feature that could allow an unauthenticated, remote
    attacker to cause a denial of service (DoS) condition on an
    affected device.
  * bsc#1103040, CVE-2018-14680, CVE-2018-14681, CVE-2018-14682:
    more fixes for embedded libmspack.
  * Make freshclam more robust against lagging signature mirrors.
  * On-Access "Extra Scanning", an opt-in minor feature of
    OnAccess scanning on Linux systems, has been disabled due to a
    known issue with resource cleanup OnAccessExtraScanning will
    be re-enabled in a future release when the issue is
    resolved. In the mean-time, users who enabled the feature in
    clamd.conf will see a warning informing them that the feature
    is not active. For details, see:
    https://bugzilla.clamav.net/show_bug.cgi?id=12048
- Restore exit code compatibility of freshclam with versions before
  0.100.0 when the virus database is already up to date
  (bsc#1104457, clamav-freshclam-exit.patch).</changelog>
  <changelog author="max@suse.com" date="1548072000">- Update to version 0.101.1:
  * Add missing headers to fix build of packages against libclamav.
- Add missing include for str.h to libclamav/others_common.c
  (clamav-str-h.patch)</changelog>
  <changelog author="egdfree@opensuse.org" date="1553688000">- Update to version 0.101.2 (bsc#1130721)
  * CVE-2019-1787:
    An out-of-bounds heap read condition may occur when scanning PDF
    documents. The defect is a failure to correctly keep track of the number
    of bytes remaining in a buffer when indexing file data.
  * CVE-2019-1789:
    An out-of-bounds heap read condition may occur when scanning PE files
    (i.e. Windows EXE and DLL files) that have been packed using Aspack as a
    result of inadequate bound-checking.
  * CVE-2019-1788:
    An out-of-bounds heap write condition may occur when scanning OLE2 files
    such as Microsoft Office 97-2003 documents. The invalid write happens when
    an invalid pointer is mistakenly used to initialize a 32bit integer to
    zero. This is likely to crash the application.
  * CVE-2019-1786:
    An out-of-bounds heap read condition may occur when scanning malformed
    PDF documents as a result of improper bounds-checking.
  * CVE-2019-1785:
    A path-traversal write condition may occur as a result of improper
    input validation when scanning RAR archives.
  * CVE-2019-1798:
    A use-after-free condition may occur as a result of improper error
    handling when scanning nested RAR archives.
- added clamav-max_patch.patch to fix build
- dropped clamav-freshclam-exit.patch</changelog>
  <changelog author="max@suse.com" date="1565092800">- Update to version 0.101.3:
  * bsc#1144504: ZIP bomb causes extreme CPU spikes</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1567598400">- update to 0.101.4:
  * CVE-2019-12900: An out of bounds write in the NSIS bzip2
    (boo#1149458)
  * CVE-2019-12625: Introduce a configurable time limit to mitigate
    zip bomb vulnerability completely. Default is 2 minutes,
    configurable useing the clamscan --max-scantime and for clamd
    using the MaxScanTime config option (boo#1144504)</changelog>
  <changelog author="max@suse.com" date="1572004800">- bsc#1151839: Increase the startup timeout of clamd to 5 minutes
  to cater for the grown virus database as a workaround until
  clamd has learned to talk to systemd to extend the timeout as
  long as needed.</changelog>
  <changelog author="suse+build@de-korte.org" date="1572609600">- update to 0.102.0
  * The On-Access Scanning feature has been migrated out of clamd
    and into a brand new utility named clamonacc. This utility is
    similar to clamdscan and clamav-milter in that it acts as a
    client to clamd. This separation from clamd means that clamd no
    longer needs to run with root privileges while scanning potentially
    malicious files. Instead, clamd may drop privileges to run under an
    account that does not have super-user. In addition to improving the
    security posture of running clamd with On-Access enabled, this
    update fixed a few outstanding defects:
  - On-Access scanning for created and moved files (Extra-Scanning)
    is fixed.
  - VirusEvent for On-Access scans is fixed.
  - With clamonacc, it is now possible to copy, move, or remove a
    file if the scan triggered an alert, just like with clamdscan.
  * The freshclam database update utility has undergone a significant
    update. This includes:
  - Added support for HTTPS.
  - Support for database mirrors hosted on ports other than 80.
  - Removal of the mirror management feature (mirrors.dat).
  - An all new libfreshclam library API.
- created new subpackage libfreshclam2
- dropped clamav-max_patch.patch (upstreamed)
- added clamav-fix_building_milter.patch to fix build of milter</changelog>
  <changelog author="suse+build@de-korte.org" date="1574251200">- update to 0.102.1
  * CVE-2019-15961, bsc#1157763: A Denial-of-Service (DoS)
    vulnerability may occur when scanning a specially crafted email
    file as a result of excessively long scan times. The issue is
    resolved by implementing several maximums in parsing MIME
    messages and by optimizing use of memory allocation.
  * Build system fixes to build clamav-milter, to correctly link
    with libxml2 when detected, and to correctly detect fanotify
    for on-access scanning feature support.
  * Signature load time is significantly reduced by changing to a
    more efficient algorithm for loading signature patterns and
    allocating the AC trie. Patch courtesy of Alberto Wu.
  * Introduced a new configure option to statically link libjson-c
    with libclamav. Static linking with libjson is highly
    recommended to prevent crashes in applications that use
    libclamav alongside another JSON parsing library.
  * Null-dereference fix in email parser when using the
  - -gen-json metadata option.
  * Fixes for Authenticode parsing and certificate signature
    (.crb database) bugs.
- dropped clamav-fix_building_milter.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="suse+build@de-korte.org" date="1577188800">- The freshclam.service should not be started before the network is
  online (it checks for updates immediately upon service start)</changelog>
  <changelog author="suse+build@de-korte.org" date="1580904000">- update to 0.102.2
  * CVE-2020-3123: A denial-of-service (DoS) condition may occur when
    using the optional credit card data-loss-prevention (DLP) feature.
    Improper bounds checking of an unsigned variable resulted in an
    out-of-bounds read, which causes a crash.
  * Significantly improved the scan speed of PDF files on Windows.
  * Re-applied a fix to alleviate file access issues when scanning RAR
    files in downstream projects that use libclamav where the scanning
    engine is operating in a low-privilege process. This bug was originally
    fixed in 0.101.2 and the fix was mistakenly omitted from 0.102.0.
  * Fixed an issue where freshclam failed to update if the database version
    downloaded is one version older than advertised. This situation may
    occur after a new database version is published. The issue affected
    users downloading the whole CVD database file.
  * Changed the default freshclam ReceiveTimeout setting to 0 (infinite).
    The ReceiveTimeout had caused needless database update failures for
    users with slower internet connections.
  * Correctly display the number of kilobytes (KiB) in progress bar and
    reduced the size of the progress bar to accommodate 80-character width
    terminals.
  * Fixed an issue where running freshclam manually causes a daemonized
    freshclam process to fail when it updates because the manual instance
    deletes the temporary download directory. The freshclam temporary files
    will now download to a unique directory created at the time of an update
    instead of using a hardcoded directory created/destroyed at the program
    start/exit.
  * Fix for freshclam's OnOutdatedExecute config option.
  * Fixes a memory leak in the error condition handling for the email
    parser.
  * Improved bound checking and error handling in ARJ archive parser.
  * Improved error handling in PDF parser.
  * Fix for memory leak in byte-compare signature handler.</changelog>
  <changelog author="mpluskal@suse.com" date="1585742400">- Drop python build dependency as it is not needed</changelog>
  <changelog author="suse+build@de-korte.org" date="1589284800">- Update to 0.102.3
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper bounds checking of an unsigned variable results
    in an out-of-bounds read which causes a crash.
  * CVE-2020-3341: Fix a vulnerability in the PDF parsing module in
    ClamAV 0.101 - 0.102.2 that could cause a Denial-of-Service (DoS)
    condition. Improper size checking of a buffer used to initialize AES
    decryption routines results in an out-of-bounds read which may cause
    a crash.
  * Fix "Attempt to allocate 0 bytes" error when parsing some PDF
    documents.
  * Fix a couple of minor memory leaks.
  * Updated libclamunrar to UnRAR 5.9.2.</changelog>
  <changelog author="suse+build@de-korte.org" date="1594900800">- Update to 0.102.4
  * CVE-2020-3350: Fix a vulnerability wherein a malicious user could
    replace a scan target's directory with a symlink to another path
    to trick clamscan, clamdscan, or clamonacc into removing or moving
    a different file (eg. a critical system file). The issue would
    affect users that use the --move or --remove options for clamscan,
    clamdscan, and clamonacc.
  * CVE-2020-3327: Fix a vulnerability in the ARJ archive parsing
    module in ClamAV 0.102.3 that could cause a Denial-of-Service
    (DoS) condition. Improper bounds checking results in an
    out-of-bounds read which could cause a crash. The previous fix for
    this CVE in 0.102.3 was incomplete. This fix correctly resolves
    the issue.
  * CVE-2020-3481: Fix a vulnerability in the EGG archive module in
    ClamAV 0.102.0 - 0.102.3 could cause a Denial-of-Service (DoS)
    condition. Improper error handling may result in a crash due to a
    NULL pointer dereference. This vulnerability is mitigated for
    those using the official ClamAV signature databases because the
    file type signatures in daily.cvd will not enable the EGG archive
    parser in versions affected by the vulnerability.</changelog>
  <changelog author="suse+build@de-korte.org" date="1600084800">- Update to 0.103.0
  * clamd can now reload the signature database without blocking
    scanning. This multi-threaded database reload improvement was made
    possible thanks to a community effort.
  - Non-blocking database reloads are now the default behavior. Some
    systems that are more constrained on RAM may need to disable
    non-blocking reloads as it will temporarily consume two times as
    much memory. We added a new clamd config option
    ConcurrentDatabaseReload, which may be set to no.
  * Dropped clamav-str-h.patch (no longer needed)
  * Fix clamav-milter.service (requires clamd.service to run)</changelog>
  <changelog author="max@suse.com" date="1605009600">- Sync Factory to SLE-15 to implement jsc#ECO-3010 and bsc#1118459.
- bsc#1119353, clamav-fips.patch: Fix freshclam crash in FIPS mode.
- Keep OBS from installing an existing clamav instance to scan the
  sources, because this makes "make check" use the old library
  instead of the just built one. This is only a workaround until
  we found a way to keep libtool from adding libdir to rpath and
  LD_LIBRARY_PATH of the binaries in the testsuite.</changelog>
  <changelog author="dimstar@opensuse.org" date="1605182400">- Do not hard-depend on systemd: use systemd_ordering instead of
  systemd_requires.</changelog>
  <changelog author="max@suse.com" date="1617969600">- Update clamav.keyring
- Update to 0.103.2
  * CVE-2021-1252, bsc#1184532: Fix for Excel XLM parser infinite
    loop. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1404, bsc#1184533: Fix for PDF parser buffer over-read;
    possible crash. Affects 0.103.0 and 0.103.1 only.
  * CVE-2021-1405, bsc#1184534: Fix for mail parser
    NULL-dereference crash. Affects 0.103.1 and prior.
  * Fix possible memory leak in PNG parser.
  * Fix ClamOnAcc scan on file-creation race condition so files are
    scanned after their contents are written.
  * FreshClam: Deprecate the SafeBrowsing config option. The
    SafeBrowsing option will no longer do anything.
  * For more details, see our blog post from last year about the
    future of the ClamAV Safe Browsing database.
  * FreshClam: Improved HTTP 304, 403, &amp; 429 handling.
  * FreshClam: Added back the mirrors.dat file to the database directory.
  * FreshClam will now exit with a failure in daemon mode if an HTTP 403
    (Forbidden) was received, because retrying later won't help any. The
    FreshClam user will have to take actions to get unblocked.
  * Fix the FreshClam mirror-sync issue where a downloaded database is
    "older than the version advertised."
  * bsc#1181256: Fix errors when scanning files &gt; 4G
  * obsoletes clamav-disable-timestamps.patch
- Update to 0.103.1
  * Added a new scan option to alert on broken media (graphics) file
    formats. This feature mitigates the risk of malformed media files
    intended to exploit vulnerabilities in other software. At present
    media validation exists for JPEG, TIFF, PNG, and GIF files. To
    enable this feature, set AlertBrokenMedia yes in clamd.conf, or
    use the --alert-broken-media option when using clamscan. These
    options are disabled by default in this patch release, but may be
    enabled in a subsequent release. Application developers may enable
    this scan option by enabling CL_SCAN_HEURISTIC_BROKEN_MEDIA for
    the heuristic scan option bit field.
  * Added CL_TYPE_TIFF, CL_TYPE_JPEG types to match GIF, PNG typing
    behavior. BMP and JPEG 2000 files will continue to detect as
    CL_TYPE_GRAPHICS because ClamAV does not yet have BMP or JPEG
    2000 format checking capabilities.
  * Fixed PNG parser logic bugs that caused an excess of parsing
    errors and fixed a stack exhaustion issue affecting some systems
    when scanning PNG files. PNG file type detection was disabled via
    signature database update for ClamAV version 0.103.0 to mitigate
    the effects from these bugs.
  * Fixed an issue where PNG and GIF files no longer work with
    Target:5 graphics signatures if detected as CL_TYPE_PNG/GIF rather
    than as CL_TYPE_GRAPHICS. Target types now support up to 10
    possible file types to make way for additional graphics types in
    future releases.
  * Fixed clamonacc's --fdpass option.
  - Interprocess file descriptor passing for clamonacc was broken
    since version 0.102.0 due to a bug introduced by the switch to
    curl for communicating with clamd. On Linux, passing file
    descriptors from one process to another is handled by the
    kernel, so we reverted clamonacc to use standard system calls
    for socket communication when fd passing is enabled.
  * Fixed a clamonacc stack corruption issue on some systems when
    using an older version of libcurl.
  * Allow clamscan and clamdscan scans to proceed even if the
    realpath lookup failed. This alleviates an issue on Windows
    scanning files hosted on file- systems that do not support the
    GetMappedFileNameW() API such as on ImDisk RAM-disks.
  * Fixed freshclam --on-update-execute=EXIT_1 temporary directory
    cleanup issue.
  * clamd's log output and VirusEvent now provide the scan target's
    file path instead of a file descriptor. The clamd socket API for
    submitting a scan by FD-passing doesn't include a file path, this
    feature works by looking up the file path by file descriptor.
    This feature works on Mac and Linux but is not yet implemented
    for other UNIX operating systems. FD-passing is not available for
    Windows.
  * Fixed an issue where freshclam database validation didn't work
    correctly when run in daemon mode on Linux/Unix.</changelog>
  <changelog author="meissner@suse.com" date="1625054400">- clamav-document-maxsize.patch: in the "clamscan" and "clamdscan" manpages,
  document that files over a certain size by default will silently not be
  scanned and how this can be adjusted (bsc#1187509)</changelog>
</package>
<package pkgid="367fcb84df42b181b5b02a2c71dd9b39d4f92072678f5d340a16caf3412f9c7c" name="clippy" arch="aarch64">
  <version epoch="0" ver="1.43.1" rel="15.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
</package>
<package pkgid="a66300869509d5b2c8aa2000acb8bc10616bb3ef1a907b5a6b6a26078322208b" name="clippy" arch="ppc64le">
  <version epoch="0" ver="1.43.1" rel="15.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
</package>
<package pkgid="f4c05f4aed00d3387681e5dbb9c6e2ecad13c22699fd4bdbb69c1f4386ce29de" name="clippy" arch="s390x">
  <version epoch="0" ver="1.43.1" rel="15.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
</package>
<package pkgid="1dcd5135ff7d6035390239a999c108ceff6d1fd873af72a9d847c5f472104862" name="clippy" arch="x86_64">
  <version epoch="0" ver="1.43.1" rel="15.1"/>
  <changelog author="luke@ljones.dev" date="1569844800">- Update to version 1.38.0
  + Language
  - The `#[global_allocator]` attribute can now be used in submodules.
  - The `#[deprecated]` attribute can now be used on macros.
  + Compiler
  - Added pipelined compilation support to `rustc`. This will
    improve compilation times in some cases.
  + Libraries
  - `ascii::EscapeDefault` now implements `Clone` and `Display`.
  - Derive macros for prelude traits (e.g. `Clone`, `Debug`, `Hash`) are now
    available at the same path as the trait. (e.g. The `Clone` derive macro
    is available at `std::clone::Clone`). This also makes all built-in macros
    available in `std`/`core` root. e.g. `std::include_bytes!`.
  - `str::Chars` now implements `Debug`.
  - `slice::{concat, connect, join}` now accepts `&amp;[T]` in addition to `&amp;T`.
  - `*const T` and `*mut T` now implement `marker::Unpin`.
  - `Arc&lt;[T]&gt;` and `Rc&lt;[T]&gt;` now implement `FromIterator&lt;T&gt;`.
  - Added euclidean remainder and division operations (`div_euclid`,
    `rem_euclid`) to all numeric primitives. Additionally `checked`,
    `overflowing`, and `wrapping` versions are available for all
    integer primitives.
  - `thread::AccessError` now implements `Clone`, `Copy`, `Eq`, `Error`, and
    `PartialEq`.
  - `iter::{StepBy, Peekable, Take}` now implement `DoubleEndedIterator`.
  + Stabilized APIs
  - `&lt;*const T&gt;::cast`
  - `&lt;*mut T&gt;::cast`
  - `Duration::as_secs_f32`
  - `Duration::as_secs_f64`
  - `Duration::div_f32`
  - `Duration::div_f64`
  - `Duration::from_secs_f32`
  - `Duration::from_secs_f64`
  - `Duration::mul_f32`
  - `Duration::mul_f64`
  - `any::type_name`
  + Cargo
  - Added pipelined compilation support to `cargo`.
  - You can now pass the `--features` option multiple times to enable
    multiple features.
  + Misc
  - `rustc` will now warn about some incorrect uses of
    `mem::{uninitialized, zeroed}` that are known to cause undefined behaviour.</changelog>
  <changelog author="luke@ljones.dev" date="1569844801">- Add patch add-option-to-allow-warnings.patch to add a config option
  which allows warnings and so enables v1.38 to bootstrap itself.</changelog>
  <changelog author="rhafer@suse.com" date="1571832000">- Switch to bundled version of libgit2 for now. libgit2-sys seems
  to expect using the bundled variant, which just seems to point
  to a snapshot of the master branch and doesn't match any released
  libgit2 (bsc#1154817).
  See: https://github.com/rust-lang/rust/issues/63476 and
  https://github.com/rust-lang/git2-rs/issues/458 for details.</changelog>
  <changelog author="aplanas@suse.com" date="1573128000">- Update to version 1.39.0
  + Language
  - You can now create async functions and blocks with async fn,
    async move {}, and async {} respectively, and you can now call
    .await on async expressions.
  - You can now use certain attributes on function, closure, and
    function pointer parameters.
  - You can now take shared references to bind-by-move patterns in
    the if guards of match arms.
  + Compiler
  - Added tier 3 support for the i686-unknown-uefi target.
  - Added tier 3 support for the sparc64-unknown-openbsd target.
  - rustc will now trim code snippets in diagnostics to fit in your
    terminal.
  - You can now pass --show-output argument to test binaries to
    print the output of successful tests.
  + For more details:
    https://github.com/rust-lang/rust/blob/stable/RELEASES.md#version-1390-2019-11-07
- Drop patches already merged in upstream:
  + rust-61206-assume-tarball-llvm-is-fresh.patch
  + add-option-to-allow-warnings.patch</changelog>
  <changelog author="aplanas@suse.com" date="1573214400">- Add hopefully-fix-rustdoc-build.patch to fix rustdoc compilation</changelog>
  <changelog author="aplanas@suse.com" date="1574683200">- Re-format the spec file
- Add a README to explain the update process
- Add _service file for download the assets and re-base the patches</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Rename README to README.suse-maint and add it as a source
  to stop factory-auto from declining submissions automatically</changelog>
  <changelog author="opensuse-packaging@opensuse.org" date="1577707200">- Rebased patches:
  + hopefully-fix-rustdoc-build.patch dropped (merged upstream)</changelog>
  <changelog author="luke@ljones.dev" date="1577707201">- Update to version 1.40.0
  + Language
  - You can now use tuple `struct`s and tuple `enum` variant's constructors in
    `const` contexts. e.g.
    pub struct Point(i32, i32);
    const ORIGIN: Point = {
    let constructor = Point;
    constructor(0, 0)
    };
  - You can now mark `struct`s, `enum`s, and `enum` variants with the `#[non_exhaustive]` attribute to
    indicate that there may be variants or fields added in the future.
    For example this requires adding a wild-card branch (`_ =&gt; {}`) to any match
    statements on a non-exhaustive `enum`.
  - You can now use function-like procedural macros in `extern` blocks and in
    type positions. e.g. `type Generated = macro!();`
  - Function-like and attribute procedural macros can now emit
    `macro_rules!` items, so you can now have your macros generate macros.
  - The `meta` pattern matcher in `macro_rules!` now correctly matches the modern
    attribute syntax. For example `(#[$m:meta])` now matches `#[attr]`,
    `#[attr{tokens}]`, `#[attr[tokens]]`, and `#[attr(tokens)]`.
  + Compiler
  - Added tier 3 support\* for the
    `thumbv7neon-unknown-linux-musleabihf` target.
  - Added tier 3 support for the
    `aarch64-unknown-none-softfloat` target.
  - Added tier 3 support for the `mips64-unknown-linux-muslabi64`, and
    `mips64el-unknown-linux-muslabi64` targets.
  + Libraries
  - The `is_power_of_two` method on unsigned numeric types is now a `const` function.
  + Stabilized APIs
  - BTreeMap::get_key_value
  - HashMap::get_key_value
  - Option::as_deref_mut
  - Option::as_deref
  - Option::flatten
  - UdpSocket::peer_addr
  - f32::to_be_bytes
  - f32::to_le_bytes
  - f32::to_ne_bytes
  - f64::to_be_bytes
  - f64::to_le_bytes
  - f64::to_ne_bytes
  - f32::from_be_bytes
  - f32::from_le_bytes
  - f32::from_ne_bytes
  - f64::from_be_bytes
  - f64::from_le_bytes
  - f64::from_ne_bytes
  - mem::take
  - slice::repeat
  - todo!
  + Cargo
  - Cargo will now always display warnings, rather than only on
    fresh builds.
  - Feature flags (except `--all-features`) passed to a virtual workspace will
    now produce an error. Previously these flags were ignored.
  - You can now publish `dev-dependencies` without including
    a `version`.
  + Misc
  - You can now specify the `#[cfg(doctest)]` attribute to include an item only
    when running documentation tests with `rustdoc`.
  + Compatibility Notes
  - As previously announced, any previous NLL warnings in the 2015 edition are
    now hard errors.
  - The `include!` macro will now warn if it failed to include the
    entire file. The `include!` macro unintentionally only includes the
    first _expression_ in a file, and this can be unintuitive. This will become
    either a hard error in a future release, or the behavior may be fixed to include all expressions as expected.
  - Using `#[inline]` on function prototypes and consts now emits a warning under
    `unused_attribute` lint. Using `#[inline]` anywhere else inside traits
    or `extern` blocks now correctly emits a hard error.</changelog>
  <changelog author="federico@suse.com" date="1578484800">- Bump version of libssh2 for SLE15; we now need a version with
  libssh2_userauth_publickey_frommemory(), which appeared in libssh2
  1.6.0.
- Use the bundled libssh2 prior to SLE15.  SLE12 has 1.4.3, which is
  too old for the ssh crate now.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579262400">- Adjust constraints: Request 20GB HDD for all archs. Simplify the
  file by removing the overrides for various disk sizes. All archs
  are curretnly at roughly 17GB storage in use.</changelog>
  <changelog author="federico@suse.com" date="1584964800">- Update to version 1.41.1:
  - Always check types of static items
  - Always check lifetime bounds of `Copy` impls
  - Fix miscompilation in callers of `Layout::repeat`
- Update to version 1.41.0:
  + Language
  - You can now pass type parameters to foreign items when implementing
    traits. E.g. You can now write `impl&lt;T&gt; From&lt;Foo&gt; for Vec&lt;T&gt; {}`.
  - You can now arbitrarily nest receiver types in the `self` position. E.g. you can
    now write `fn foo(self: Box&lt;Box&lt;Self&gt;&gt;) {}`. Previously only `Self`, `&amp;Self`,
    `&amp;mut Self`, `Arc&lt;Self&gt;`, `Rc&lt;Self&gt;`, and `Box&lt;Self&gt;` were allowed.
  - You can now use any valid identifier in a `format_args` macro.
    Previously identifiers starting with an underscore were not allowed.
  - Visibility modifiers (e.g. `pub`) are now syntactically allowed on trait items and
    enum variants. These are still rejected semantically, but
    can be seen and parsed by procedural macros and conditional compilation.
  + Compiler
  - Rustc will now warn if you have unused loop `'label`s.
  - Removed support for the `i686-unknown-dragonfly` target.
  - Added tier 3 support\* for the `riscv64gc-unknown-linux-gnu` target.
  - You can now pass an arguments file passing the `@path` syntax
    to rustc. Note that the format differs somewhat from what is
    found in other tooling; please see the documentation for
    more information.
  - You can now provide `--extern` flag without a path, indicating that it is
    available from the search path or specified with an `-L` flag.
    Refer to Rust's [platform support page][forge-platform-support] for more
    information on Rust's tiered platform support.
  + Libraries
  - The `core::panic` module is now stable. It was already stable
    through `std`.
  - `NonZero*` numerics now implement `From&lt;NonZero*&gt;` if it's a smaller integer
    width. E.g. `NonZeroU16` now implements `From&lt;NonZeroU8&gt;`.
  - `MaybeUninit&lt;T&gt;` now implements `fmt::Debug`.
  + Stabilized APIs
  - `Result::map_or`
  - `Result::map_or_else`
  - `std::rc::Weak::weak_count`
  - `std::rc::Weak::strong_count`
  - `std::sync::Weak::weak_count`
  - `std::sync::Weak::strong_count`
  + Cargo
  - Cargo will now document all the private items for binary crates
    by default.
  - `cargo-install` will now reinstall the package if it detects that it is out
    of date.
  - Cargo.lock now uses a more git friendly format that should help to reduce
    merge conflicts.
  - You can now override specific dependencies's build settings. E.g.
    `[profile.dev.package.image] opt-level = 2` sets the `image` crate's
    optimisation level to `2` for debug builds. You can also use
    `[profile.&lt;profile&gt;.build-override]` to override build scripts and
    their dependencies.
  + Misc
  - You can now specify `edition` in documentation code blocks to compile the block
    for that edition. E.g. `edition2018` tells rustdoc that the code sample
    should be compiled the 2018 edition of Rust.
  - You can now provide custom themes to rustdoc with `--theme`, and check the
    current theme with `--check-theme`.
  - You can use `#[cfg(doc)]` to compile an item when building documentation.
  + Compatibility Notes
  - As previously announced 1.41.0 will be the last tier 1 release for 32-bit
    Apple targets. This means that the source code is still
    available to build, but the targets are no longer being tested and release
    binaries for those platforms will no longer be distributed by the Rust project.
    Please refer to the linked blog post for more information.</changelog>
  <changelog author="alarrosa@suse.com" date="1585656000">- Rebased patches:
  + ignore-Wstring-conversion.patch (offset / fuzz)</changelog>
  <changelog author="alarrosa@suse.com" date="1585656001">- Update to version 1.42.0:
  + Language
  - You can now use the slice pattern syntax with subslices.
  - You can now use #[repr(transparent)] on univariant enums. Meaning
    that you can create an enum that has the exact layout and ABI of
    the type it contains.
  - There are some syntax-only changes:
  * default is syntactically allowed before items in trait
    definitions.
  * Items in impls (i.e. consts, types, and fns) may syntactically
    leave out their bodies in favor of ;.
  * Bounds on associated types in impls are now syntactically
    allowed (e.g. type Foo: Ord;).
  * ... (the C-variadic type) may occur syntactically directly
    as the type of any function parameter.
    These are still rejected semantically, so you will likely receive
    an error but these changes can be seen and parsed by procedural
    macros and conditional compilation.
  + Compiler
  - Added tier 2 support for armv7a-none-eabi.
  - Added tier 2 support for riscv64gc-unknown-linux-gnu.
  - Option::{expect,unwrap} and Result::{expect, expect_err, unwrap,
    unwrap_err} now produce panic messages pointing to the location
    where they were called, rather than core's internals.
    Refer to Rust's platform support page for more information on
    Rust's tiered platform support.
  + Libraries
  - iter::Empty&lt;T&gt; now implements Send and Sync for any T.
  - Pin::{map_unchecked, map_unchecked_mut} no longer require the
    return type to implement Sized.
  - io::Cursor now derives PartialEq and Eq.
  - Layout::new is now const.
  - Added Standard Library support for riscv64gc-unknown-linux-gnu.
  + Stabilized APIs
  - CondVar::wait_while
  - CondVar::wait_timeout_while
  - DebugMap::key
  - DebugMap::value
  - ManuallyDrop::take
  - matches!
  - ptr::slice_from_raw_parts_mut
  - ptr::slice_from_raw_parts
  + Cargo
  - You no longer need to include extern crate proc_macro; to be
    able to use proc_macro; in the 2018 edition.
  + Compatibility Notes
  - Error::description has been deprecated, and its use will now
    produce a warning. It's recommended to use Display/to_string
    instead.</changelog>
  <changelog author="schwab@suse.de" date="1586260800">- Avoid duplication of environment settings</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1588161600">- Update to version 1.43.0
  + Language
  - Fixed using binary operations with `&amp;{number}` (e.g. `&amp;1.0`)
    not having the type inferred correctly.
  - Attributes such as `#[cfg()]` can now be used on `if`
    expressions.
  - Syntax only changes:
  * Allow `type Foo: Ord` syntactically.
  * Fuse associated and extern items up to defaultness.
  * Syntactically allow `self` in all `fn` contexts.
  * Merge `fn` syntax + cleanup item parsing.
  * `item` macro fragments can be interpolated into `trait`s,
    `impl`s, and `extern` blocks.
    For example, you may now write:
    ```rust
    macro_rules! mac_trait {
    ($i:item) =&gt; {
    trait T { $i }
    }
    }
    mac_trait! {
    fn foo() {}
    }
    ```
  * These are still rejected *semantically*, so you will likely
    receive an error but these changes can be seen and parsed by
    macros and conditional compilation.
  + Compiler
  - You can now pass multiple lint flags to rustc to override the
    previous flags.
    For example; `rustc -D unused -A unused-variables` denies
    everything in the `unused` lint group except `unused-variables`
    which is explicitly allowed. However, passing
    `rustc -A unused-variables -D unused` denies everything in
    the `unused` lint group **including** `unused-variables` since
    the allow flag is specified before the deny flag (and therefore
    overridden).
  - rustc will now prefer your system MinGW libraries over its
    bundled libraries if they are available on `windows-gnu`.
  - rustc now buffers errors/warnings printed in JSON.
  + Libraries
  - `Arc&lt;[T; N]&gt;`, `Box&lt;[T; N]&gt;`, and `Rc&lt;[T; N]&gt;`, now implement
    `TryFrom&lt;Arc&lt;[T]&gt;&gt;`,`TryFrom&lt;Box&lt;[T]&gt;&gt;`, and `TryFrom&lt;Rc&lt;[T]&gt;&gt;`
    respectively.
  * *Note** These conversions are only available when `N` is
    `0..=32`.
  - You can now use associated constants on floats and integers
    directly, rather than having to import the module.
    e.g. You can now write `u32::MAX` or `f32::NAN` with no imports.
  - `u8::is_ascii` is now `const`.
  - `String` now implements `AsMut&lt;str&gt;`.
  - Added the `primitive` module to `std` and `core`.
    This module reexports Rust's primitive types. This is mainly
    useful in macros where you want avoid these types being shadowed.
  - Relaxed some of the trait bounds on `HashMap` and `HashSet`.
  - `string::FromUtf8Error` now implements `Clone + Eq`.
  + Stabilized APIs
  - `Once::is_completed`
  - `f32::LOG10_2`
  - `f32::LOG2_10`
  - `f64::LOG10_2`
  - `f64::LOG2_10`
  - `iter::once_with`
  + Cargo
  - You can now set config `[profile]`s in your `.cargo/config`,
    or through your environment.
  - Cargo will now set `CARGO_BIN_EXE_&lt;name&gt;` pointing to a
    binary's executable path when running integration tests or
    benchmarks.
    `&lt;name&gt;` is the name of your binary as-is e.g. If you wanted
    the executable path for a binary named `my-program`you would
    use `env!("CARGO_BIN_EXE_my-program")`.
  + Misc
  - Certain checks in the `const_err` lint were deemed unrelated
    to const evaluation, and have been moved to the
    `unconditional_panic` and `arithmetic_overflow` lints.
  + Compatibility Notes
  - Having trailing syntax in the `assert!` macro is now a hard
    error. This has been a warning since 1.36.0.
  - Fixed `Self` not having the correctly inferred type. This
    incorrectly led to some instances being accepted, and now
    correctly emits a hard error.</changelog>
  <changelog author="schwab@suse.de" date="1588593600">- Update rustfmt_version</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1589457600">- Update to version 1.43.1
  - Updated openssl-src to 1.1.1g for CVE-2020-1967.
  - Fixed the stabilization of AVX-512 features.
  - Fixed `cargo package --list` not working with unpublished
    dependencies.</changelog>
  <changelog author="martin.sirringhaus@suse.com" date="1592827200">- Add patch Fix-big-endian-miscompile-of-bitcast-zex.patch
  to fix miscompilations with rustc 1.43 that lead to LTO failures
  (bsc#1173202)</changelog>
  <changelog author="dmueller@suse.com" date="1612440000">- build 32bit arches llvm without debuginfo to avoid oom during build (bsc#1181571)</changelog>
</package>
<package pkgid="af356a08b3a7764d53dca89d0edf79c5d27cd3cdc58bdb285382aff5a25e9744" name="cloud-regionsrv" arch="noarch">
  <version epoch="0" ver="8.1.2" rel="11.6.1"/>
  <changelog author="rjschwei@suse.com" date="1422619200">- Update to version 6.0.2
  + modified config to accomodate changes in mod_wsgi
  + generalized script to generate the cert</changelog>
  <changelog author="rjschwei@suse.com" date="1462276800">- Update to version 7.0.0 - Include in SLE 12 FATE#320818
  + Increase key length to 2048
  + Code clean up, pep8 compliance
  + Upstream source location change to GitHub repo
  + Licensed GPLv3+</changelog>
  <changelog author="rjschwei@suse.com" date="1463572800">- Update to version 7.0.1
  + Fix argument parsing initialization in cert generator</changelog>
  <changelog author="rjschwei@suse.com" date="1479384000">- Include in SLE 12 (FATE#320818, bsc#979331)</changelog>
  <changelog author="rjschwei@suse.com" date="1517918400">- Update to version 8.0.0 (bsc#1079233)
  + Port to Python 3
  + Set subjevtAltName when generating a cert</changelog>
  <changelog author="rjschwei@suse.com" date="1518091200">- Update to version 8.0.1
  + Reduce memory footprint of running application</changelog>
  <changelog author="rjschwei@suse.com" date="1588680000">- Add find_all_matching_cidr.patch (bsc#1171232, bsc#1171233)
  + The prefix length matcher returned only the first cidr that was a
    possible match. In the final check that verifies that the requesters
    IP is in the range this might lead to a mismatch and thus a 404.</changelog>
  <changelog author="rjschwei@suse.com" date="1614513600">- Update to version 8.0.5 (bsc#1029162)
  + Improve region hint matching by forcing config settings and
    received regionHint to lower case
  + IPv6 support
  + Remove find_all_matching_cidr.patch home grown matcher removed</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 8.1.0 (bsc#1029162)
  + Enable multiple IP assignments (IPv4+IPv6) on TLS Certificate</changelog>
  <changelog author="jmason@suse.com" date="1631620800">- Update to version 8.1.1 (bsc#1190250)
  + Use a cross-filesystem compatible method to move certificates</changelog>
  <changelog author="jmason@suse.com" date="1633089600">- Update to version 8.1.2 (bsc#1190250)
  + Place certificate key in proper destination</changelog>
</package>
<package pkgid="4eefb501c5220d4d6c117b8440a4bfb452be365531f0b4aa3fdba1795e3a9fda" name="cloud-regionsrv" arch="src">
  <version epoch="0" ver="8.1.2" rel="11.6.1"/>
  <changelog author="rschweikert@suse.com" date="1390392000">- update to version 3.0.0
  - switch the service to be https
    + the previous implementation via http was vulnerable to the traffic
    being intercepted and then having the client register against a
    "fake" SMT server for potential malicious package distribution
  - add a script to create a self signed certificate
  - move the configuration files to regionService directory in etc
  - name consistency updates</changelog>
  <changelog author="rschweikert@suse.com" date="1392897600">- add dependency to pyOpenSSL</changelog>
  <changelog author="rschweikert@suse.com" date="1393588800">- fix inconsistency between package and default configuration
  + package created /var/log/regionsrv and configuration expected
    /var/log/regionService. Fxed package to match configureation</changelog>
  <changelog author="rschweikert@suse.com" date="1395230400">- bump to version 3.0.3
  + fixed Makefile to address naming inconsistency of log directory</changelog>
  <changelog author="rschweikert@suse.com" date="1397476800">- update to version 4.0.0
  + removed automatic update feature, this is now handled by
    cspApacheAccessConfig
  &gt;&gt;&gt;&gt;&gt;&gt;&gt; ./cloud-regionsrv.changes.r12</changelog>
  <changelog author="rschweikert@suse.com" date="1398168000">- update to version 4.1.1
  + create a separate package for the configuration
  - this allows us to create packages for each cloud that just
    carry the configuration
  - provides a single point of update for the configuration for each cloud
  + let the cert generation code also update the ApacheAccessConfig
    service configuration file if it exists</changelog>
  <changelog author="rschweikert@suse.com" date="1400328000">- Update to version 4.1.2
  + create the regionsrv user, this was previously deleted accidentally
  + handle exception if the IP range is not properly formed for some
    reason</changelog>
  <changelog author="rschweikert@suse.com" date="1409659200">- Update to version 5.0.0
  + support multiple SMT servers per region
  + this is an incompatible change and breaks existing clients</changelog>
  <changelog author="rschweikert@suse.com" date="1412856000">- Update to version 6.0.0
  + accept a region hint from the client
    ~ the client can now provide a location hint by adding ?regionHint=
    to the URL. The server will first try to find a match using the IP
    address of the client and then fall back to the regionHint if it was
    provided. The caveat is that the client has to know the region names
    as they are configured in the regionData.cfg file. However, the region
    names are always well known for each cloud provider.
  + randomize the provided SMT information
    ~ to avoid always handing out the first listed SMT server in the
    configfile and thus loading this server with all requests, the order is
    now randomized.</changelog>
  <changelog author="rjschwei@suse.com" date="1422619200">- Update to version 6.0.2
  + modified config to accomodate changes in mod_wsgi
  + generalized script to generate the cert</changelog>
  <changelog author="rjschwei@suse.com" date="1462276800">- Update to version 7.0.0 - Include in SLE 12 FATE#320818
  + Increase key length to 2048
  + Code clean up, pep8 compliance
  + Upstream source location change to GitHub repo
  + Licensed GPLv3+</changelog>
  <changelog author="rjschwei@suse.com" date="1463572800">- Update to version 7.0.1
  + Fix argument parsing initialization in cert generator</changelog>
  <changelog author="rjschwei@suse.com" date="1479384000">- Include in SLE 12 (FATE#320818, bsc#979331)</changelog>
  <changelog author="rjschwei@suse.com" date="1517918400">- Update to version 8.0.0 (bsc#1079233)
  + Port to Python 3
  + Set subjevtAltName when generating a cert</changelog>
  <changelog author="rjschwei@suse.com" date="1518091200">- Update to version 8.0.1
  + Reduce memory footprint of running application</changelog>
  <changelog author="rjschwei@suse.com" date="1588680000">- Add find_all_matching_cidr.patch (bsc#1171232, bsc#1171233)
  + The prefix length matcher returned only the first cidr that was a
    possible match. In the final check that verifies that the requesters
    IP is in the range this might lead to a mismatch and thus a 404.</changelog>
  <changelog author="rjschwei@suse.com" date="1614513600">- Update to version 8.0.5 (bsc#1029162)
  + Improve region hint matching by forcing config settings and
    received regionHint to lower case
  + IPv6 support
  + Remove find_all_matching_cidr.patch home grown matcher removed</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 8.1.0 (bsc#1029162)
  + Enable multiple IP assignments (IPv4+IPv6) on TLS Certificate</changelog>
  <changelog author="jmason@suse.com" date="1631620800">- Update to version 8.1.1 (bsc#1190250)
  + Use a cross-filesystem compatible method to move certificates</changelog>
  <changelog author="jmason@suse.com" date="1633089600">- Update to version 8.1.2 (bsc#1190250)
  + Place certificate key in proper destination</changelog>
</package>
<package pkgid="1559720676d254af1574b836f0e69d6134a0291568752b7c7e3f2d5ab348a6c0" name="cloud-regionsrv-client" arch="noarch">
  <version epoch="0" ver="9.2.0" rel="6.46.1"/>
  <changelog author="rjschwei@suse.com" date="1559822400">- Update to version 8.2.0 (bsc#1137384, bsc#1137385)
  + Upstream version jump from 8.1.4 to 8.2.0 due to compatible
    behavior change of get_instance_data() implementation
  + Always return the marker that triggers the server to return
    URL resolver URIs for get_instance_data()
  + Handle exception when metadata retrieval fails.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.0
  + Fix logging issues. During registration against RMT
    "inconsistent system state" messages were printed to the log, while
    the system was not in an inconsistent state.
  + The public has_repos() method was removed from the registerutil
    implementtaion making this an incompatible change and therefore
    the major version changed.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908801">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
</package>
<package pkgid="4eb0c75b0738e63c53f19595e1b5fa3e6077f2bea69f9fa541dadfcbdbbf0681" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="9.2.0" rel="6.46.1"/>
  <changelog author="rjschwei@suse.com" date="1559822400">- Update to version 8.2.0 (bsc#1137384, bsc#1137385)
  + Upstream version jump from 8.1.4 to 8.2.0 due to compatible
    behavior change of get_instance_data() implementation
  + Always return the marker that triggers the server to return
    URL resolver URIs for get_instance_data()
  + Handle exception when metadata retrieval fails.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.0
  + Fix logging issues. During registration against RMT
    "inconsistent system state" messages were printed to the log, while
    the system was not in an inconsistent state.
  + The public has_repos() method was removed from the registerutil
    implementtaion making this an incompatible change and therefore
    the major version changed.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908801">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
</package>
<package pkgid="974d676d66d74796dd26bfb6265504cb3e973fcd5905e9f6cd5382c516bcb1d5" name="cloud-regionsrv-client" arch="noarch">
  <version epoch="0" ver="9.2.1" rel="6.51.1"/>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
</package>
<package pkgid="244cb3cf6bcfa5c4c7adffc3e0ea34e0ad71cb330f4f6535b5015162b28d5d10" name="cloud-regionsrv-client" arch="src">
  <version epoch="0" ver="9.2.1" rel="6.51.1"/>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
</package>
<package pkgid="240325a0777b61d0a5d6dcf6f5be1667b099f7b339a7443a1b6124d102654259" name="cloud-regionsrv-client-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="6.46.1"/>
  <changelog author="rjschwei@suse.com" date="1559822400">- Update to version 8.2.0 (bsc#1137384, bsc#1137385)
  + Upstream version jump from 8.1.4 to 8.2.0 due to compatible
    behavior change of get_instance_data() implementation
  + Always return the marker that triggers the server to return
    URL resolver URIs for get_instance_data()
  + Handle exception when metadata retrieval fails.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.0
  + Fix logging issues. During registration against RMT
    "inconsistent system state" messages were printed to the log, while
    the system was not in an inconsistent state.
  + The public has_repos() method was removed from the registerutil
    implementtaion making this an incompatible change and therefore
    the major version changed.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908801">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
</package>
<package pkgid="c8dd068d738ee0ee284d122091420904b10c5cf5b5a170ce2c37a6c6a5f79bc1" name="cloud-regionsrv-client-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="6.51.1"/>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
</package>
<package pkgid="9508169e32884eb369e03ec04005c2a95890f8409237f2c9cccd0d8353571ee1" name="cloud-regionsrv-client-plugin-azure" arch="noarch">
  <version epoch="0" ver="1.0.1" rel="6.46.1"/>
  <changelog author="rjschwei@suse.com" date="1559822400">- Update to version 8.2.0 (bsc#1137384, bsc#1137385)
  + Upstream version jump from 8.1.4 to 8.2.0 due to compatible
    behavior change of get_instance_data() implementation
  + Always return the marker that triggers the server to return
    URL resolver URIs for get_instance_data()
  + Handle exception when metadata retrieval fails.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.0
  + Fix logging issues. During registration against RMT
    "inconsistent system state" messages were printed to the log, while
    the system was not in an inconsistent state.
  + The public has_repos() method was removed from the registerutil
    implementtaion making this an incompatible change and therefore
    the major version changed.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908801">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
</package>
<package pkgid="5de32dac4352928a6494c21ca2806bb30dc5ea2ff0284278d3221f214cc16eaf" name="cloud-regionsrv-client-plugin-azure" arch="noarch">
  <version epoch="0" ver="1.0.1" rel="6.51.1"/>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
</package>
<package pkgid="ff1233c71398ea96d2950a0770e59692c595eedf2e0c800a75ec1f98244657c1" name="cloud-regionsrv-client-plugin-ec2" arch="noarch">
  <version epoch="0" ver="1.0.1" rel="6.46.1"/>
  <changelog author="rjschwei@suse.com" date="1559822400">- Update to version 8.2.0 (bsc#1137384, bsc#1137385)
  + Upstream version jump from 8.1.4 to 8.2.0 due to compatible
    behavior change of get_instance_data() implementation
  + Always return the marker that triggers the server to return
    URL resolver URIs for get_instance_data()
  + Handle exception when metadata retrieval fails.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.0
  + Fix logging issues. During registration against RMT
    "inconsistent system state" messages were printed to the log, while
    the system was not in an inconsistent state.
  + The public has_repos() method was removed from the registerutil
    implementtaion making this an incompatible change and therefore
    the major version changed.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908801">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
</package>
<package pkgid="366e8cbef17e347cc8c4a5aa8a7a257be6fa5de8a787d6638d7de63dfb2b286b" name="cloud-regionsrv-client-plugin-ec2" arch="noarch">
  <version epoch="0" ver="1.0.1" rel="6.51.1"/>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
</package>
<package pkgid="8868fb73bb7ae29e1d35d0b87183548df56d88cd796689b6ecf4cff814d56a60" name="cloud-regionsrv-client-plugin-gce" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="6.46.1"/>
  <changelog author="rjschwei@suse.com" date="1559822400">- Update to version 8.2.0 (bsc#1137384, bsc#1137385)
  + Upstream version jump from 8.1.4 to 8.2.0 due to compatible
    behavior change of get_instance_data() implementation
  + Always return the marker that triggers the server to return
    URL resolver URIs for get_instance_data()
  + Handle exception when metadata retrieval fails.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.0
  + Fix logging issues. During registration against RMT
    "inconsistent system state" messages were printed to the log, while
    the system was not in an inconsistent state.
  + The public has_repos() method was removed from the registerutil
    implementtaion making this an incompatible change and therefore
    the major version changed.</changelog>
  <changelog author="rjschwei@suse.com" date="1559908801">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
</package>
<package pkgid="d971c868079c0c9f2fc9f3fc59f911050f67dc253d6da1fe6bb66b57edab92b2" name="cloud-regionsrv-client-plugin-gce" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="6.51.1"/>
  <changelog author="rjschwei@suse.com" date="1559908800">- Update to version 9.0.1 (bsc#1136113, bsc#1136112)
  + Refresh the server cache if non of the currently cached update servers
    can be reached. The condition may arise in a general outage or when
    systems have been decomissioned. In the later case the refresh will
    re-eastablish update capabilities</changelog>
  <changelog author="rjschwei@suse.com" date="1565006400">- Update to version 9.0.2
  + If the credentials are not valid an error is issued and the user is
    instructed to re-register the system</changelog>
  <changelog author="rjschwei@suse.com" date="1566388800">- Update to version 9.0.3
  + Fix missing dependency for python3-urllib3 (bsc#1146610, bsc#1146321i,
    bsc#1144754)
  + Cast the the resolved link of the serice plugin to a string to
    allow proper use of basename() and comparison (bsc#1146462, bsc#1146463)
  + Clear the new-registration marker if the instance has a cache of
    update servers (bsc#1146467, bsc#1146468)</changelog>
  <changelog author="rjschwei@suse.com" date="1567771200">- Update to version 9.0.4 (bsc#1148644, bsc#1149840)
  + The logic in the URLresolver my result in "None" being returned during
    initial registration when zypper tries to refresh the repos. This
    triggers a condition where repos are missing from the system. This
    version changes the logic in the URL resolver to address this condition.</changelog>
  <changelog author="jmason@suse.com" date="1569931200">- Update to version 9.0.5 (bsc#1152567, bsc#1149528)
  + Ignore exception if the new registration flag file does not
    exist but there is an attempt to remove it.
  + Properly include the IP addresses of the update server if we
    were unable to get the product information
  + Include requirement for python3-six in specfile</changelog>
  <changelog author="rjschwei@suse.com" date="1572004800">- Update to version 9.0.6 (bsc#1154533)
  + Support repositories with different credentials files
  + Add --clean option and --help
  + Add man page</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238400">- Update to version 9.0.7
  + Fix crash with a stack trace if no current_smt is
    present (bsc#1158664)</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1576238401">- Update to version 9.0.8
  + Properly handle IPv6 addresses in URLs</changelog>
  <changelog author="rjschwei@suse.com" date="1587384000">- Update to version 9.0.9 (bsc#1169599)
  + Handle the /etc/hosts file with Python 3.4 if there are non ascii
    characters in the file.</changelog>
  <changelog author="rjschwei@suse.com" date="1589803200">- Update to version 9.0.10 (bsc#1171704, bsc#1171705)
  + While the service starts After=network-online.target this is no
    guarantee that the cloud framework has configured the outgoing routing
    for the instance. This configuration on the framework side may take
    longer. Introduce a wait look that retries connections to the
    update infrastructure 3 times before giving up.</changelog>
  <changelog author="rjschwei@suse.com" date="1589889600">- Improve error message for failed update server access to determine
  product status</changelog>
  <changelog author="ikapelyukhin@suse.com" date="1593432000">- Update to version 9.1.0 (bsc#1173474, bsc#1173475)
  + Introduce containerbuild-regionsrv service to allow container
    building tools to access required data for accessing Public Cloud RMTs</changelog>
  <changelog author="rjschwei@suse.com" date="1596196800">- Update to version 9.1.1 (bsc#1174731, bsc#1174732)
  + Do not immediately failover to a sibling system. Upon contact failure
    to the target system give the server/route time to recover. We have
    seen network instability trigger a pre-mature failover during initial
    registration causing problems later during updates.
  + When we do failover make sure the access credentials are known to the
    new target</changelog>
  <changelog author="rjschwei@suse.com" date="1596628800">- Update to version 9.1.2 (bsc#1174791, bsc#1174937)
  + Implement changes to configure the client to use https only for
    outbound traffic
- plugin-ec2 to version 1.0.1 (bsc#1174743, bsc#1174837)
  + Prefer IMDSv2 and switch all IMDS access requests to support v2 token
    based access method.</changelog>
  <changelog author="rjschwei@suse.com" date="1598356800">- Update to version 9.1.3 (bsc#1175752, bsc#1175753)
  + Re-write the cache for the update server objects to avoid an
    attribute error that is triggered if the config is not set to
    https_only.</changelog>
  <changelog author="rjschwei@suse.com" date="1600862400">- Update to version 9.1.4 (bsc#1176858, bsc#1176859)
  + Properly handle the exit code for SUSEConnect and provide log
    message with failure details for registration failure</changelog>
  <changelog author="rjschwei@suse.com" date="1619438400">- Update to version 9.1.5 (bsc#1182779, bsc#1185234, bsc#1185198)
  + Another startup process may run zypper before the registration process
    if zypper is still running we cannot get the lock and as such
    the installed products cannot be determined. Wait for the lock to be
    released for up to 30 seconds.
  + On any error durring product list generation return a list to avoid
    a traceback by trying to iterate over None</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 9.2.0 (bsc#1029162)
  + Support IPv6 as best-effort, with fallback to IPv4</changelog>
  <changelog author="jesusbv@suse.com" date="1627560000">- New package to enable/disable access due to AHB
  This references bsc#1182026, (jsc#SLE-21246, jsc#SLE-21247, jsc#SLE-21248, jsc#SLE-21249, jsc#SLE-21250)</changelog>
  <changelog author="rjschwei@suse.com" date="1632830400">- Avoid race confition with ca-certificates (bsc#1189362)
  + Make the service run after ca-sertificates is done
  + Attempt multiple times to update the trust chain</changelog>
</package>
<package pkgid="c1d58635b4adae65fb7f36d710a493f248dbf5ff818bde8550b59e1edf9e7a88" name="cloud-regionsrv-generic-config" arch="noarch">
  <version epoch="0" ver="1.0.0" rel="11.6.1"/>
  <changelog author="rjschwei@suse.com" date="1422619200">- Update to version 6.0.2
  + modified config to accomodate changes in mod_wsgi
  + generalized script to generate the cert</changelog>
  <changelog author="rjschwei@suse.com" date="1462276800">- Update to version 7.0.0 - Include in SLE 12 FATE#320818
  + Increase key length to 2048
  + Code clean up, pep8 compliance
  + Upstream source location change to GitHub repo
  + Licensed GPLv3+</changelog>
  <changelog author="rjschwei@suse.com" date="1463572800">- Update to version 7.0.1
  + Fix argument parsing initialization in cert generator</changelog>
  <changelog author="rjschwei@suse.com" date="1479384000">- Include in SLE 12 (FATE#320818, bsc#979331)</changelog>
  <changelog author="rjschwei@suse.com" date="1517918400">- Update to version 8.0.0 (bsc#1079233)
  + Port to Python 3
  + Set subjevtAltName when generating a cert</changelog>
  <changelog author="rjschwei@suse.com" date="1518091200">- Update to version 8.0.1
  + Reduce memory footprint of running application</changelog>
  <changelog author="rjschwei@suse.com" date="1588680000">- Add find_all_matching_cidr.patch (bsc#1171232, bsc#1171233)
  + The prefix length matcher returned only the first cidr that was a
    possible match. In the final check that verifies that the requesters
    IP is in the range this might lead to a mismatch and thus a 404.</changelog>
  <changelog author="rjschwei@suse.com" date="1614513600">- Update to version 8.0.5 (bsc#1029162)
  + Improve region hint matching by forcing config settings and
    received regionHint to lower case
  + IPv6 support
  + Remove find_all_matching_cidr.patch home grown matcher removed</changelog>
  <changelog author="jmason@suse.com" date="1623758400">- Update to version 8.1.0 (bsc#1029162)
  + Enable multiple IP assignments (IPv4+IPv6) on TLS Certificate</changelog>
  <changelog author="jmason@suse.com" date="1631620800">- Update to version 8.1.1 (bsc#1190250)
  + Use a cross-filesystem compatible method to move certificates</changelog>
  <changelog author="jmason@suse.com" date="1633089600">- Update to version 8.1.2 (bsc#1190250)
  + Place certificate key in proper destination</changelog>
</package>
<package pkgid="fa24500ef0c43601b25ee490497264eee9a2d328b54b9ccaa0be8f7fe1640251" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="6b4bad1c398297c331c42609f3a995a8ee5f773d8a843811e2f52a0294d41831" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="d59d22c45fb26e45b9dc81d5d885eb4e60ceb7bbd13fad7fcd136434cc253f16" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="2e863d09b393ede7ed4580a1403021c768f8bd25fe129b14bb6729370406f707" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="a6afe1e20c7f4e70bdf84e149f96f9b7175ba8c511e0939c62c9f86e374f5cb6" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="85b965487a58c0695e9a2af5c31b8030326590626b4db38b75dc578972908853" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="4dee03f152e62c9d5f5ed4e83195ea89ca9d9c4e94086727bbd800ef79282139" name="cluster-md-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="adbf66f38279ac3e5151faad84f02d88770e58fe1ac3e4f6d66c5a25f71d5562" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.11.1"/>
  <changelog author="lduncan@suse.com" date="1625140800">- Blacklisted SCSI ufs core patch: way out of context.
- commit 33b89f4</changelog>
  <changelog author="glin@suse.com" date="1625140801">- bpfilter: Specify the log level for the kmsg message
  (bsc#1155518).
- commit a6b5aff</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140802">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch
  patches.suse/xfrm-policy-Read-seqcount-outside-of-rcu-read-side-i.patch
- commit fc2830a</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140803">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140804">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140805">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140806">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140807">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140808">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="bp@suse.de" date="1625140809">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="ohering@suse.de" date="1625227201">- x86/vdso: Mark the TSC clocksource path likely (bsc#1186071).
- hv_sock: Add the support of hibernation (bsc#1186071).
- hv_sock: set VMADDR_CID_HOST in the hvs_remote_addr_init()
  (bsc#1186071).
- hv_sock: use HV_HYP_PAGE_SIZE for Hyper-V communication
  (bsc#1186071).
- hv_sock: Use consistent types for UUIDs (bsc#1186071).
- commit e34e685</changelog>
  <changelog author="ohering@suse.de" date="1625227202">- x86/vdso: Move VDSO clocksource state tracking to callback (bsc#1186071).
- commit fc5b544</changelog>
  <changelog author="ohering@suse.de" date="1625227203">- hv_netvsc: Validate number of allocated sub-channels
  (bsc#1183682).
- drivers: hv: vmbus: Fix call msleep using &lt; 20ms (bsc#1186071).
- drivers: hv: vmbus: Fix checkpatch LINE_SPACING (bsc#1186071).
- drivers: hv: vmbus: Replace symbolic permissions by octal
  permissions (bsc#1186071).
- drivers: hv: Fix hyperv_record_panic_msg path on comment
  (bsc#1183682).
- hv_netvsc: Use vmbus_requestor to generate transaction IDs
  for VMBus hardening (bsc#1183682).
- scsi: storvsc: Use vmbus_requestor to generate transaction
  IDs for VMBus hardening (bsc#1183682).
- Drivers: hv: vmbus: Add vmbus_requestor data structure for
  VMBus hardening (bsc#1183682).
- x86/hyper-v: Add synthetic debugger definitions (bsc#1186071).
- asm-generic/hyperv: Add definitions for Get/SetVpRegister
  hypercalls (bsc#1186071).
- commit f79519d</changelog>
  <changelog author="ohering@suse.de" date="1625227204">- scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback() (bsc#1183682).
- commit e599609</changelog>
  <changelog author="ohering@suse.de" date="1625227205">- drivers/hv: remove obsolete TODO and fix misleading typo in
  comment (bsc#1186071).
- drivers: hv: vmbus: Fix checkpatch SPLIT_STRING (bsc#1186071).
- commit 9cc5e50</changelog>
  <changelog author="ohering@suse.de" date="1625227206">- Revert "scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback()" (bsc#1183682).
- commit fa61bc6</changelog>
  <changelog author="ohering@suse.de" date="1625227207">- PCI: hv: Drop msi_controller structure (bsc#1186071).
- hv_netvsc: Make netvsc/VF binding check both MAC and serial
  number (bsc#1186071).
- hv_netvsc: Add error handling while switching data path
  (bsc#1186071).
- hv_netvsc: Add a comment clarifying batching logic
  (bsc#1186071).
- scsi: storvsc: Enable scatterlist entry lengths &gt; 4Kbytes
  (bsc#1186071).
- scsi: storvsc: Parameterize number hardware queues
  (bsc#1186071).
- drivers: hv: Create a consistent pattern for checking Hyper-V
  hypercall status (bsc#1186071).
- x86/hyperv: Move hv_do_rep_hypercall to asm-generic
  (bsc#1186071).
- Drivers: hv: vmbus: Check for pending channel interrupts before
  taking a CPU offline (bsc#1186071).
- Drivers: hv: vmbus: Drivers: hv: vmbus: Introduce
  CHANNELMSG_MODIFYCHANNEL_RESPONSE (bsc#1186071).
- Drivers: hv: vmbus: Introduce and negotiate VMBus protocol
  version 5.3 (bsc#1186071).
- Drivers: hv: vmbus: remove unused function (bsc#1186071).
- Drivers: hv: vmbus: Remove unused linux/version.h header
  (bsc#1186071).
- x86/hyperv: remove unused linux/version.h header (bsc#1186071).
- x86/hyperv: Fix unused variable 'hi' warning in hv_apic_read
  (bsc#1186071).
- x86/hyperv: Fix unused variable 'msr_val' warning in
  hv_qlock_wait (bsc#1186071).
- hv: hyperv.h: a few mundane typo fixes (bsc#1186071).
- drivers: hv: Fix EXPORT_SYMBOL and tab spaces issue
  (bsc#1186071).
- Drivers: hv: vmbus: Drop error message when 'No request id
  available' (bsc#1183682).
- asm-generic/hyperv: Add missing function prototypes per -W1
  warnings (bsc#1186071).
- clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts
  (bsc#1186071).
- clocksource/drivers/hyper-v: Set clocksource rating based on
  Hyper-V feature (bsc#1186071).
- clocksource/drivers/hyper-v: Handle sched_clock differences
  inline (bsc#1186071).
- Drivers: hv: vmbus: Move handling of VMbus interrupts
  (bsc#1186071).
- Drivers: hv: vmbus: Handle auto EOI quirk inline (bsc#1186071).
- Drivers: hv: vmbus: Move hyperv_report_panic_msg to arch
  neutral code (bsc#1186071).
- Drivers: hv: Redo Hyper-V synthetic MSR get/set functions
  (bsc#1186071).
- x86/hyper-v: Move hv_message_type to architecture neutral module
  (bsc#1186071).
- Drivers: hv: vmbus: Move Hyper-V page allocator to arch neutral
  code (bsc#1186071).
- hv_netvsc: Fix validation in netvsc_linkstatus_callback()
  (bsc#1183682).
- PCI: hv: Fix typo (bsc#1186071).
- scsi: storvsc: Return DID_ERROR for invalid commands
  (bsc#1186071).
- scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback() (bsc#1183682).
- scsi: storvsc: Resolve data race in storvsc_probe()
  (bsc#1183682).
- scsi: storvsc: Fix max_outstanding_req_per_channel for Win8
  and newer (bsc#1186071).
- Revert "Drivers: hv: vmbus: Copy packets sent by Hyper-V out
  of the ring buffer" (bsc#1186071).
- iommu/hyperv: setup an IO-APIC IRQ remapping domain for root
  partition (bsc#1186071).
- x86/hyperv: implement an MSI domain for root partition
  (bsc#1186071).
- asm-generic/hyperv: import data structures for mapping device
  interrupts (bsc#1186071).
- asm-generic/hyperv: introduce hv_device_id and auxiliary
  structures (bsc#1186071).
- asm-generic/hyperv: update hv_interrupt_entry (bsc#1186071).
- asm-generic/hyperv: update hv_msi_entry (bsc#1186071).
- x86/hyperv: implement and use hv_smp_prepare_cpus (bsc#1186071).
- x86/hyperv: provide a bunch of helper functions (bsc#1186071).
- x86/hyperv: handling hypercall page setup for root
  (bsc#1186071).
- x86/hyperv: extract partition ID from Microsoft Hypervisor if
  necessary (bsc#1186071).
- x86/hyperv: allocate output arg pages if required (bsc#1186071).
- clocksource/hyperv: use MSR-based access if running as root
  (bsc#1186071).
- Drivers: hv: vmbus: skip VMBus initialization if Linux is root
  (bsc#1186071).
- x86/hyperv: detect if Linux is the root partition (bsc#1186071).
- asm-generic/hyperv: change HV_CPU_POWER_MANAGEMENT to
  HV_CPU_MANAGEMENT (bsc#1186071).
- hv: hyperv.h: Replace one-element array with flexible-array
  in struct icmsg_negotiate (bsc#1186071).
- hv_netvsc: Restrict configurations on isolated guests
  (bsc#1183682).
- Drivers: hv: vmbus: Enforce 'VMBus version &gt;= 5.2' on isolated
  guests (bsc#1183682).
- Drivers: hv: vmbus: Restrict vmbus_devices on isolated guests
  (bsc#1183682).
- x86/hyperv: Load/save the Isolation Configuration leaf
  (bsc#1183682).
- hv_utils: Fix spelling mistake "Hearbeat" -&gt; "Heartbeat"
  (bsc#1186071).
- Drivers: hv: vmbus: Add /sys/bus/vmbus/hibernation
  (bsc#1186071).
- Drivers: hv: vmbus: Resolve race condition in
  vmbus_onoffer_rescind() (bsc#1183682).
- Drivers: hv: vmbus: Copy the hv_message in vmbus_on_msg_dpc()
  (bsc#1183682).
- Drivers: hv: vmbus: Reduce number of references to message in
  vmbus_on_msg_dpc() (bsc#1183682).
- Drivers: hv: vmbus: Initialize memory to be sent to the host
  (bsc#1183682).
- hv_utils: Add validation for untrusted Hyper-V values
  (bsc#1183682).
- Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the
  ring buffer (bsc#1183682).
- hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet
  info (bsc#1183682).
- hv_netvsc: Allocate the recv_buf buffers after
  NVSP_MSG1_TYPE_SEND_RECV_BUF (bsc#1183682).
- hv_netvsc: Copy packets sent by Hyper-V out of the receive
  buffer (bsc#1183682).
- hv_netvsc: Add (more) validation for untrusted Hyper-V values
  (bsc#1183682).
- hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
  (bsc#1186071).
- hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
  (bsc#1186071).
- hv_netvsc: Check VF datapath when sending traffic to VF
  (bsc#1183682).
- vsock: fix locking in vsock_shutdown() (bsc#1186071).
- x86/hyperv: check cpu mask after interrupt has been disabled
  (bsc#1186071).
- use __netdev_notify_peers in hyperv (bsc#1186071).
- hv_balloon: do adjust_managed_page_count() when
  ballooning/un-ballooning (bsc#1186071).
- hv_balloon: simplify math in alloc_balloon_pages()
  (bsc#1186071).
- commit 8aa7b0a</changelog>
  <changelog author="ohering@suse.de" date="1625227208">- x86/hyperv: fix logical processor creation (bsc#1186071).
- commit 3182d1d</changelog>
  <changelog author="bp@suse.de" date="1625486400">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
</package>
<package pkgid="a2fb26a097d467b537901740162ecf81178a14f92424d76c13fe27da644cb495" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.14.1"/>
  <changelog author="ohering@suse.de" date="1625227200">- scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback() (bsc#1183682).
- commit e599609</changelog>
  <changelog author="ohering@suse.de" date="1625227201">- drivers/hv: remove obsolete TODO and fix misleading typo in
  comment (bsc#1186071).
- drivers: hv: vmbus: Fix checkpatch SPLIT_STRING (bsc#1186071).
- commit 9cc5e50</changelog>
  <changelog author="ohering@suse.de" date="1625227202">- Revert "scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback()" (bsc#1183682).
- commit fa61bc6</changelog>
  <changelog author="ohering@suse.de" date="1625227203">- PCI: hv: Drop msi_controller structure (bsc#1186071).
- hv_netvsc: Make netvsc/VF binding check both MAC and serial
  number (bsc#1186071).
- hv_netvsc: Add error handling while switching data path
  (bsc#1186071).
- hv_netvsc: Add a comment clarifying batching logic
  (bsc#1186071).
- scsi: storvsc: Enable scatterlist entry lengths &gt; 4Kbytes
  (bsc#1186071).
- scsi: storvsc: Parameterize number hardware queues
  (bsc#1186071).
- drivers: hv: Create a consistent pattern for checking Hyper-V
  hypercall status (bsc#1186071).
- x86/hyperv: Move hv_do_rep_hypercall to asm-generic
  (bsc#1186071).
- Drivers: hv: vmbus: Check for pending channel interrupts before
  taking a CPU offline (bsc#1186071).
- Drivers: hv: vmbus: Drivers: hv: vmbus: Introduce
  CHANNELMSG_MODIFYCHANNEL_RESPONSE (bsc#1186071).
- Drivers: hv: vmbus: Introduce and negotiate VMBus protocol
  version 5.3 (bsc#1186071).
- Drivers: hv: vmbus: remove unused function (bsc#1186071).
- Drivers: hv: vmbus: Remove unused linux/version.h header
  (bsc#1186071).
- x86/hyperv: remove unused linux/version.h header (bsc#1186071).
- x86/hyperv: Fix unused variable 'hi' warning in hv_apic_read
  (bsc#1186071).
- x86/hyperv: Fix unused variable 'msr_val' warning in
  hv_qlock_wait (bsc#1186071).
- hv: hyperv.h: a few mundane typo fixes (bsc#1186071).
- drivers: hv: Fix EXPORT_SYMBOL and tab spaces issue
  (bsc#1186071).
- Drivers: hv: vmbus: Drop error message when 'No request id
  available' (bsc#1183682).
- asm-generic/hyperv: Add missing function prototypes per -W1
  warnings (bsc#1186071).
- clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts
  (bsc#1186071).
- clocksource/drivers/hyper-v: Set clocksource rating based on
  Hyper-V feature (bsc#1186071).
- clocksource/drivers/hyper-v: Handle sched_clock differences
  inline (bsc#1186071).
- Drivers: hv: vmbus: Move handling of VMbus interrupts
  (bsc#1186071).
- Drivers: hv: vmbus: Handle auto EOI quirk inline (bsc#1186071).
- Drivers: hv: vmbus: Move hyperv_report_panic_msg to arch
  neutral code (bsc#1186071).
- Drivers: hv: Redo Hyper-V synthetic MSR get/set functions
  (bsc#1186071).
- x86/hyper-v: Move hv_message_type to architecture neutral module
  (bsc#1186071).
- Drivers: hv: vmbus: Move Hyper-V page allocator to arch neutral
  code (bsc#1186071).
- hv_netvsc: Fix validation in netvsc_linkstatus_callback()
  (bsc#1183682).
- PCI: hv: Fix typo (bsc#1186071).
- scsi: storvsc: Return DID_ERROR for invalid commands
  (bsc#1186071).
- scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback() (bsc#1183682).
- scsi: storvsc: Resolve data race in storvsc_probe()
  (bsc#1183682).
- scsi: storvsc: Fix max_outstanding_req_per_channel for Win8
  and newer (bsc#1186071).
- Revert "Drivers: hv: vmbus: Copy packets sent by Hyper-V out
  of the ring buffer" (bsc#1186071).
- iommu/hyperv: setup an IO-APIC IRQ remapping domain for root
  partition (bsc#1186071).
- x86/hyperv: implement an MSI domain for root partition
  (bsc#1186071).
- asm-generic/hyperv: import data structures for mapping device
  interrupts (bsc#1186071).
- asm-generic/hyperv: introduce hv_device_id and auxiliary
  structures (bsc#1186071).
- asm-generic/hyperv: update hv_interrupt_entry (bsc#1186071).
- asm-generic/hyperv: update hv_msi_entry (bsc#1186071).
- x86/hyperv: implement and use hv_smp_prepare_cpus (bsc#1186071).
- x86/hyperv: provide a bunch of helper functions (bsc#1186071).
- x86/hyperv: handling hypercall page setup for root
  (bsc#1186071).
- x86/hyperv: extract partition ID from Microsoft Hypervisor if
  necessary (bsc#1186071).
- x86/hyperv: allocate output arg pages if required (bsc#1186071).
- clocksource/hyperv: use MSR-based access if running as root
  (bsc#1186071).
- Drivers: hv: vmbus: skip VMBus initialization if Linux is root
  (bsc#1186071).
- x86/hyperv: detect if Linux is the root partition (bsc#1186071).
- asm-generic/hyperv: change HV_CPU_POWER_MANAGEMENT to
  HV_CPU_MANAGEMENT (bsc#1186071).
- hv: hyperv.h: Replace one-element array with flexible-array
  in struct icmsg_negotiate (bsc#1186071).
- hv_netvsc: Restrict configurations on isolated guests
  (bsc#1183682).
- Drivers: hv: vmbus: Enforce 'VMBus version &gt;= 5.2' on isolated
  guests (bsc#1183682).
- Drivers: hv: vmbus: Restrict vmbus_devices on isolated guests
  (bsc#1183682).
- x86/hyperv: Load/save the Isolation Configuration leaf
  (bsc#1183682).
- hv_utils: Fix spelling mistake "Hearbeat" -&gt; "Heartbeat"
  (bsc#1186071).
- Drivers: hv: vmbus: Add /sys/bus/vmbus/hibernation
  (bsc#1186071).
- Drivers: hv: vmbus: Resolve race condition in
  vmbus_onoffer_rescind() (bsc#1183682).
- Drivers: hv: vmbus: Copy the hv_message in vmbus_on_msg_dpc()
  (bsc#1183682).
- Drivers: hv: vmbus: Reduce number of references to message in
  vmbus_on_msg_dpc() (bsc#1183682).
- Drivers: hv: vmbus: Initialize memory to be sent to the host
  (bsc#1183682).
- hv_utils: Add validation for untrusted Hyper-V values
  (bsc#1183682).
- Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the
  ring buffer (bsc#1183682).
- hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet
  info (bsc#1183682).
- hv_netvsc: Allocate the recv_buf buffers after
  NVSP_MSG1_TYPE_SEND_RECV_BUF (bsc#1183682).
- hv_netvsc: Copy packets sent by Hyper-V out of the receive
  buffer (bsc#1183682).
- hv_netvsc: Add (more) validation for untrusted Hyper-V values
  (bsc#1183682).
- hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
  (bsc#1186071).
- hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
  (bsc#1186071).
- hv_netvsc: Check VF datapath when sending traffic to VF
  (bsc#1183682).
- vsock: fix locking in vsock_shutdown() (bsc#1186071).
- x86/hyperv: check cpu mask after interrupt has been disabled
  (bsc#1186071).
- use __netdev_notify_peers in hyperv (bsc#1186071).
- hv_balloon: do adjust_managed_page_count() when
  ballooning/un-ballooning (bsc#1186071).
- hv_balloon: simplify math in alloc_balloon_pages()
  (bsc#1186071).
- commit 8aa7b0a</changelog>
  <changelog author="ohering@suse.de" date="1625227204">- x86/hyperv: fix logical processor creation (bsc#1186071).
- commit 3182d1d</changelog>
  <changelog author="dwagner@suse.de" date="1625227205">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227206">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227207">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227208">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227209">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="175c5e67556888a28b83c226df76dc13a09fc096a5bf68e0b6ee4a0bf930b2e1" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.17.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="ffc7ea6b7da113004845d261ed5aa2e6390383c8565496f24484ad69e6c3aee6" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.22.2"/>
  <changelog author="msuchanek@suse.de" date="1631188800">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188802">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- commit 561fbd8</changelog>
  <changelog author="mkoutny@suse.com" date="1631534407">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="2aca3d1a4936e108b388bd06a7fda8e22d44b0002f1f569d280ea493486e59f2" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.25.2"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="421295ce43c3b469a7f527c6291135600e6c430baee6460e41b58418a73f228c" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.28.2"/>
  <changelog author="dwagner@suse.de" date="1635422400">- nvme-pci: fix error unwind in nvme_map_data (bsc#1191934).
- nvme-pci: refactor nvme_unmap_data (bsc#1191934).
- commit 3a9d8cd</changelog>
  <changelog author="dwagner@suse.de" date="1635422401">- nvme-pci: fix error unwind in nvme_map_data (bsc#1191934).
- nvme-pci: refactor nvme_unmap_data (bsc#1191934).
- commit fc21d20</changelog>
  <changelog author="tiwai@suse.de" date="1635422402">- Update patch reference for ISDN fix (CVE-2021-3896 bsc#1191958)
- commit b1524c3</changelog>
  <changelog author="msuchanek@suse.de" date="1635422403">- powerpc/idle: Don't corrupt back chain when going idle
  (bko#206669 bsc#1174585 bsc#1192107 CVE-2021-43056).
- KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return
  0 if it went to guest (bko#206669 bsc#1174585 bsc#1192107
  CVE-2021-43056).
- KVM: PPC: Book3S HV: Fix stack handling in
  idle_kvm_start_guest() (bko#206669 bsc#1174585 bsc#1192107
  CVE-2021-43056).
- powerpc64/idle: Fix SP offsets when saving GPRs (bko#206669
  bsc#1174585 bsc#1192107 CVE-2021-43056).
- commit 90745c9</changelog>
  <changelog author="mkubecek@suse.cz" date="1635508800">- sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
  (CVE-2021-3655 bsc#1188563).
- sctp: validate chunk size in __rcv_asconf_lookup (CVE-2021-3655
  bsc#1188563).
- sctp: add size validation when walking chunks (CVE-2021-3655
  bsc#1188563).
- commit e419503</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1635508801">- netfilter: xt_IDLETIMER: fix panic that occurs when timer_type
  has garbage value (bsc#1176447).
- ice: fix getting UDP tunnel entry (jsc#SLE-12878).
- net/mlx5: E-Switch, Fix double allocation of acl flow counter
  (jsc#SLE-15172).
- net/mlx5e: IPSEC RX, enable checksum complete (jsc#SLE-15172).
- RDMA/cma: Do not change route.addr.src_addr.ss_family
  (bsc#1181147).
- RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
  (bsc#1181147).
- net: hns3: check queue id range before using (jsc#SLE-14777).
- bnxt_en: make bnxt_free_skbs() safe to call after
  bnxt_free_mem() (jsc#SLE-16649).
- ice: Only lock to update netdev dev_addr (git-fixes).
- net/sched: ets: fix crash when flipping from 'strict' to
  'quantum' (bsc#1176774).
- net/mlx5e: RX, Avoid possible data corruption when relaxed
  ordering and LRO combined (jsc#SLE-15172).
- commit 016bdb7</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1635508802">- ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
  (git-fixes).
- commit c406ead</changelog>
  <changelog author="tiwai@suse.de" date="1635508803">- net: lan78xx: fix division by zero in send path (git-fixes).
- net: batman-adv: fix error handling (git-fixes).
- nfc: port100: fix using -ERRNO as command type mask (git-fixes).
- cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
  (git-fixes).
- regmap: Fix possible double-free in regcache_rbtree_exit()
  (git-fixes).
- commit 1fb45c2</changelog>
  <changelog author="tiwai@suse.de" date="1635508804">- cfg80211: correct bridge/4addr mode check (git-fixes).
- cfg80211: fix management registrations locking (git-fixes).
- commit 38a77a6</changelog>
  <changelog author="tiwai@suse.de" date="1635508805">- kABI workaround for cfg80211 mgmt_registration_lock changes
  (git-fixes).
- commit 85ca292</changelog>
  <changelog author="dwagner@suse.de" date="1635508806">- scsi: lpfc: Update lpfc version to 14.0.0.3 (bsc#1192145).
- scsi: lpfc: Allow fabric node recovery if recovery is in
  progress before devloss (bsc#1192145).
- scsi: lpfc: Fix link down processing to address NULL pointer
  dereference (bsc#1192145).
- scsi: lpfc: Allow PLOGI retry if previous PLOGI was aborted
  (bsc#1192145).
- scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
  (bsc#1192145).
- scsi: lpfc: Correct sysfs reporting of loop support after SFP
  status change (bsc#1192145).
- scsi: lpfc: Wait for successful restart of SLI3 adapter during
  host sg_reset (bsc#1192145).
- scsi: lpfc: Revert LOG_TRACE_EVENT back to LOG_INIT prior to
  driver_resource_setup() (bsc#1192145).
- commit ea0ad63</changelog>
  <changelog author="tiwai@suse.de" date="1635595200">- mmc: vub300: fix control-message timeouts (git-fixes).
- mmc: dw_mmc: exynos: fix the finding clock sample value
  (git-fixes).
- commit 15296ab</changelog>
  <changelog author="mkubecek@suse.cz" date="1635768000">- sctp: add vtag check in sctp_sf_ootb (CVE-2021-3772
  bsc#1190351).
- sctp: add vtag check in sctp_sf_do_8_5_1_E_sa (CVE-2021-3772
  bsc#1190351).
- sctp: add vtag check in sctp_sf_violation (CVE-2021-3772
  bsc#1190351).
- sctp: fix the processing for COOKIE_ECHO chunk (CVE-2021-3772
  bsc#1190351).
- sctp: fix the processing for INIT_ACK chunk (CVE-2021-3772
  bsc#1190351).
- sctp: fix the processing for INIT chunk (CVE-2021-3772
  bsc#1190351).
- sctp: use init_tag from inithdr for ABORT chunk (CVE-2021-3772
  bsc#1190351).
- sctp: check asoc peer.asconf_capable before processing asconf
  (bsc#1190351).
- commit c4ecd47</changelog>
  <changelog author="msuchanek@suse.de" date="1635768001">- KVM: PPC: Book3S HV: Save host FSCR in the P7/8 path
  (bsc#1065729).
- commit 4a60f84</changelog>
  <changelog author="bp@suse.de" date="1635768002">- x86/pat: Pass valid address to sanitize_phys() (bsc#1152489).
- commit 1702f6b</changelog>
  <changelog author="msuchanek@suse.de" date="1635768003">- powerpc/64s: Remove irq mask workaround in
  accumulate_stolen_time() (jsc#SLE-9246 git-fixes).
- commit 5f2cf7e</changelog>
  <changelog author="msuchanek@suse.de" date="1635768004">- powerpc/xive: Discard disabled interrupts in get_irqchip_state()
  (fate#322438 bsc#1085030 git-fixes).
- commit 3106974</changelog>
  <changelog author="msuchanek@suse.de" date="1635768005">- KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode
  changing registers (bsc#1156395).
- KVM: PPC: Fix clearing never mapped TCEs in realmode
  (bsc#1156395).
- KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0
  when guest SPRs are live (bsc#1156395).
- KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state
  (bsc#1156395).
- KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak (bsc#1156395).
- commit 2ce76cc</changelog>
  <changelog author="mkubecek@suse.cz" date="1635768006">- ipv6/netfilter: Discard first fragment not including all headers
  (bsc#1191241).
- IPv6: reply ICMP error if the first fragment don't include
  all headers (bsc#1191241).
- ICMPv6: Add ICMPv6 Parameter Problem, code 3 definition
  (bsc#1191241).
- net: ipv6: Discard next-hop MTU less than minimum link MTU
  (bsc#1191241).
- commit c74316d</changelog>
  <changelog author="mkubecek@suse.cz" date="1635768007">- netfilter: conntrack: collect all entries in one cycle
  (bsc#1173604).
- commit c4117de</changelog>
</package>
<package pkgid="87730c4d70308100471c158cefa87e930aa2db60eb3ce355916eb3c68e0fc2e2" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.3.1"/>
  <changelog author="hare@suse.de" date="1622462400">- nvme-pci: use simple suspend when a HMB is enabled (git-fixes).
- nvme-pci: make sure write/poll_queues less or equal then cpu
  (git-fixes).
- nvme-pci: align io queue count with allocted nvme_queue in
  (git-fixes).
- nvme-pci: remove last_sq_tail (git-fixes).
- nvme-pci: remove volatile cqes (git-fixes).
- nvme-pci: avoid race between nvme_reap_pending_cqes() and
  nvme_poll() (git-fixes).
- nvme-pci: dma read memory barrier for completions (git-fixes).
- nvme-pci: fix "slimmer CQ head update" (git-fixes).
- nvme-pci: Simplify nvme_poll_irqdisable (git-fixes).
- nvme-pci: Remove two-pass completions (git-fixes).
- nvme-pci: Remove tag from process cq (git-fixes).
- nvme-pci: slimmer CQ head update (git-fixes).
- commit dd74a78</changelog>
  <changelog author="hare@suse.de" date="1622462401">- nvme: document nvme controller states (git-fixes).
- commit 495f482</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- blacklist.conf: arm64: add fix for unsupported SOC
- commit 7c4e5f6</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- arm64: vdso32: make vdso32 install conditional (git-fixes).
- commit de92552</changelog>
  <changelog author="hare@suse.de" date="1622462405">- nvme: fix deadlock in disconnect during scan_work and/or
  ana_work (git-fixes).
- Refresh
  patches.suse/nvme-fabrics-reject-I-O-to-offline-device.patch.
- commit 4805fdc</changelog>
  <changelog author="varad.gautam@suse.com" date="1622462406">- series.conf: cleanup
  update upstream references and resort:
  patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch
- commit a8331c9</changelog>
  <changelog author="ykaukab@suse.de" date="1622462407">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462408">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462409">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="bp@suse.de" date="1622462410">- x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is
  supported (bsc#1152489).
- commit 1931741</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="hare@suse.de" date="1622548801">- block/genhd: use atomic_t for disk_event-&gt;block (bsc#1185497).
- commit 57427b3</changelog>
  <changelog author="oneukum@suse.com" date="1622548802">- nxp-nci: add NXP1002 id (bsc#1185589).
- commit 9d43526</changelog>
  <changelog author="oneukum@suse.com" date="1622548803">- nxp-i2c: restore includes for kABI (bsc#1185589).
- commit 1786af1</changelog>
  <changelog author="msuchanek@suse.de" date="1622548804">- Refresh patches.suse/scsi-ibmvfc-Reinit-target-retries.patch.
  Update patch metadata.
- commit e269098</changelog>
  <changelog author="mkubecek@suse.cz" date="1622548805">- series.conf: cleanup
- move unsortable patch out of sorted section
  patches.suse/nxp-nci-add-NXP1002-id.patch
- commit d0ca1ba</changelog>
  <changelog author="dwagner@suse.de" date="1622548806">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
  Refresh:
  - patches.suse/nvme-multipath-retry-commands-for-dying-queues.patch
- commit f0fe006</changelog>
  <changelog author="dwagner@suse.de" date="1622548807">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="3e8978a70b679364fea33a5bca1488b3984ba0f2e770d2a4bf7bf387376ad983" name="cluster-md-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.8.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="a8c57ae26d5e2130da826a067c2dd1e3dcba1d534c009450b21509b9f394cd28" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="c1a567d022f78eb370f713fb4c8b6b3d77f1bc56f8313a486e72eca2f908d63a" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="64b6055a38b6237aec956b4c9a9bfff4506b0d06eb00424d4cdf00ef57fca2ef" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="34d26c9dc64290740d5e781e2814f678a92f41ccefbfe645d04bff0fa4cdf88d" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="7c5ef5ce12932ae1269198d3fd1a2ed0733954147ced703d546b9526592a677b" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="539f3a1cc1936a619004753b885c0011a85b085224a826a0bf0de8635280d24d" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="a8f0c30619004310103e185b57b5793c47e63fcd986cac3270571a60585413e3" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="8603783752f825838ec3a7c02d86e18baa463438bbf6c815ae2576a650f60313" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="a86631480dd9b10a463adc37b127c2371f86337fdd1cfe83bb1971aedb144320" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="abd0559538dee22db45baed8a2f32773d60a683685af87da4aba73b17826b3de" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="493ca5d3d7ef47e66d7daa976cd6d75f03834611d439fcb309eebffaaa4c92a0" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="90e5221582df0320c27529654d98f58ede21ded68fcf3244cde42d06e6db6b29" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="4f4f3f0f85a19f1960e5dd0cde1ce3948aae42d691445dfcad403d13946b9f97" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="a23cbf2fdd219ea998a0c7f3ea4546f9da16dc180d7f73c9dbfc6773b62d76b9" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="771a779725dfc96226609e055bf13c2c20008788971c02507637e28d4637b3bb" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="5c1af245091a628e621407bd236a2becc9706a5d8310360040bb7f6d3f573628" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="1cdb7b58b0935861d7685e1c15bb706da52176c95eca361dd7b031558527f953" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="33bbe98339bc63bf41f7958c74afaf55e2c627fe134d9255bec66c18c54bee00" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="e0095012a85bcc08103aaf4f0aa2d127488807c6582d1e9240d1f80b541cab82" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="a9ebf10caf1dcbd6f0db20f9a2ca812fff1e815b12aceefcb644ec477d4bbd5a" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="356cdc6c21692e3fb15edf7f6e771145db017979450cd5b44ff165398503077b" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="00971407e5fbec427583aba67dca72dea4d736dd76cb7b24ea93347b2e0fca18" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="ef0fd872abadb0871cf04ceb311b068b31aaa983ee42eca3dabd621a2f6279c4" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="0101d938c8fe7911acb817017d1c537258bd4f3f71afabda0360b148a4c504b8" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="8b152e189a328699a4b7e7bc58aa85172320075bfd9f1bd6088e7f7c339ed150" name="cluster-md-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="a1b787e5ea2435e8e8303acda63a26c2630a4b51d6b3fb80743f8e9d88797f1d" name="cluster-md-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="89dcf4bed409df845516b03f27f1774a21f36801e3045b00dab64c31fdf74bc2" name="cluster-md-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="e196c265e663c9f346682c4500f0e94a076969a0638cbeeec9e8f50cbba186db" name="cluster-md-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="23b144959a6c54855b574a5cdb1cafb38dfb054fea2459e25d192f40ddc95022" name="cluster-md-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="484d47ccd9cef0d63d9fe48288f60780798d9a689718c26eeb312afc6045432a" name="cluster-md-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="4df398af8f917ba4fa66f1e8e37c0b3a7e83716e902fe53b51ecdaee172aa59a" name="cluster-md-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="dc32d295be96c301b3d0875c906ad845235ebada21a6f12ee377bf3c686426a9" name="cluster-md-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="d1cc6fac8c01069fa2e3f2523b9c8d726397a9e5b2e6f9707e26986a1035a0a7" name="cluster-md-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="9fa905b9cf437dbbe948a9fd315390628f0ec4239bae7c1deeba0525180cc015" name="cluster-md-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="835e0aee96bcc905f938abb6ab34e14cf8e013689b20f1baa1e3041bb6262921" name="cluster-md-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="6fac9ef799ff798b5e78597a03b1d3844bd11af0d6a0a54e03a605a9e80f7ae4" name="cluster-md-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="4f49a064d5644c9baf2f9126d8832835c0d7b642c10b9216e5164a8cb42c576c" name="cluster-md-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="29971b6352669c4bafd8538abad77591fdc1f65ba7b5d04111ada2c0d63987d1" name="cluster-md-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="0fd2bb450859661da17c8de65fd4c963ba4fcab2591b4b2a0fe0b62a2a913bdb" name="cluster-md-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="c7c583cc8f64c3afa57159e0ef864d1fddeef33a108b846a0bd18838b1601663" name="cluster-md-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="9f9c8d067182a7c3c37e4d744848a2997cdeaba29d4a8206567f7e196abdb23c" name="cluster-md-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="141e0b038609d33d307b1c5894a32004ebc4505cfb90b12810270542eee462d0" name="cluster-md-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="11b90968de0d6021b7a822ca79ad1c249dc26c6c3297f3a8ade9eac9d0a151dd" name="compat-libpthread-nonshared" arch="src">
  <version epoch="0" ver="0" rel="3.3.1"/>
  <changelog author="schwab@suse.de" date="1605096000">- New (bsc#1178526)</changelog>
  <changelog author="schwab@suse.de" date="1626091200">- Also build 32-bit x86 version (bsc#1188004)</changelog>
</package>
<package pkgid="9db3a12db2c7348fdeba0a3f10d0b83fd0d75669d7cfd745de5213a8920a6edc" name="compat-libpthread-nonshared" arch="x86_64">
  <version epoch="0" ver="0" rel="3.3.1"/>
  <changelog author="schwab@suse.de" date="1605096000">- New (bsc#1178526)</changelog>
  <changelog author="schwab@suse.de" date="1626091200">- Also build 32-bit x86 version (bsc#1188004)</changelog>
</package>
<package pkgid="3aa20f066c65ed3661fbd954fd9ca0e54e6c3ad541391dc0a3d084b5f9988cc7" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.4.11" rel="56.1"/>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="6f8bf5f81dc2ccdd0b1bb5c4c921f516388a095fe14b706e0da412a0685fca88" name="containerd" arch="ppc64le">
  <version epoch="0" ver="1.4.11" rel="56.1"/>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="dab3bf9556f6817c0abc5921561bb64e584ba3dd28e9fc45f06b19af5273a4f4" name="containerd" arch="s390x">
  <version epoch="0" ver="1.4.11" rel="56.1"/>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="694d84a41cddc6980cc6c04a1731d6b75ea593f9f4abcabebe8710f70a425edb" name="containerd" arch="src">
  <version epoch="0" ver="1.4.11" rel="56.1"/>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="5707422a177e8c6aa8aeca0aad352244037bdd2b365f653bba195c49c1180618" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.4.11" rel="56.1"/>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="96b538029faa86b7ab74b0b36eaf7a2f6beffc868701871e2877f1a7c96f6cba" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.4.4" rel="5.32.1"/>
  <changelog author="asarai@suse.com" date="1532520000">- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. bsc#1102522
- Add backport of https://github.com/containerd/containerd/pull/2534 to make
  the man page no longer pollute the global namespace.
  + 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch
- Remove the following patch since it has already been merged upstream.
  - bsc1065109-0001-makefile-add-support-for-build_flags.patch
- Remove systemd-related files and add docker-containerd-* symlinks; this
  aligns with the upstream defaults where dockerd will execute
  docker-containerd. Version upgrades of docker are expected to work more
  smoothly as much of the upgrade logic is implemented in dockerd.
- Add containerd-rpmlintrc (or containerd-kubic-rpmlintrc) to deal with
  /usr/src/containerd/* rpmlint errors (which don't affect normal users of this
  package).</changelog>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
</package>
<package pkgid="86100c96e1627794c7374b7aeebf14d797ea8c0c00836660e47de3ab285dcd94" name="containerd" arch="ppc64le">
  <version epoch="0" ver="1.4.4" rel="5.32.1"/>
  <changelog author="asarai@suse.com" date="1532520000">- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. bsc#1102522
- Add backport of https://github.com/containerd/containerd/pull/2534 to make
  the man page no longer pollute the global namespace.
  + 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch
- Remove the following patch since it has already been merged upstream.
  - bsc1065109-0001-makefile-add-support-for-build_flags.patch
- Remove systemd-related files and add docker-containerd-* symlinks; this
  aligns with the upstream defaults where dockerd will execute
  docker-containerd. Version upgrades of docker are expected to work more
  smoothly as much of the upgrade logic is implemented in dockerd.
- Add containerd-rpmlintrc (or containerd-kubic-rpmlintrc) to deal with
  /usr/src/containerd/* rpmlint errors (which don't affect normal users of this
  package).</changelog>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
</package>
<package pkgid="ea8f06d5996253028f6d494c7b5e42b559c45390f654038c2f24f2c71dfb7cd2" name="containerd" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="5.32.1"/>
  <changelog author="asarai@suse.com" date="1532520000">- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. bsc#1102522
- Add backport of https://github.com/containerd/containerd/pull/2534 to make
  the man page no longer pollute the global namespace.
  + 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch
- Remove the following patch since it has already been merged upstream.
  - bsc1065109-0001-makefile-add-support-for-build_flags.patch
- Remove systemd-related files and add docker-containerd-* symlinks; this
  aligns with the upstream defaults where dockerd will execute
  docker-containerd. Version upgrades of docker are expected to work more
  smoothly as much of the upgrade logic is implemented in dockerd.
- Add containerd-rpmlintrc (or containerd-kubic-rpmlintrc) to deal with
  /usr/src/containerd/* rpmlint errors (which don't affect normal users of this
  package).</changelog>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
</package>
<package pkgid="a11504731b0b469210e0a1d4fa1ed45e2b00d68b2c1b7f6196eee9e1596f7f07" name="containerd" arch="src">
  <version epoch="0" ver="1.4.4" rel="5.32.1"/>
  <changelog author="asarai@suse.com" date="1532520000">- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. bsc#1102522
- Add backport of https://github.com/containerd/containerd/pull/2534 to make
  the man page no longer pollute the global namespace.
  + 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch
- Remove the following patch since it has already been merged upstream.
  - bsc1065109-0001-makefile-add-support-for-build_flags.patch
- Remove systemd-related files and add docker-containerd-* symlinks; this
  aligns with the upstream defaults where dockerd will execute
  docker-containerd. Version upgrades of docker are expected to work more
  smoothly as much of the upgrade logic is implemented in dockerd.
- Add containerd-rpmlintrc (or containerd-kubic-rpmlintrc) to deal with
  /usr/src/containerd/* rpmlint errors (which don't affect normal users of this
  package).</changelog>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
</package>
<package pkgid="eabcdbd1d0fc669c3475c63f02f979b3e281737bf1241ea421ca4d2b4d86431b" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.4.4" rel="5.32.1"/>
  <changelog author="asarai@suse.com" date="1532520000">- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. bsc#1102522
- Add backport of https://github.com/containerd/containerd/pull/2534 to make
  the man page no longer pollute the global namespace.
  + 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch
- Remove the following patch since it has already been merged upstream.
  - bsc1065109-0001-makefile-add-support-for-build_flags.patch
- Remove systemd-related files and add docker-containerd-* symlinks; this
  aligns with the upstream defaults where dockerd will execute
  docker-containerd. Version upgrades of docker are expected to work more
  smoothly as much of the upgrade logic is implemented in dockerd.
- Add containerd-rpmlintrc (or containerd-kubic-rpmlintrc) to deal with
  /usr/src/containerd/* rpmlint errors (which don't affect normal users of this
  package).</changelog>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
</package>
<package pkgid="cfc1f2659d15f5b63d3d13c6cdb9faade8ea9d9de796c9f372e2e9b42c6514d7" name="containerd" arch="aarch64">
  <version epoch="0" ver="1.4.4" rel="5.36.1"/>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1626264000">- Add patch for CVE-2021-32760. bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
</package>
<package pkgid="0f81d8b886073610e87eb3dec9327c715523303b13303dab4bdf813e473ca2bd" name="containerd" arch="ppc64le">
  <version epoch="0" ver="1.4.4" rel="5.36.1"/>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1626264000">- Add patch for CVE-2021-32760. bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
</package>
<package pkgid="d8b4d4f862c2f0836820560d56d3a06b204e2bc42bb704562c80342ef3d40b5d" name="containerd" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="5.36.1"/>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1626264000">- Add patch for CVE-2021-32760. bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
</package>
<package pkgid="5b7f2dc9f7dfc421979aca2feb9d4e7a5199a747c1b2ce31907e1f0a5ed9cbd6" name="containerd" arch="src">
  <version epoch="0" ver="1.4.4" rel="5.36.1"/>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1626264000">- Add patch for CVE-2021-32760. bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
</package>
<package pkgid="ae507d7615df1bc786eef507c64c8bc3b28cb63ba0b7bcde2ed2c042df5e9e0f" name="containerd" arch="x86_64">
  <version epoch="0" ver="1.4.4" rel="5.36.1"/>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1626264000">- Add patch for CVE-2021-32760. bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
</package>
<package pkgid="15d513668592d99ec7a818527542d3db01aebba1b2a40cdde118fb1d63b4fd00" name="containerd-ctr" arch="aarch64">
  <version epoch="0" ver="1.4.11" rel="56.1"/>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="8381136f075006ee1fba5d603777b36855d133f17e646a5ecb20f4bc8cd82662" name="containerd-ctr" arch="ppc64le">
  <version epoch="0" ver="1.4.11" rel="56.1"/>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="038329b1aac1d3911b5b222e43a7a51a4f6e616b4ad136f2ab016eb1b2ada3dc" name="containerd-ctr" arch="s390x">
  <version epoch="0" ver="1.4.11" rel="56.1"/>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="4182a31fb3ca7920fdb03584def71175df56af1802f1ba8b19302a6ca585c2ee" name="containerd-ctr" arch="x86_64">
  <version epoch="0" ver="1.4.11" rel="56.1"/>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1625659200">- Build with go1.15 for reproducible build results (boo#1102408)</changelog>
  <changelog author="asarai@suse.com" date="1626264000">[ This patch was only released in SLES and Leap. ]
- Add patch for GHSA-c72p-9xmj-rx3w. CVE-2021-32760 bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="asarai@suse.com" date="1626782400">- Update to containerd v1.4.8, to fix CVE-2021-32760. bsc#1188282
- Remove upstreamed patches:
  - bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
  <changelog author="dcermak@suse.com" date="1633089600">- Install systemd service file as well (fixes bsc#1190826)</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to containerd v1.4.11, to fix CVE-2021-41103 bsc#1191121. bsc#1191355
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="144fcbdec4436a36d25f37d705e7ea5d2b01501491e55ee8fc040a26ef5a917d" name="containerd-ctr" arch="aarch64">
  <version epoch="0" ver="1.4.4" rel="5.32.1"/>
  <changelog author="asarai@suse.com" date="1532520000">- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. bsc#1102522
- Add backport of https://github.com/containerd/containerd/pull/2534 to make
  the man page no longer pollute the global namespace.
  + 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch
- Remove the following patch since it has already been merged upstream.
  - bsc1065109-0001-makefile-add-support-for-build_flags.patch
- Remove systemd-related files and add docker-containerd-* symlinks; this
  aligns with the upstream defaults where dockerd will execute
  docker-containerd. Version upgrades of docker are expected to work more
  smoothly as much of the upgrade logic is implemented in dockerd.
- Add containerd-rpmlintrc (or containerd-kubic-rpmlintrc) to deal with
  /usr/src/containerd/* rpmlint errors (which don't affect normal users of this
  package).</changelog>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
</package>
<package pkgid="06ec9b5244d5330e39e4d20aacc3cf854f84e2b3477b45cb0304630547e2d004" name="containerd-ctr" arch="ppc64le">
  <version epoch="0" ver="1.4.4" rel="5.32.1"/>
  <changelog author="asarai@suse.com" date="1532520000">- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. bsc#1102522
- Add backport of https://github.com/containerd/containerd/pull/2534 to make
  the man page no longer pollute the global namespace.
  + 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch
- Remove the following patch since it has already been merged upstream.
  - bsc1065109-0001-makefile-add-support-for-build_flags.patch
- Remove systemd-related files and add docker-containerd-* symlinks; this
  aligns with the upstream defaults where dockerd will execute
  docker-containerd. Version upgrades of docker are expected to work more
  smoothly as much of the upgrade logic is implemented in dockerd.
- Add containerd-rpmlintrc (or containerd-kubic-rpmlintrc) to deal with
  /usr/src/containerd/* rpmlint errors (which don't affect normal users of this
  package).</changelog>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
</package>
<package pkgid="6daef601203a00d4c038bf26272f889e6d5dbfed37615b030daa80d76bcb0f90" name="containerd-ctr" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="5.32.1"/>
  <changelog author="asarai@suse.com" date="1532520000">- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. bsc#1102522
- Add backport of https://github.com/containerd/containerd/pull/2534 to make
  the man page no longer pollute the global namespace.
  + 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch
- Remove the following patch since it has already been merged upstream.
  - bsc1065109-0001-makefile-add-support-for-build_flags.patch
- Remove systemd-related files and add docker-containerd-* symlinks; this
  aligns with the upstream defaults where dockerd will execute
  docker-containerd. Version upgrades of docker are expected to work more
  smoothly as much of the upgrade logic is implemented in dockerd.
- Add containerd-rpmlintrc (or containerd-kubic-rpmlintrc) to deal with
  /usr/src/containerd/* rpmlint errors (which don't affect normal users of this
  package).</changelog>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
</package>
<package pkgid="ad90b67ccc792b680e663e9248bd675d70d7553ac3d406c8b5d551c65ea7430e" name="containerd-ctr" arch="x86_64">
  <version epoch="0" ver="1.4.4" rel="5.32.1"/>
  <changelog author="asarai@suse.com" date="1532520000">- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. bsc#1102522
- Add backport of https://github.com/containerd/containerd/pull/2534 to make
  the man page no longer pollute the global namespace.
  + 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch
- Remove the following patch since it has already been merged upstream.
  - bsc1065109-0001-makefile-add-support-for-build_flags.patch
- Remove systemd-related files and add docker-containerd-* symlinks; this
  aligns with the upstream defaults where dockerd will execute
  docker-containerd. Version upgrades of docker are expected to work more
  smoothly as much of the upgrade logic is implemented in dockerd.
- Add containerd-rpmlintrc (or containerd-kubic-rpmlintrc) to deal with
  /usr/src/containerd/* rpmlint errors (which don't affect normal users of this
  package).</changelog>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
</package>
<package pkgid="8d572a62be3bde0c1beba8eb22226fa261992e773739235abce48fec4dce69a8" name="containerd-ctr" arch="aarch64">
  <version epoch="0" ver="1.4.4" rel="5.36.1"/>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1626264000">- Add patch for CVE-2021-32760. bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
</package>
<package pkgid="9968d2357298945a9fb5fafe8d5dece4baf8f26f4f9572754de7eb6d13f6d0bc" name="containerd-ctr" arch="ppc64le">
  <version epoch="0" ver="1.4.4" rel="5.36.1"/>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1626264000">- Add patch for CVE-2021-32760. bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
</package>
<package pkgid="4eb6b1d27e52cfd1acb9d64ac95dddab38c2ebe497357785a91602ba5bdc3518" name="containerd-ctr" arch="s390x">
  <version epoch="0" ver="1.4.4" rel="5.36.1"/>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1626264000">- Add patch for CVE-2021-32760. bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
</package>
<package pkgid="3603c1d8a6da00aab6963c40d524799f20f5b4c35b600fa5701ed8f234f97691" name="containerd-ctr" arch="x86_64">
  <version epoch="0" ver="1.4.4" rel="5.36.1"/>
  <changelog author="asarai@suse.com" date="1533124800">- Enable seccomp support on SLE12, since libseccomp is now a new enough vintage
  to work with Docker and containerd. fate#325877</changelog>
  <changelog author="asarai@suse.com" date="1534420800">- Merge -kubic packages back into the main Virtualization:containers packages.
  This is done using _multibuild to add a "kubic" flavour, which is then used
  to conditionally compile patches and other kubic-specific features.
  bsc#1105000</changelog>
  <changelog author="asarai@suse.com" date="1534939200">- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  bsc#1102522</changelog>
  <changelog author="asarai@suse.com" date="1541419200">- Add backport of https://github.com/containerd/containerd/pull/2764, which is
  required for us to build containerd on i586 SLE-12 (where /bin/sh doesn't
  like emoji in shell scripts). bsc#1102522 bsc#1113313
  + 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="clee@suse.com" date="1545307200">- Update go requirements to &gt;= go1.10 to fix
  * bsc#1118897 CVE-2018-16873
    go#29230 cmd/go: remote command execution during "go get -u"
  * bsc#1118898 CVE-2018-16874
    go#29231 cmd/go: directory traversal in "go get" via curly braces in import paths
  * bsc#1118899 CVE-2018-16875
    go#29233 crypto/x509: CPU denial of service</changelog>
  <changelog author="sgrunert@suse.com" date="1547208000">- Disable leap based builds for kubic flavor. bsc#1121412</changelog>
  <changelog author="asarai@suse.com" date="1549368000">- Update to containerd v1.2.2, which is required for Docker v18.09.1-ce.
  bsc#1124308
  * Fix rare deadlock on FIFO creation with timeout
  * Fix a bug that a container can't be stopped or inspected when its
    corresponding image is deleted
  * Fix a bug that the cri plugin handles containerd events outside of
    k8s.io namespace
  more changes at:
  https://github.com/containerd/containerd/releases/tag/v1.2.2
  Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.1
    https://github.com/containerd/containerd/releases/tag/v1.2.0
    https://github.com/containerd/containerd/releases/tag/v1.1.4
    https://github.com/containerd/containerd/releases/tag/v1.1.3
- Remove required_dockerrunc commit pinning, as it just lead to issues.
- Remove upstreamed patches.
  - 0001-docs-man-rename-config.toml-5-to-be-more-descriptive.patch</changelog>
  <changelog author="sgrunert@suse.com" date="1553169600">- Update containerd to v1.2.4
  * cri: Set /etc/hostname
  * cri: Fix env performance issue
  * runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve
    bsc#1121967 CVE-2019-5736
  * cri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
  * Windows: NewDirectIOFromFIFOSet
  * Changelogs from previous versions also included in this update:
    https://github.com/containerd/containerd/releases/tag/v1.2.3</changelog>
  <changelog author="asarai@suse.com" date="1556884800">- Update to containerd v1.2.5, which is required for v18.09.5-ce.
  bsc#1128376 boo#1134068
  https://github.com/containerd/containerd/releases/tag/v1.2.5</changelog>
  <changelog author="asarai@suse.com" date="1561723200">- Update to containerd v1.2.6, which is required for Docker v18.09.7-ce.
  bsc#1139649
- Remove containerd-test (it's not useful for actual testing).</changelog>
  <changelog author="asarai@suse.com" date="1570536000">- Update to containerd v1.2.10, which is required for Docker 19.03.3-ce.
  bsc#1153367 bsc#1157330</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to containerd v1.2.13, which is required for Docker 19.03.11-ce.
  bsc#1172377</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Use Go 1.13 for build.</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to containerd v1.3.7, which is required for Docker 19.03.13-ce.
  boo#1176708 bsc#1177598 CVE-2020-15157
- Refresh patches:
  * 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to containerd v1.3.9, which is needed for Docker v19.03.14-ce and
  fixes CVE-2020-15257. bsc#1178969 bsc#1180243</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Update to containerd v1.4.3, which is needed for Docker v20.10.2-ce.
  bsc#1181594
- Install the containerd-shim* binaries and stop creating
  docker-containerd-shim because that isn't used by Docker anymore.
  bsc#1183024</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Update to handle the docker-runc removal, and drop the -kubic flavour.
  bsc#1181677 bsc#1181749</changelog>
  <changelog author="asarai@suse.com" date="1615032000">- Update to containerd v1.4.4, to fix CVE-2021-21334.</changelog>
  <changelog author="asarai@suse.com" date="1618574400">- Drop long-since upstreamed patch, originally needed to fix i386 builds on
  SLES:
  - 0001-makefile-remove-emoji.patch</changelog>
  <changelog author="asarai@suse.com" date="1626264000">- Add patch for CVE-2021-32760. bsc#1188282
  + bsc1188282-use-chmod-path-for-checking-symlink.patch</changelog>
</package>
<package pkgid="017c6237cd4aba4e10e084111df091bc901ed7d5f13df251cd949e849ad9791b" name="coreutils" arch="aarch64">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="7250c58b11946fee373cd9be0dda7fae68b95f3f181e6c60d76a3ec2c8a9e890" name="coreutils" arch="ppc64le">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="bceb722835ff0aeb9e490753193bd317bd670344674a303dd80c6b594418522e" name="coreutils" arch="s390x">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="9bf04d1cea5a6ab692f8280413742c2089ec9ba597ecb6a45f03c3ee73331b7f" name="coreutils" arch="src">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="bee43e2054c5e7e185d5fef9879da6094512a5d2aa6a019f9641c959ed2550d3" name="coreutils" arch="x86_64">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="9965b83a26c796d3ba2e9a1e35f1ec31e1d7673021a2d7c37406fd2065a4e316" name="coreutils-doc" arch="noarch">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="341f1e1ce31c82368a8b6178013a914c2feda3a49bb652a199de09d55c596c35" name="coreutils-lang" arch="noarch">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="100ce13ec825468d103518ce3d9749ac8c42eb93332a96e18ca0551b7cf726c9" name="coreutils-single" arch="aarch64">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="06a4042a36253fbb25968e55a28aaca215648749239d3da0e0c42fcdd05aa861" name="coreutils-single" arch="ppc64le">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="1b7f70dcba23df13985cd0205a297b5c932c048c9bf30591146b426ccd672a81" name="coreutils-single" arch="s390x">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="b2feaa40b248e2b382976cbf7478420450db2dade0fcd433958338033e46c590" name="coreutils-single" arch="src">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="01c5a7639752f7cc6cb65099f1978413a127305eaf5b352a21261305586775ec" name="coreutils-single" arch="x86_64">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="29a4185da2be51db82d56f9aa648a3d9f7c2df1e0f604d612fc13ce8fb9d550e" name="coreutils-testsuite" arch="aarch64">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="67f4b9842eb07396d0affc4419938fb25ba4f30e6b35ebd3bad72fb1ca8c9fa7" name="coreutils-testsuite" arch="ppc64le">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="90da00f1f9a8f6519bd96488aa1341beed2aa8ea2487504aa04bd1d13ca3adef" name="coreutils-testsuite" arch="s390x">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="64343ec63397b9b23934d1f7533a5302542f507b35091745fa000f45bda9f6bc" name="coreutils-testsuite" arch="src">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="d1f9a6e2659b3b3fa44e0ce405a7890260df63105fdcb11e6b52803b09d8d591" name="coreutils-testsuite" arch="x86_64">
  <version epoch="0" ver="8.32" rel="3.2.1"/>
  <changelog author="mail@bernhard-voelker.de" date="1478001600">- coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch:
  Add upstream patch to fix "md5sum --check --ignore-missing" which
  treated files with checksums starting with "00" as missing.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1480680000">- Update to 8.26
  (for details see included NEWS file)
- coreutils.spec (%description): Add b2sum, a new utility.
  (BuildRequires): Add timezone to enable new 'date-debug.sh' test.
- coreutils-i18n.patch: Sync I18N patch from Fedora, as the diff
  for the old i18n implementation of expand/unexpand has become
  unmaintainable:
  git://pkgs.fedoraproject.org/coreutils.git
- Remove now-upstream patches:
  * coreutils-df-hash-in-filter.patch
  * coreutils-diagnose-fts-readdir-failure.patch
  * coreutils-m5sum-sha-sum-fix-ignore-missing-with-00-checksums.patch
  * coreutils-maint-fix-dependency-of-man-arch.1.patch
- Refresh/merge all other patches:
  * coreutils-invalid-ids.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-sysinfo.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1489147200">- Update to 8.27
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-ocfs2_reflinks.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
  * coreutils-testsuite.spec
- coreutils.keyring: Update (now ascii-armored) by
    'osc service localrun download_files'.
- coreutils-tests-port-to-timezone-2017a.patch: Add patch to
  workaround a FP test failure with newer timezone-2017a.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1493726400">- coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch:
  Add upstream patch to fix an heap overflow security issue
  in date(1) and touch(1) with a large TZ variable
  (CVE-2017-7476, rh#1444774, boo#1037124).</changelog>
  <changelog author="ghe@suse.com" date="1502884800">- Drop coreutils-ocfs2_reflinks.patch
  OCFS2 file system has supported file clone ioctls like btrfs,
  then, coreutils doesn't need this patch from the kernel v4.10-rc1</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1504526400">- Update to 8.28
  (for details see included NEWS file)
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.keyring: Update from upstream (Savannah).
- Remove now-upstream patches:
  * coreutils-cve-2017-7476-out-of-bounds-with-large-tz.patch
  * coreutils-tests-port-to-timezone-2017a.patch
- coreutils.spec: Add "BuildRequires: user(bin)" for the tests.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1514462400">- Update to 8.29:
  * Noteworthy changes in release 8.29 (2017-12-27) [stable]
  * * Bug fixes
  b2sum no longer crashes when processing certain truncated check files.
  [bug introduced with b2sum coreutils-8.26]
  dd now ensures the correct cache ranges are specified for the "nocache"
  and "direct" flags.  Previously some pages in the page cache were not
  invalidated.  [bug introduced for "direct" in coreutils-7.5,
  and with the "nocache" implementation in coreutils-8.11]
  df no longer hangs when given a fifo argument.
  [bug introduced in coreutils-7.3]
  ptx -S no longer infloops for a pattern which returns zero-length matches.
  [the bug dates back to the initial implementation]
  shred --remove will again repeatedly rename files with shortening names
  to attempt to hide the original length of the file name.
  [bug introduced in coreutils-8.28]
  stty no longer crashes when processing settings with -F also specified.
  [bug introduced in fileutils-4.0]
  tail --bytes again supports non seekable inputs on all systems.
  On systems like android it always tried to process as seekable inputs.
  [bug introduced in coreutils-8.24]
  timeout will again notice its managed command exiting, even when
  invoked with blocked CHLD signal, or in a narrow window where
  this CHLD signal from the exiting child was missed.  In each case
  timeout would have then waited for the time limit to expire.
  [bug introduced in coreutils-8.27]
  * * New features
  timeout now supports the --verbose option to diagnose forced termination.
  * * Improvements
  dd now supports iflag=direct with arbitrary sized files on all file systems.
  tail --bytes=NUM will efficiently seek to the end of block devices,
  rather than reading from the start.
  Utilities which do not support long options (other than the default --help
  and --version), e.g. cksum and sleep, now use more consistent error diagnostic
  for unknown long options.
  * * Build-related
  Default man pages are now distributed which are used if perl is
  not available on the build system, or when cross compiling.
- Refresh patches (line number changes only):
  * coreutils-i18n.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1530619200">- Update to 8.30:
  * Noteworthy changes in release 8.30 (2018-07-01) [stable]
  * * Bug fixes
  'cp --symlink SRC DST' will again correctly validate DST.
  If DST is a regular file and SRC is a symlink to DST,
  then cp will no longer allow that operation to clobber DST.
  Also with -d, if DST is a symlink, then it can always be replaced,
  even if it points to SRC on a separate device.
  [bugs introduced with coreutils-8.27]
  'cp -n -u' and 'mv -n -u' now consistently ignore the -u option.
  Previously, this option combination suffered from race conditions
  that caused -u to sometimes override -n.
  [bug introduced with coreutils-7.1]
  'cp -a --no-preserve=mode' now sets appropriate default permissions
  for non regular files like fifos and character device nodes etc.,
  and leaves mode bits of existing files unchanged.
  Previously it would have set executable bits on created special files,
  and set mode bits for existing files as if they had been created.
  [bug introduced with coreutils-8.20]
  'cp --remove-destination file symlink' now removes the symlink
  even if it can't be traversed.
  [bug introduced with --remove-destination in fileutils-4.1.1]
  ls no longer truncates the abbreviated month names that have a
  display width between 6 and 12 inclusive.  Previously this would have
  output ambiguous months for Arabic or Catalan locales.
  'ls -aA' is now equivalent to 'ls -A', since -A now overrides -a.
  [bug introduced in coreutils-5.3.0]
  'mv -n A B' no longer suffers from a race condition that can
  overwrite a simultaneously-created B.  This bug fix requires
  platform support for the renameat2 or renameatx_np syscalls, found
  in recent Linux and macOS kernels.  As a side effect, ?mv -n A A?
  now silently does nothing if A exists.
  [bug introduced with coreutils-7.1]
  * * Changes in behavior
  'cp --force file symlink' now removes the symlink even if
  it is self referential.
  ls --color now matches file extensions case insensitively.
  * * New features
  cp --reflink now supports --reflink=never to enforce a standard copy.
  env supports a new -v/--debug option to show verbose information about
  each processing step.
  env supports a new -S/--split-string=S option to split a single argument
  string into multiple arguments. Used to pass multiple arguments in scripts
  (shebang lines).
  md5sum accepts a new option: --zero (-z) to delimit the output lines with a
  NUL instead of a newline character.  This also disables file name escaping.
  This also applies to sha*sum and b2sum.
  rm --preserve-root now supports the --preserve-root=all option to
  reject any command line argument that is mounted to a separate file system.
  * * Improvements
  cut supports line lengths up to the max file size on 32 bit systems.
  Previously only offsets up to SIZE_MAX-1 were supported.
  stat and tail now know about the "exfs" file system, which is a
  version of XFS.  stat -f --format=%T now reports the file system type,
  and tail -f uses inotify.
  wc avoids redundant processing of ASCII text in multibyte locales,
  which is especially significant on macOS.
  * * Build-related
  Adjust to glibc &gt;= 2.28  (bsc#1182550, jsc#SLE-13520, jsc#SLE-13756)
- Refresh patches (line number changes only):
  * coreutils-build-timeout-as-pie.patch
  * coreutils-disable_tests.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * (License): osc changed the value from "GPL-3.0+" to "GPL-3.0-or-later".
  * (build): Make sure that parse-datetime.{c,y} ends up in debuginfo (rh#1555079).
- coreutils-i18n.patch:
  * src/exand.c,src/unexpand.c: Avoid -Wcomment warning.
  * src/cut.c (cut_characters_or_cut_bytes_no_split): Change idx from size_t
    to uintmax_t type to avoid a regression on i586, armv7l and ppc.
    Compare upstream, non-MB commit:
    https://git.sv.gnu.org/cgit/coreutils.git/commit/?id=d1a754c8272
    (cut_fields_mb): Likewise for field_idx.
  * tests/misc/cut.pl: Remove downstream tweaks as upstream MB tests are
    working since a while.
- coreutils.keyring: Update Assaf Gordon's GPG public key.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1552305600">- Update to 8.31:
  * Noteworthy changes in release 8.31 (2019-03-10) [stable]
  * * Bug fixes
  'base64 a b' now correctly diagnoses 'b' as the extra operand, not 'a'.
  [bug introduced in coreutils-5.3.0]
  When B already exists, 'cp -il A B' no longer immediately fails
  after asking the user whether to proceed.
  [This bug was present in "the beginning".]
  df no longer corrupts displayed multibyte characters on macOS.
  [bug introduced with coreutils-8.18]
  seq no longer outputs inconsistent decimal point characters
  for the last number, when locales are misconfigured.
  [bug introduced in coreutils-7.0]
  shred, sort, and split no longer falsely report ftruncate errors
  when outputting to less-common file types.  For example, the shell
  command 'sort /dev/null -o /dev/stdout | cat' no longer fails with
  an "error truncating" diagnostic.
  [bug was introduced with coreutils-8.18 for sort and split, and
  (for shared memory objects only) with fileutils-4.1 for shred]
  sync no longer fails for write-only file arguments.
  [bug introduced with argument support to sync in coreutils-8.24]
  'tail -f file | filter' no longer exits immediately on AIX.
  [bug introduced in coreutils-8.28]
  'tail -f file | filter' no longer goes into an infinite loop
  if filter exits and SIGPIPE is ignored.
  [bug introduced in coreutils-8.28]
  * * Changes in behavior
  cksum, dd, hostid, hostname, link, logname, sleep, tsort, unlink,
  uptime, users, whoami, yes: now always process --help and --version options,
  regardless of any other arguments present before any optional '--'
  end-of-options marker.
  nohup now processes --help and --version as first options even if other
  parameters follow.
  'yes a -- b' now outputs 'a b' instead of including the end-of-options
  marker as before: 'a -- b'.
  echo now always processes backslash escapes when the POSIXLY_CORRECT
  environment variable is set.
  When possible 'ln A B' now merely links A to B and reports an error
  if this fails, instead of statting A and B before linking.  This
  uses fewer system calls and avoids some races.  The old statting
  approach is still used in situations where hard links to directories
  are allowed (e.g., NetBSD when superuser).
  ls --group-directories-first will also group symlinks to directories.
  'test -a FILE' is not supported anymore.  Long ago, there were concerns about
  the high probability of humans confusing the -a primary with the -a binary
  operator, so POSIX changed this to 'test -e FILE'.  Scripts using it were
  already broken and non-portable; the -a unary operator was never documented.
  wc now treats non breaking space characters as word delimiters
  unless the POSIXLY_CORRECT environment variable is set.
  * * New features
  id now supports specifying multiple users.
  'date' now supports the '+' conversion specification flag,
  introduced in POSIX.1-2017.
  printf, seq, sleep, tail, and timeout now accept floating point
  numbers in either the current or the C locale.  For example, if the
  current locale's decimal point is ',', 'sleep 0,1' and 'sleep 0.1'
  now mean the same thing.  Previously, these commands accepted only
  C-locale syntax with '.' as the decimal point.  The new behavior is
  more compatible with other implementations in non-C locales.
  test now supports the '-N FILE' unary operator (like e.g. bash) to check
  whether FILE exists and has been modified since it was last read.
  env now supports '--default-signal[=SIG]', '--ignore-signal[=SIG]', and
  '--block-signal[=SIG], to setup signal handling before executing a program.
  env now supports '--list-signal-handling' to indicate non-default
  signal handling before executing a program.
  * * New commands
  basenc is added to complement existing base64,base32 commands,
  and encodes and decodes printable text using various common encodings:
  base64,base64url,base32,base32hex,base16,base2,z85.
  * * Improvements
  ls -l now better aligns abbreviated months containing digits,
  which is common in Asian locales.
  stat and tail now know about the "sdcardfs" file system on Android.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  stat now prints file creation time when supported by the file system,
  on GNU Linux systems with glibc &gt;= 2.28 and kernel &gt;= 4.11.
- Refresh patches (line number changes only):
  * coreutils-disable_tests.patch
  * coreutils-i18n.patch
  * coreutils-misc.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils.spec:
  * Version: bump version.
  * URL: Use https scheme.
  * %description: Add 'basenc' tool.
  * Change gitweb to cgit URL with https in a comment.
- coreutils.keyring:
  * Update for added section headers ('GPG keys of &lt;MAINTAINER&gt;').</changelog>
  <changelog author="lnussel@suse.de" date="1568894400">- Do not recommend lang package. The lang package already has a
  supplements.</changelog>
  <changelog author="lnussel@suse.de" date="1578571200">- switch to multibuild
- add coreutils-single subpackage that contains a single binary coreutils tool
  similar to busybox
- package LC_CTIME directories also in lang package
- split off doc package
- remove info macros, handled by file trigger nowadays</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1579521600">- minor: remove obsolete comment in spec file.</changelog>
  <changelog author="lnussel@suse.de" date="1580212800">- disable single and testsuite builds in rings/staging
- remove duplicate "coreutils" in flavor to make it look nicer in OBS</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1583755200">- Update to 8.32:
  * Noteworthy changes in release 8.32 (2020-03-05) [stable]
  * * Bug fixes
  cp now copies /dev/fd/N correctly on platforms like Solaris where
  it is a character-special file whose minor device number is N.
  [bug introduced in fileutils-4.1.6]
  dd conv=fdatasync no longer reports a "Bad file descriptor" error
  when fdatasync is interrupted, and dd now retries interrupted calls
  to close, fdatasync, fstat and fsync instead of incorrectly
  reporting an "Interrupted system call" error.
  [bugs introduced in coreutils-6.0]
  df now correctly parses the /proc/self/mountinfo file for unusual entries
  like ones with '\r' in a field value ("mount -t tmpfs tmpfs /foo$'\r'bar"),
  when the source field is empty ('mount -t tmpfs "" /mnt'), and when the
  filesystem type contains characters like a blank which need escaping.
  [bugs introduced in coreutils-8.24 with the introduction of reading
  the /proc/self/mountinfo file]
  factor again outputs immediately when stdout is a tty but stdin is not.
  [bug introduced in coreutils-8.24]
  ln works again on old systems without O_DIRECTORY support (like Solaris 10),
  and on systems where symlink ("x", ".") fails with errno == EINVAL
  (like Solaris 10 and Solaris 11).
  [bug introduced in coreutils-8.31]
  rmdir --ignore-fail-on-non-empty now works correctly for directories
  that fail to be removed due to permission issues.  Previously the exit status
  was reversed, failing for non empty and succeeding for empty directories.
  [bug introduced in coreutils-6.11]
  'shuf -r -n 0 file' no longer mistakenly reads from standard input.
  [bug introduced with the --repeat feature in coreutils-8.22]
  split no longer reports a "output file suffixes exhausted" error
  when the specified number of files is evenly divisible by 10, 16, 26,
  for --numeric, --hex, or default alphabetic suffixes respectively.
  [bug introduced in coreutils-8.24]
  seq no longer prints an extra line under certain circumstances (such as
  'seq -f "%g " 1000000 1000000').
  [bug introduced in coreutils-6.10]
  * * Changes in behavior
  Several programs now check that numbers end properly.  For example,
  'du -d 1x' now reports an error instead of silently ignoring the 'x'.
  Affected programs and options include du -d, expr's numeric operands
  on non-GMP builds, install -g and -o, ls's TABSIZE environment
  variable, mknod b and c, ptx -g and -w, shuf -n, and sort --batch-size
  and --parallel.
  date now parses military time zones in accordance with common usage:
    "A" to "M"  are equivalent to UTC+1 to UTC+12
    "N" to "Y"  are equivalent to UTC-1 to UTC-12
    "Z" is "zulu" time (UTC).
  For example, 'date -d "09:00B" is now equivalent to 9am in UTC+2 time zone.
  Previously, military time zones were parsed according to the obsolete
  rfc822, with their value negated (e.g., "B" was equivalent to UTC-2).
  [The old behavior was introduced in sh-utils 2.0.15 ca. 1999, predating
  coreutils package.]
  ls issues an error message on a removed directory, on GNU/Linux systems.
  Previously no error and no entries were output, and so indistinguishable
  from an empty directory, with default ls options.
  uniq no longer uses strcoll() to determine string equivalence,
  and so will operate more efficiently and consistently.
  * * New Features
  ls now supports the --time=birth option to display and sort by
  file creation time, where available.
  od --skip-bytes now can use lseek even if the input is not a regular
  file, greatly improving performance in some cases.
  stat(1) supports a new --cached= option, used on systems with statx(2)
  to control cache coherency of file system attributes,
  useful on network file systems.
  * * Improvements
  stat and ls now use the statx() system call where available, which can
  operate more efficiently by only retrieving requested attributes.
  stat and tail now know about the "binderfs", "dma-buf-fs", "erofs",
  "ppc-cmm-fs", and "z3fold" file systems.
  stat -f -c%T now reports the file system type, and tail -f uses inotify.
  * * Build-related
  gzip-compressed tarballs are distributed once again
- Refresh patches:
  * coreutils-disable_tests.patch
  * coreutils-getaddrinfo.patch
  * coreutils-i18n.patch
  * coreutils-invalid-ids.patch
  * coreutils-remove_hostname_documentation.patch
  * coreutils-remove_kill_documentation.patch
  * coreutils-skip-gnulib-test-tls.patch
  * coreutils-tests-shorten-extreme-factor-tests.patch
- coreutils-i18n.patch:
  * uniq: remove collation handling as required by newer POSIX; see
  - https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=8e81d44b5
  - https://www.austingroupbugs.net/view.php?id=963
- coreutils-ls-restore-8.31-behavior-on-removed-dirs.patch:
  * Add patch for 'ls' to restore 8.31 behavior on removed directories.
- coreutils.spec:
  * Version: bump version.
  * %check: re-enable regular 'make check' for non-multibuild package.
  * reference the above new patch.
- coreutils.keyring:
  * Update from upstream (Savannah).</changelog>
  <changelog author="dmueller@suse.com" date="1588593600">- add coreutils-use-python3.patch to minimally port away from
  python 2.x use of pyinotify in the testsuite</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1592049600">- coreutils-gnulib-disable-test-float.patch: Add patch to temporarily
  disable the gnulib test 'test-float' failing on ppc and ppc64le.
- coreutils.spec: Reference the patch.  While at it, avoid conditional
  Patch and Source entries as that break cross-platform builds from
  source RPMs.</changelog>
  <changelog author="dimstar@opensuse.org" date="1594900800">- Drop suse-module-tools BuildRequires: this was used for the macro
  regenerate_initrd_post/posttrans, which have been moved to
  rpm-config-SUSE in Jan 2019.</changelog>
  <changelog author="mail@bernhard-voelker.de" date="1598875200">- gnulib-test-avoid-FP-perror-strerror.patch: Add patch to
  avoid false-positive error in gnulib tests 'test-perror2' and
  'test-strerror_r', visible on armv7l.
- coreutils.spec: Reference the patch.</changelog>
  <changelog author="lnussel@suse.de" date="1602849600">- prepare usrmerge (boo#1029961)</changelog>
</package>
<package pkgid="ec22da28c4cdbbf109f75d5900743be83947e1c5a2a4d3c82afe1a2600d5a48f" name="corosync" arch="aarch64">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="72036459a7b28e2485b6b0b9902673abae7d68bebdba07cc18f31befab272453" name="corosync" arch="ppc64le">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="367ef2a4f94e3ef5fb46d9652d0d6bd8e28acf3c2d21ceec71d7820dceda9347" name="corosync" arch="s390x">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="b1957a620f249eb2018d735d5689f4afd776de01bb7bc1e8ad27364e36141dbb" name="corosync" arch="src">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="ca7ac073bbc84a45cc2c12032a439f7d5a92884cd511bf781a150a6f12a27253" name="corosync" arch="x86_64">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="6d6ec089c2777a946ff1d040e9491f7e00b9bb614878587291f7442099168ee8" name="corosync-qdevice" arch="aarch64">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="fb55bc9da3a55fe59d8a73323e5d1b5a2dda5613a7192e9d45321d126d470159" name="corosync-qdevice" arch="ppc64le">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="87a6c6b22fa7775d130489a2b78754f7d41d314cb3f535c475b884c0a0d9e690" name="corosync-qdevice" arch="s390x">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="52da71abe0faf12451713fa405ccd9360caf30371940d0696b2ff12ad991c59c" name="corosync-qdevice" arch="x86_64">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="c38936913de62c9d3708f262ebef01f385355744ca0d848167ecb5b9a4006d4c" name="corosync-qnetd" arch="aarch64">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="e703ef31252931ab1482b12dc1398d39bcc88c104930fb9da2e71b596a0edefc" name="corosync-qnetd" arch="ppc64le">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="37c0b53516dcf575bb2b28b3523f0f0da21a7544c30e306f43992946ad050008" name="corosync-qnetd" arch="s390x">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="ac2988729d4cc1e16a052041c36b2643abc360cac69b402f6d90c5d07d7b3f65" name="corosync-qnetd" arch="x86_64">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="ea55447f0fde7cbb80206583766e89b295e9d1766ebfaf6dd17617cfcd31752c" name="corosync-testagents" arch="aarch64">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="f1bb890866fe497b429fb5d4cedaf627c5e23ace075dd3f160c2306459ef0634" name="corosync-testagents" arch="ppc64le">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="321d791f1f93511631c41889799a48f1725bf6ec8d08d7d8e8dd225e9d8990ba" name="corosync-testagents" arch="s390x">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="052860c721ef6dad914221b84e354c5aab6e3c58cfceef8c11bd0c40654f3d79" name="corosync-testagents" arch="x86_64">
  <version epoch="0" ver="2.4.5" rel="12.3.1"/>
  <changelog author="bliu@suse.com" date="1515067200">- issue with partial packets assembly when multiple nodes are sending big packets(bsc#1074929)
    Added: 0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch</changelog>
  <changelog author="bliu@suse.com" date="1515585600">- totemudp[u]: Drop truncated packets on receive(bsc#1075300)
    Added: 0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1517400000">- corosync exposes itself for a self-crash under rare circumstance(bsc#1078412)
    Added: 0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    Modified: remove unncessary git commit messages
    0001-coroapi-Use-size_t-for-private_data_size.patch
    0002-fix-ifdown-udp.patch
    0005-do-not-convert-empty-uid-gid-to-0.patch
    0008-wd-fix-snprintf-warnings.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch</changelog>
  <changelog author="bliu@suse.com" date="1520251200">- some coverity fixes for corosync on upstream(bsc#1083895)
    Added: 0015-coverity-fixes.patch</changelog>
  <changelog author="bliu@suse.com" date="1520510400">- [Build 489.1] Corosync is not working after upgrade from sle11sp4-ha to sle15-ha(bsc#1083561)
    Added: 0016-bsc#1083561-upgrade-from-1-x-y.patch</changelog>
  <changelog author="bliu@suse.com" date="1523361600">- UNKNOWN version in corosync pkg-config(bsc#1088619)
    Added: 0017-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1523620800">-  (CVE-2018-1084) VUL-0: CVE-2018-1084: corosync: Integer overflow in totemcrypto(bsc#1089346)
    Added: 0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch</changelog>
  <changelog author="bliu@suse.com" date="1523966400">- corosync-2.4.4 is available now(bsc#1089836)
    man:fix in corosync-qdevice.8
    quorumtool: remove duplicated help message
    cfg: nodeid should be unsigned int
    coroparse: Use readdir instead of readdir_r
    wd: fix snprintf warnings
    Fix compile errors in qdevice on FreeBSD
    qdevice: mv free(str) after port validation
    Fix various typos
    Fix typo: recomended -&gt; recommended
    man: support SOURCE_DATE_EPOCH
    configure: add --with-initconfigdir option
    Use static case blocks to determine distro flavor
    Use RuntimeDirectory instead of tmpfiles.d
    coroparse: Do not convert empty uid, gid to 0
    sam: Fix snprintf compiler warnings
    quorumtool: Use full buffer size in snprintf
    man: Add note about qdevice parallel cmds start
    sync: Remove unneeded determine sync code
    sync: Call sync_init of all services at once
    corosync.conf: publicize nodelist.node.name
    totemudp[u]: Drop truncated packets on receive
    logging: Make blackbox configurable
    logging: Close before and open blackbox after fork
    init: Quote subshell result properly
    blackbox: Quote subshell result properly
    qdevice: quote certutils scripts properly
    sam_test_agent: Remove unused assignment
    qdevice: Fix NULL pointer dereference
    quorumtool: Don't set our_flags without v_handle
    qdevice: Nodelist is set into string not array
    qdevice: Check if user_data can be dereferenced
    qdevice: Add safer wrapper of strtoll
    qdevice: Replace strtol by strtonum
    qnetd: Replace strtol by strtonum
    main: Set errno before calling of strtol
    totemcrypto: Implement bad crypto header guess
    cpg: Use list_del instead of qb_list_del
    totemcrypto: Check length of the packet
    totemsrp: Implement sanity checks of received msgs
    totemsrp: Check join and leave msg length
    totemudp: Check lenght of message to sent
    qdevice msgio: Fix reading of msg longer than i32
    logsys: Avoid redundant callsite section checking
    man: corosync-qdevice: fix formatting vs. punctuation
    man: corosync-qdevice: some more stylistics
    man: fix cpg_mcast_joined.3.in
    libcpg: Fix issue with partial big packet assembly
    totempg: Fix fragmentation segfault
    totempg: use iovec[i].iov_len instead of copy_len
    totempg: Fix corrupted messages
    cpg: Handle fragmented message sending interrupt
    corosync.aug: Add missing options
    systemd: Delete unnecessary soft_margin
    Added:
    corosync-2.4.4.tar.gz
    0010-qdevice-net-instance.c-optarg-should-be-str.patch
    Deleted:
    0007-sync-Call-sync_init-of-all-services-at-once.patch
    0008-wd-fix-snprintf-warnings.patch
    0009-add-config-for-corosync-qnetd.patch
    0010-qdevice-mv-free-str-after-port-validation.patch
    0011-libcpg-Fix-issue-with-partial-big-packet-assembly.patch
    0012-totemudp-u-Drop-truncated-packets-on-receive.patch
    0013-logging-Make-blackbox-configurable.patch
    0014-logging-Close-before-and-open-blackbox-after-fork.patch
    0015-coverity-fixes.patch
    0018-bsc#1089346-corosync-Integer-overflow-in-totemcrypto.patch
    corosync-2.4.3.tar.gz
    Renamed:
    0009-add-config-for-corosync-qnetd.patch -&gt; 0007-add-config-for-corosync-qnetd.patch
    0016-bsc#1083561-upgrade-from-1-x-y.patch -&gt; 0008-bsc#1083561-upgrade-from-1-x-y.patch
    0017-bsc#1088619-add-version.patch -&gt; 0009-bsc#1088619-add-version.patch</changelog>
  <changelog author="bliu@suse.com" date="1524744000">- NSS_NoDB_Init: the parameter is reserved, must be NULL(bsc#1090996)
    Added: 0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch</changelog>
  <changelog author="bliu@suse.com" date="1525262400">- cpg: Inform clients about left nodes during pause(bsc#1091593)
    Added: 0012-cpg-Inform-clients-about-left-nodes-during-pause.patch</changelog>
  <changelog author="yren@suse.com" date="1565956800">- corosync-2.4.5 upgrade(bsc#1144200)
  block_unlisted_ips block package from ips not in nodelist
  Qnetd now supports updated NSS database format
  Partly fixed problem with ifdown (only for UDPU)
  Added:
  corosync-2.4.5.tar.gz
  bug-1001164_corosync.conf-example.patch
  corosync-init-lockfile-path-error.patch
  Deleted:
  corosync-2.4.4.tar.gz
  0003-fix-tmpfiles-create.patch
  0004-mark-corosync-as-a-static-service.patch
  0005-do-not-convert-empty-uid-gid-to-0.patch
  0007-add-config-for-corosync-qnetd.patch
  0009-bsc#1088619-add-version.patch
  0010-qdevice-net-instance.c-optarg-should-be-str.patch
  0011-NSS_NoDB_Init-the-parameter-is-reserved-must-be-NULL.patch
  0012-cpg-Inform-clients-about-left-nodes-during-pause.patch
  bnc#872651-stop-cluster.patch
  disable-build-html-docs.patch
  Renamed:
  0001-coroapi-Use-size_t-for-private_data_size.patch -&gt; upstream-afd97d7884940_coroapi-Use-size_t-for-private_data_size.patch
  0006-Fix-compile-warnings-with-GCC-7.2.1.patch -&gt; Fix-compile-warnings-with-GCC-7.2.1.patch
  0008-bsc#1083561-upgrade-from-1-x-y.patch -&gt; bug-1083561_upgrade-from-1-x-y.patch
  bnc#882449-corosync-conf-example.patch -&gt; bug-882449_corosync-conf-example.patch
  0002-fix-ifdown-udp.patch -&gt; bug-1032634_fix-ifdown-udp.patch
  bsc#1001164-corosync.conf-example.patch -&gt; bug-1001164_corosync.conf-example.patch</changelog>
  <changelog author="yren@suse.com" date="1570622400">- Replace corosync-2.4.5.tar.gz with a clean source.tar.gz(bsc#1144200)
  The reason is some binaries left in corosync-2.4.5.tar.gz</changelog>
  <changelog author="yren@suse.com" date="1573128000">- Packaging bug updating Corosync(bsc#1155792)
  Some noisy output from Tumbleweed caused by RPM macro not fairly used
  Make sure corosync sysconfig keep original configured firstly(bsc1153502)
  Store the tmp file to a more security directory</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1578052800">- Don't package sysconfig file in tmpfiles.d, it's a bug. Instead correctly
  add it to /etc/sysconfig, invoking fillup accordingly.</changelog>
  <changelog author="XLiang@suse.com" date="1584532800">- Fix bsc#1166899, return value of "corosync-quorumtool -s" was not correct
  Added: bug-1166899-quorumtool-Fix-exit-status-codes.patch</changelog>
  <changelog author="XLiang@suse.com" date="1584705600">- Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch</changelog>
  <changelog author="XLiang@suse.com" date="1587556800">- Revoke the patch bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Deleted: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: That path will cause problems while doing rolling upgrade, see bsc#1168771</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Stop mangling libexecdir: it's not needed at all.</changelog>
  <changelog author="aburlakov@suse.com" date="1603800000">- (Again) Fix bsc#1163460 Corosync does not support link-local IPv6 addresses
  Added: bug-1163460-totemip-Add-support-for-sin6_scope_id.patch
  Reason: This time the path will NOT cause problems when doing rolling
    upgrade, see bsc#1168771</changelog>
  <changelog author="emil.penchev@suse.com" date="1629806400">- corosync totem: bsc#1189680, Add cancel_hold_on_retransmit config option
  Added: bsc#1189680-cancel_hold_on_retransmit-option.patch</changelog>
</package>
<package pkgid="405a63cad53edff669512008fea1efe900e3af21adcc1e1e5f9118263e6f817d" name="cpio" arch="aarch64">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="c71e1400514866d1813aeee7bd248de897c57c3ece905375ecf0e6eaea58e9cd" name="cpio" arch="ppc64le">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="f141c93339f2837263be88bd4293ba61e1fd53f0e0d7695e4d8f60a4a82b0687" name="cpio" arch="s390x">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="a1463a783e7b960ba6e721cf7c52eda1ec7db8858e4e4adefe956c7926045c44" name="cpio" arch="src">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="mmeister@suse.com" date="1363867200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="vcizek@suse.com" date="1374580800">- add a missing fix from SLE for bnc#830779 (original bug bnc#658031)
  added paxutils-rtapelib_mtget.patch</changelog>
  <changelog author="vcizek@suse.com" date="1405598400">- prevent cpio from extracting over a symlink (bnc#658010)
  * added cpio-check_for_symlinks.patch</changelog>
  <changelog author="vcizek@suse.com" date="1406635200">- fix a truncation check in mt
  * added cpio-fix_truncation_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1408622400">- drop cpio-dir_perm.patch
  * no longer needed since 2.11
  * it was dropped from Fedora too and only caused problems (bnc#889138)</changelog>
  <changelog author="jengelh@inai.de" date="1409313600">- Improve on RPM group classification (cpio does not compress
  on its own per se)
- Remove redundant %clean section</changelog>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="60572427e5ef998f4f392dbe6e7e3c6ddb15adc645991fab2a23a6696f15a568" name="cpio" arch="x86_64">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="ebb872d1b2c8bfa9edbc0858187d5eb9724cbeecd10fc482d470f1e1c1740506" name="cpio" arch="aarch64">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="9ea0a75ffcf11d12bba0dc1c6a2c0a94702b58c3757b884c817f7c3621292246" name="cpio" arch="ppc64le">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="48b3f77c9989d3dbd20b621133d95b51bb3c388443231ae876348ec171d3c515" name="cpio" arch="s390x">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="94b41ef1217239cd0caf5d1c80abcf85b00301051b5a4440348fd3e646788057" name="cpio" arch="src">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1374580800">- add a missing fix from SLE for bnc#830779 (original bug bnc#658031)
  added paxutils-rtapelib_mtget.patch</changelog>
  <changelog author="vcizek@suse.com" date="1405598400">- prevent cpio from extracting over a symlink (bnc#658010)
  * added cpio-check_for_symlinks.patch</changelog>
  <changelog author="vcizek@suse.com" date="1406635200">- fix a truncation check in mt
  * added cpio-fix_truncation_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1408622400">- drop cpio-dir_perm.patch
  * no longer needed since 2.11
  * it was dropped from Fedora too and only caused problems (bnc#889138)</changelog>
  <changelog author="jengelh@inai.de" date="1409313600">- Improve on RPM group classification (cpio does not compress
  on its own per se)
- Remove redundant %clean section</changelog>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="fb1b6b933087cd9f0d95349904d3d4b0725e586c042548508f2d5c1b3fbf9d39" name="cpio" arch="x86_64">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="1b6d6b47ab1e6ee6078c54658134229e6f27b203cf2ecadbfc0b33f7000ad950" name="cpio" arch="aarch64">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="9870d52724a81340a2da2e634029243f950017dcbcdca9c71cc7d26e8d869c10" name="cpio" arch="ppc64le">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="c3620f8cd5e083b86f5b47b439c60c6504bc3bfa0fec17d63a429aa1058e9cc9" name="cpio" arch="s390x">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="6c06a227f720d1286833269fe2b723950843985d9261e0ddfaa575255390ae81" name="cpio" arch="src">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1405598400">- prevent cpio from extracting over a symlink (bnc#658010)
  * added cpio-check_for_symlinks.patch</changelog>
  <changelog author="vcizek@suse.com" date="1406635200">- fix a truncation check in mt
  * added cpio-fix_truncation_check.patch</changelog>
  <changelog author="vcizek@suse.com" date="1408622400">- drop cpio-dir_perm.patch
  * no longer needed since 2.11
  * it was dropped from Fedora too and only caused problems (bnc#889138)</changelog>
  <changelog author="jengelh@inai.de" date="1409313600">- Improve on RPM group classification (cpio does not compress
  on its own per se)
- Remove redundant %clean section</changelog>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="b2b05c7ab03a280649a9f626be1417484e0fb6bda0592a1a37b2d244acf436e4" name="cpio" arch="x86_64">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="e5ec0d483131f0e17365cb2751881147db995fc638c27376d5bcad8a46273114" name="cpio-lang" arch="noarch">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="c4357fc0a2a705512b2f52ede5a321cbda7b0faaedc265d0951846eb6fd17348" name="cpio-lang" arch="noarch">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="25ac5fd9e197a54daf1e3b422bb730ba5ca67b8561c58427e2f8b0007fde13f1" name="cpio-lang" arch="noarch">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="7fb147b457cf8455e8bd83e32c42839cc9b1fbd18dd7d66622567e918ca31bcd" name="cpio-mt" arch="aarch64">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="6ed87ca8a5a93baac2a83ed60876a4beb1e9bb080f604d7d7a1f721b01f4ebe4" name="cpio-mt" arch="ppc64le">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="ce58d1911847aeeb17c77094aadc022778e79ff811be17b75a4491964a16c9d2" name="cpio-mt" arch="s390x">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="0469e79207869feac6a9f8e57049a7e9ed521bed69be4af5dfc65376f704a2ec" name="cpio-mt" arch="x86_64">
  <version epoch="0" ver="2.12" rel="3.6.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
</package>
<package pkgid="80a6a1074ecd2a79e261eeca31d7fc7dcb37252ee85479f8fc8a4b4b11c2b247" name="cpio-mt" arch="aarch64">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="c81ecb250b391c463dcc90e3cb655eb9f197b19d65d486477742e410e2c401a4" name="cpio-mt" arch="ppc64le">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="29d191062d95c1850a8ab670e99eaf43fd565b53e276277cc54b715ccdad83b7" name="cpio-mt" arch="s390x">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="952243a8cacaffa835fe1ddb2fdbf3628eb9b25111f9314bb994924cd925276d" name="cpio-mt" arch="x86_64">
  <version epoch="0" ver="2.12" rel="3.6.2"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
</package>
<package pkgid="af67fe2d47055ad58e3252f10cb361fdc60110d91a291cf6a088aa99e208f212" name="cpio-mt" arch="aarch64">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="b34340235775d92f246225a8686bce0adefcf8e4aab22144a706e75984aae8ff" name="cpio-mt" arch="ppc64le">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="7047e8e642232e6c37c5891652a1b809695769b442880003efe5872817da260c" name="cpio-mt" arch="s390x">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="6d6ef151b01711613324f7b89540c76b5cca8c7b21e17914f20c3144d224ceeb" name="cpio-mt" arch="x86_64">
  <version epoch="0" ver="2.12" rel="3.9.1"/>
  <changelog author="vcizek@suse.com" date="1417435200">- fix an OOB write with cpio -i (bnc#907456) (CVE-2014-9112)
  * added 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch</changelog>
  <changelog author="meissner@suse.com" date="1420113600">- build with PIE</changelog>
  <changelog author="mpluskal@suse.com" date="1426507200">- Add gpg signature
- Correct info scriplet dependencies
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1444305600">- update to 2.12
  * Improved documentation
  * Manpages are installed by make install
  * New options for copy-out mode: --ignore-devno,
  - -renumber-inodes, --device-independent, --reproducible
  * update
  * cpio-use_new_ascii_format.patch
  * cpio-mt.patch
  * cpio-eof_tape_handling.patch
  * cpio-pattern-file-sigsegv.patch
  * cpio-check_for_symlinks.patch
  * remove (no longer needed)
  * cpio-stdio.in.patch
  * 0001-Fix-memory-overrun-on-reading-improperly-created-lin.patch
  * add
  * cpio-2.12-util.c_no_return_in_nonvoid_fnc.patch to add missing
    return to the nonvoid get_inode_and_dev() function
- use spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1455883200">- add cpio-2.12-out_of_bounds_write.patch to fix an out of bounds
  write in a way cpio parses certain cpio files [bsc#963448],
  [CVE-2016-2037]</changelog>
  <changelog author="svalx@svalx.net" date="1457006400">- Disable mt building: this binary from mt_st package offers
  advanced capabilities with the same functionality.
- Enable rmt building: 'dump' package no longer include it, besides
  cpio code base for rmt is more fresh.
- Reflect those changes in the package description.</changelog>
  <changelog author="kstreitova@suse.com" date="1457006401">- fix typos in the description
- add 'Require: mt_st' in order not to surprise users by the missing
  'mt' binary</changelog>
  <changelog author="mpluskal@suse.com" date="1457179200">- Recommend mt_st as it is not hard dependency</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="svalx@svalx.net" date="1490356800">- Enable mt building
- Separated cpio-mt subpackge
- Change recommend to own mt subpackge
- Remove cpio-mt.patch - those features available in original mt-st package
- Switch to use alternatives system for mt
- Disable rmt building: this binary fully identical to rmt from tar
- Change default rmt dir to /usr/bin</changelog>
  <changelog author="mpluskal@suse.com" date="1490616000">- Use macro for configure and make install
- Use update-alternatives according to current documentation
- Enable testsuite</changelog>
  <changelog author="kstreitova@suse.com" date="1491912000">- modify cpio-2.12-out_of_bounds_write.patch to fix a regression
  causing cpio to crash for tar and ustar archive types
  [bsc#1028410]</changelog>
  <changelog author="kstreitova@suse.com" date="1572868800">- add cpio-2.12-CVE-2019-14866.patch to fix a security issue where
  cpio does not properly validate the values written in the header
  of a TAR file through the to_oct() function [bsc#1155199]
  [CVE-2019-14866]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628510400">- Fix CVE-2021-38185 Remote code execution caused by an integer overflow in ds_fgetstr
  (CVE-2021-38185, bsc#1189206)
  * fix-CVE-2021-38185.patch</changelog>
  <changelog author="sflees@suse.de" date="1629115200">- Fix regression in last update (bsc#1189465)
  * fix-CVE-2021-38185_2.patch</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629288000">- Add another patch to fix regression (bsc#1189465)
  * fix-CVE-2021-38185_3.patch</changelog>
</package>
<package pkgid="d5735e5c1635160fc64cd8755943ddc75c15d5e6f76837bb25d71030dff0c5f4" name="cpp" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="9233ae3a335b2132ddf7d75693ca1416a2d34bb840b5b8f8baf383523bd1ebcf" name="cpp" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="49398aa7d55893bb47f09c9d6f8d8919a62838057144320f270a3d2ce69fc1a2" name="cpp" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="980aa013f1973bd3585afe0802e6ec0fdb9d7dca03b60dd9f704056b1f78aa07" name="cpp" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="e980b2dfed0838af25b218fc90c0babb3ab5d9315a4a0883536ca36967557a37" name="cpp" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="5a4a33aeb435f7c8907864e00798e39482ad4b253dc2544dd1376f0060cafb2b" name="cpp" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="52812722885b9739e76afc28622c39ebfe2c6570de736b4d1e1fb18e609e6390" name="cpp" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="6abda6fd68cb3ced5cc29be7baa25df9071aaacb012694ba4321267d5594241c" name="cpp" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="e53e0b0c96fbba03c6a3fc8b19967b3ae9c13757e6ea0f6a18243e460e8510ae" name="cpp10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="af4f7c1ffaae6824b9a99c67e8cdd3a3121d79e29f125adcd724b41daac8a743" name="cpp10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="9f1ba442fc57814b7317375ca1f1f56af0c100d67a923e440ec70b563df966ef" name="cpp10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="154daf68c1602511cf8db63e5af58d278d083ae6259c7c4969b450ccb0f34356" name="cpp10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="4ccb6b8992982cc4fdf126a895737db173e4f3f64d8bf1e2a0074c06966cec66" name="cpupower" arch="aarch64">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="ff18b4cbaacb8493a3daac70b029b069656b62b392fe7dd01b72326208a9e7c1" name="cpupower" arch="ppc64le">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="5aada751abcbdfd07eedac99b651c4efa72f35d67cfb1d272d6f726dc2c2c832" name="cpupower" arch="s390x">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="863588fe2f4815fef102bef050213f606a83c88993cb9632e5a474a2dd48971c" name="cpupower" arch="src">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="2dcf6c030284e764da8faf1f5aee51cafebf4135967249df4925bf2936aaec5a" name="cpupower" arch="x86_64">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="f3f0fd4753491bbdd5afb445b09a0f7ee13835a18b45f5c30e6a6b6ae777d177" name="cpupower-bench" arch="aarch64">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="d719768d6a742dd8e6492809ff6c3aa628c55ea4e06d5207dbfa2b0af50915ff" name="cpupower-bench" arch="ppc64le">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="7d73c72ee81697ce681aa04954331d9f77d585ab79980d7962d68f961f5b7cda" name="cpupower-bench" arch="s390x">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="4967e9c38218d1425fcec908365984548e97dbc83191659d2265105ec225e065" name="cpupower-bench" arch="x86_64">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="73ca1cf42ba103a8633baeda8d55c662caf34b16f4dc39c858829ca37a9f6e0e" name="cpupower-devel" arch="aarch64">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="9a85aa3289f5d5741fcace4fcec421fc76dd101a6277139485a36aaa2447fe90" name="cpupower-devel" arch="ppc64le">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="357c38f2d3cf1fc47f6c579fe095a8092b0e2ed0a3057769ac3d2de503b7e137" name="cpupower-devel" arch="s390x">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="2ba4cf33d5ec348024d63898904fb1af5573bcf788c9a37ef409d9e83cb64013" name="cpupower-devel" arch="x86_64">
  <version epoch="0" ver="5.10" rel="3.3.1"/>
  <changelog author="trenn@suse.de" date="1508500800">fate#321274
- Provide rapl domain info (cpupower powercap-info cmd)
  * Add: cpupower_rapl.patch
- Provide rapl power monitoring
  * Add: rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1515499200">- Add x86_energy_perf_bias tool
  This is a tool which is, same as turbostat, located in kernel sources here:
  tools/power/x86/
  A x86_energy_perf_policy-17.05.11.tar.bz2
  A x86_perf_fix_man_permissions.patch
  A x86_perf_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1515672000">- Update cpupower to latest kernel version (version name 4.15, but
  checked out against latest kernel tag 4.15-rc7. There will not
  be important changes any more, maybe a fix).
- cpu online/offline fixes
- This is the first cpupower package (with updated version) which
  includes x86_energy_perf_policy binary.
  This is important for later package dependencies, namely tuned.
  A cpupower_exclude_kernel_Makefile.patch</changelog>
  <changelog author="trenn@suse.de" date="1538395200">- Updating to latest 4.19(-rc6) kernel sources
  Turbostat is increased to version 18.07.27 by this
  Patches which got deleted because they are now mainline:
  D    turbostat_decode_MSR_IA32_MISC_ENABLE_only_on_Intel.patch
  D    turbostat_fix_man_perm.patch
  D    x86_perf_fix_man_permissions.patch</changelog>
  <changelog author="trenn@suse.de" date="1539691200">- Fix static compilation and sysfs_read_file mess
  A cpupower_fix_compilation_and_sysfs_read_file_mess.patch</changelog>
  <changelog author="trenn@suse.de" date="1543924800">- Add bash completion for cpupower command (from mainline submit)
  A cpupower_bash-completion_for_cpupower_tool.patch</changelog>
  <changelog author="idonmez@suse.com" date="1544097600">- Run spec-cleaner
- Don't disable as-needed, it works now.</changelog>
  <changelog author="jengelh@inai.de" date="1544097601">- Description updates.</changelog>
  <changelog author="trenn@suse.de" date="1554724800">- Update to latest kernel HEAD sources
  (5.1-rc4, 15ade5d2e7775667cf191cf2f94327a4889f8b9d)
  Patches included mainline:
  D cpupower_fix_compilation_and_sysfs_read_file_mess.patch
  D cpupower_bash-completion_for_cpupower_tool.patch
  Adjusted patches:
  M turbostat_makefile_fix_asm_header.patch
  M x86_perf_makefile_fix_asm_header.patch
  M rapl_monitor.patch
  M cpupower_rapl.patch</changelog>
  <changelog author="trenn@suse.de" date="1559736000">- jira#5244 Turbostat for Ice Lake
- Remove very old cpufrequtils provides and requires (predecessor)
- Update libcpupower description
- Sidenote about fate#321274 - This feature is on the kernel side
  and got wrongly mentioned in cpupower in a released product.</changelog>
  <changelog author="trenn@suse.de" date="1563364800">- Add intel-speed-select tool (jsc#SLE-5364)
  A intel-speed-select-1.0.tar.bz2
  A intel-speed-select_remove_DATE_TIME.patch
- Fix missing governors when running cpupower frequency-info (bsc#1117709)
  M rapl_monitor.patch</changelog>
  <changelog author="trenn@suse.de" date="1572350400">- Update turbostat to latest version 19.08.31</changelog>
  <changelog author="trenn@suse.de" date="1574942400">- Update intel-speed-select to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit b3abfd778bf1dbdd
- Update cpupower to latest 5.5-rc1 kernel version
  latest mainline commit:
  commit 4611a4fb0cce3
  Fixes aperf/mperf monitoring on latest AMD Rome CPUs (bsc#1152967)
- Fix library API breakage (bsc#1154240)
  A libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch</changelog>
  <changelog author="trenn@suse.de" date="1580385600">- Add mainline patch with proper patch header and filename:
  D libcpupower_fix_api_cpufreq_get_frequencies_breakage.patch
  A cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
- Fix manpage (bsc#1162142)
  A Correction-to-manpage-of-cpupower.patch</changelog>
  <changelog author="trenn@suse.de" date="1583409600">- Do not show 0 boost states if boost states are supported, but could
  not be read from PCI registers.
  bsc#1165712, bsc#1164983
  A amd_do_not_show_amount_of_boost_states_if_zero.patch</changelog>
  <changelog author="trenn@suse.de" date="1589889600">- Update to latest:
  turbostat 20.03.20
  intel-speed-select 1.3  (bsc#1171810)
  verions
- Adjust needed kernel and userspace requirements in:
  cpupower_export_tarball_from_git.sh
  and
  BuildRequires: libcap-devel
  A remove_bits_h.patch</changelog>
  <changelog author="info@paolostivanin.com" date="1592395200">- Add -fcommon to allow building against GCC10</changelog>
  <changelog author="trenn@suse.de" date="1602763200">- Update intel-speed-select to version 1.6 (jsc#SLE-13334)</changelog>
  <changelog author="trenn@suse.de" date="1605182400">- Add AMD Fam 19h support (bsc#1177394)
  D tools-power-turbostat-Support-AMD-Family-19h.patch
  Already included  in the mainline sources now
- Update turbostat to latest version 20.09.30 including:
  * jsc#SLE-13412, jsc#SLE-13174 (rocket lake support)
  * jsc#SLE-13448 (Alder Lake support)
  * jsc#SLE-13348, jsc#SLE-13171 (Sapphire Rapid support)
  * Support AMD Fam 19h
- Touched patches:
  Deleted mainline integrated patches:
  D    Correction-to-manpage-of-cpupower.patch
  D    cpupower-Revert-library-ABI-changes-from-commit-ae2917093fb60bdc1ed3e.patch
  Patches refreshed:
  M    rapl_monitor.patch
  M    turbostat_makefile_fix_asm_header.patch</changelog>
  <changelog author="trenn@suse.de" date="1624276800">- jsc#SLE-17797 cpupower updates for Milan
  All patches have been fetched from mainline git repo:
  A    cpupower-Add-CPUPOWER_CAP_AMD_HW_PSTATE-cpuid-caps-flag.patch
  A    cpupower-Add-cpuid-cap-flag-for-MSR_AMD_HWCR-support.patch
  A    cpupower-Condense-pstate-enabled-bit-checks-in-decode_pstates.patch
  A    cpupower-Correct-macro-name-for-CPB-caps-flag.patch
  A    cpupower-Remove-family-arg-to-decode_pstates.patch
  A    cpupower-Remove-unused-pscur-variable.patch
  A    cpupower-Update-family-checks-when-decoding-HW-pstates.patch
  A    cpupower-Update-msr_pstate-union-struct-naming.patch</changelog>
</package>
<package pkgid="6969ee64c5eba6f2a7e7d3b162dd750caa95eed34a50c97811eaa531b46f5c17" name="crash" arch="aarch64">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="307a3d1a63f50d681f771b770b8189a6bcf5e06b3b1a90e992c1b38e2d1a7f2c" name="crash" arch="ppc64le">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="3e77e014a47fff3abae4dae22803695a35be77172f14791c4d99b45df840cad4" name="crash" arch="s390x">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="6d45f3d9ad82f35e1b857b8fc7426d2851cdc8d86858cc30f41a06b2b8c102ca" name="crash" arch="src">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="12fb3c278b4f33057536ebb149198abdb17d08ffc0105d05b20ea5edbb272269" name="crash" arch="x86_64">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="eef9c89239a30d349c480f6407e4ddaf92e722194569564cd2437bddfe3806ae" name="crash-devel" arch="aarch64">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="bbda65b7907331a6b342a656a9cf9a777e44d15bba2a723341f0dbc4d2d29dfe" name="crash-devel" arch="ppc64le">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="1a213a677e5159c390b05ae90f2670d6a9db8ba293abdc36c1f5b97458a60eb8" name="crash-devel" arch="s390x">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="c3c99a77eb21174a5839421fb04e4979a8429a7a6d14869e553e48f45c90b5b6" name="crash-devel" arch="x86_64">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="08fade6a223041fee54727cc7df5191ad71fc3799d46419dba8108deba77d797" name="crash-doc" arch="aarch64">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="d74b4d33723beb3a0741f3edd6d4f8212e93eb7a3ad8c2d4ddb3576ade4b73cb" name="crash-doc" arch="ppc64le">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="4c595a83011e8828f4218f4cdc276c1fde5a22d66213e3135296d7d68ee8810f" name="crash-doc" arch="s390x">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="1243871576fa963e167c7db8f05725ff705fc7e556876d37c2d0d43ab879f069" name="crash-doc" arch="x86_64">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="f032722e33a7996a803283bd060c4acb1557819f89047ba5be9ecb1724c3cd05" name="crash-eppic" arch="aarch64">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="0997886134b7b4948440db0b95a18553bf647035fd01978bdda0073426a8cbbc" name="crash-eppic" arch="ppc64le">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="86fb511f687be35763ff9516506b11e76a56608db9940aabcfa2c4e4445e5c2d" name="crash-eppic" arch="s390x">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="4fcdd834c7768d4b14e8dd472f59ab5592b468f0023c4a49e499b04877322c96" name="crash-eppic" arch="x86_64">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="f2f1948376d01a188e16cbca11adb9d30d9f7270f18c4260106aa803ba621f06" name="crash-gcore" arch="x86_64">
  <version epoch="0" ver="7.2.9" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="46ec5005d1eb3d360ab75bf2391501445441dd9d291bd45feb25d0b5518015b4" name="crash-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="7.2.9_k5.3.18_59.16" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="f11a92a0f5717154ab78164aba7540d6aab1abbb412f751705a5da6acf5caec5" name="crash-kmp-default" arch="aarch64">
  <version epoch="0" ver="7.2.9_k5.3.18_59.16" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="7c62974bd1681a1eefcb986afd9db982b55fb049b98195e12cb106b7a0779ddd" name="crash-kmp-default" arch="ppc64le">
  <version epoch="0" ver="7.2.9_k5.3.18_59.16" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="0128b902300d6f3ad79d4cb4307eb8146183cd490ca7fa9ded67a477ded61a50" name="crash-kmp-default" arch="s390x">
  <version epoch="0" ver="7.2.9_k5.3.18_59.16" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="366b33addeb58117de29417c12d1edf133d38eaca0a0255d73ae1573891e6af2" name="crash-kmp-default" arch="x86_64">
  <version epoch="0" ver="7.2.9_k5.3.18_59.16" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="6cc7cded06563d43603a88ecc8bbccc632d5a5cdb643fa4cc8214e2dbb22d1eb" name="crash-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="7.2.9_k5.3.18_59.16" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="55076167b69f878857541187131b0d51d5b6211efa0c837981619d0c781b04ae" name="crash-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="7.2.9_k5.3.18_59.16" rel="23.5.3"/>
  <changelog author="msuchanek@suse.de" date="1586347200">- Add crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  Fix "kmem -[sS]" for caches created during SLUB bootstrap (bsc#1164815 ltc#182973).</changelog>
  <changelog author="msuchanek@suse.com" date="1587124800">- Drop crash-s390-autodetect-kaslr.patch which has been merged in 7.2.7.</changelog>
  <changelog author="msuchanek@suse.com" date="1587211200">- Make Factory ppc64 crash usable on both SLE 15 SP1 and releases before
  SLE15 SP1 (bsc#1148197).  This is only a workaround that requires to build
  crash for each codestream separately.</changelog>
  <changelog author="ptesarik@suse.com" date="1588075200">- Add crash-Define-fallback-PN_XNUM.patch
  Add a fallback PN_XNUM definition.</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1588766400">- remove bypass lto and add -mfull-toc for ppc64le to check boo#1146646</changelog>
  <changelog author="ptesarik@suse.com" date="1599134400">- Always build crash KMPs.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220800">- Add crash-fix-memory_driver-build-kernel-5.8.patch
  Fix memory driver build failure with kernels 5.8+.</changelog>
  <changelog author="ptesarik@suse.com" date="1599220801">- Add eppic-remove-duplicate-symbols.patch
  Fix eppic extension build.</changelog>
  <changelog author="dmair@suse.com" date="1599652800">- Add crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  In calls to search a stack for x86_64 exceptions a flag is used
  to request the stack be verified for room to contain saved
  registers. The verify is not performed if other flags are used
  in the same call. Fixing this exposes another bug where only a
  kernel stack is verified anyway, even if the exception is being
  searched for on a userspace stack. Patch fixes both problems.
  (bsc#1162297)</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1602244800">- Fix build on aarch64:
  crash-gdb-fix-aarch64.patch</changelog>
  <changelog author="dmair@suse.com" date="1607342400">- Corrected project URL in spec file to match the changed upstream
  location as-of May 30th 2020.
  Noted the project URL change in README.SUSE without removing the old URL
  because it represents the location the project source was obtained from.
  The next project source update is available from the new project URL. When
  the package is updated with that source all URL project references will be
  modified to only show the new URL.
  Add crash-update-whitepaper-URL.patch
  Note change of no longer valid old project whitepaper URL to current valid
  project whitepaper URL in help output. Leave the old one reported because it
  represents the location the project source was obtained from for this
  package version.
  (bsc#1179536)</changelog>
  <changelog author="msuchanek@suse.de" date="1609934400">- Fix "kmem -i" option on Linux 5.9-rc1 and later kernels (bsc#1179970 ltc#188981).
  crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
- Fix crash utility is taking forever to initialize a vmcore from large config
  system (bsc#1178827 ltc#189279).
  crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch</changelog>
  <changelog author="msuchanek@suse.de" date="1610971200">- Update arm64 support (boo#1169099).
  crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  crash-Several-fixes-for-ARM64-kernels.patch
  crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
  crash-arm64-update-mapping-symbol-filter-in-arm64_verify_s.patch
  crash-Fix-segmentation-fault-when-ikconfig-passed-nonstand.patch</changelog>
  <changelog author="jbohac@suse.com" date="1611835200">- Added crash-xen-increase-__physical_mask_shift_xen-to-52.patch
  (bsc#1177050)</changelog>
  <changelog author="mwilck@suse.com" date="1615377600">- Install and ship the small built-in extensions snap.so, trace.so,
  and dminfo.so. "trace.so" is particularly useful.
  Ship them in the main "crash" package, as they are small.</changelog>
  <changelog author="pmladek@suse.com" date="1616673600">- Upgrade to version 7.2.9:
  * x86_64: Add support for new divide_error name
  * calc_kaslr_offset: 5-level paging support
  * Append time zone to output of date and time
  * s390dbf: support s390 debug feature version 3
  * x86_64: Add support for 1GB huge pages to "vtop" command
  * Implement support for user-space zram reads on x86_64
  * Prepare for the introduction of ARM64 8.3 Pointer Authentication
  * New "log -T" option
  * New ARM64 "--machdep vabits_actual=&lt;value&gt;" command line option
  * Enhancement of the "struct -r" option
  * Enhancement of the "bpf -p|-P" options
  * New "extend -s" option
- Dropped the following patches obsoleted by the version upgrade:
  * crash-Fix-for-reading-compressed-kdump-dumpfiles-from-syst.patch
  * crash-Fix-kmem-i-option-on-Linux-5.9-rc1-and-later-kernels.patch
  * crash-Fix-to-allow-the-translation-of-ARM64-FIXMAP-address.patch
  * crash-Introduce-a-new-ARM64-machdep-vabits_actual-value-co.patch
  * crash-Prepare-for-the-introduction-of-ARM64-8.3-Pointer-Au.patch
  * crash-Several-fixes-for-ARM64-kernels.patch
  * crash-arm64-Change-tcr_el1_t1sz-variable-name-to-TCR_EL1_T.patch
  * crash-fix-kmem-sS-for-caches-created-during-SLUB-bootstrap.patch
  * crash-fix-memory_driver-build-kernel-5.8.patch
  * crash-gdb-fix-aarch64.patch
  * crash-task.c-avoid-unnecessary-cpu-cycles-in-stkptr_to_tas.patch
  * crash-update-whitepaper-URL.patch
  * crash-verify-exception-frame-accessible-for-all-verify-requests.patch
  * crash-xendump-fix-failure-to-match-arm-aarch64-elf-format-.patch
- Support the lockless printk ringbuffer added into kernel-5.10 (bsc#1183965)
  * crash-printk-add-support-for-lockless-ringbuffer.patch
  * crash-printk-use-committed-finalized-state-values.patch</changelog>
  <changelog author="msuchanek@suse.com" date="1617710400">- Crash KMPs cannot be always built.</changelog>
  <changelog author="msuchanek@suse.com" date="1617883200">- Add back some more missing KMP conditionals
- Refresh crash-sles9-time.patch
  * fix warning: format '%ld' expects argument of type 'long int', but argument 3 has type 'int'</changelog>
  <changelog author="msuchanek@suse.com" date="1619438400">- Fix bt command with SEV-ES (bsc#1185209)
  + crash-x86_64-VC-exception-stack-support.patch</changelog>
  <changelog author="dmair@suse.com" date="1625140800">- Kernel commit 5c83511bdb9832c86be20fb86b783356e2f58062 removed
  pv_init_ops, and commit 054ac8ad5ebe4a69e1f0e842483821ddbe560121
  removed the Xen-specific paravirt patch function. As a result,
  pvops Xen dumps are no longer recognized as Xen dumps, and
  virtual-to-physical translation fails.
  Use the value of xen_start_info to determine whether the kernel
  is running in Xen PV mode. As suggested by Juergen Gross.
  (bsc#1187634)
  + crash-xen-pvops.patch</changelog>
</package>
<package pkgid="9e5b481d1a904fe010168ce24ea430e32b0e5558a11d1104b7057f01e5e31e3d" name="createrepo_c" arch="aarch64">
  <version epoch="0" ver="0.16.0" rel="3.3.1"/>
  <changelog author="ngompa13@gmail.com" date="1533124800">- Update to 0.11.1
  + Add support for RPMs with large files
  + Identify Requires(missingok) as Recommends correctly
  + Enable legacy tags by default
  + Fix missing packages in mergerepo_c with multiple VR of same name
  + Add mergerepo_c --repo-prefix-search and --repo-prefix-replace
  + Build against Python 3 by default for bindings
- Drop snapshot source service and snapshot tarball
- Use license macro for license file
- Drop trailing whitespace
- Fix comment about drpm support
- [boo#1125044] fix for huge rpm packages</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281600">- Update to 0.12.0
  + Add basic support for zchunk metadata
  + Add support for building wheels to upload to PyPI
- Drop Python 2 subpackage
- Enable drpm support
- Enable zchunk for openSUSE Leap 15.1+ and Tumbleweed
- Adjust changes entries to use full author identities</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281601">- Backport fixes from upstream
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch</changelog>
  <changelog author="FSchreiner@suse.com" date="1551441600">- Added upstream patches
  * 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  * 0002-fix-linking-when-Wl-no-undefined-is-set.patch
- Drop included patches
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch
- Disable drpm support
- Update to version 0.12.1:
  * Release 0.12.1
  * For make test, xz and zchunk (not just *-devel) are required.
  * Make cmake variable PYTHON_EXECUTABLE global
  * Add zchunk support already to Fedora 29
  * [spec] Fix spec to work for epel 7
  * Add CMake support for python interpreter path
  * Add space after if statement
  * Fix misc test
  * Add missing sentinal
  * Add zchunk support to mergerepo_c for extra files</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Use noun phrase in summary.</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971200">- Update to 0.13.0
  + Add support for handling modulemd
  + Add support for Koji simple merge mode
  + Add support for zchunked modulemd
  + Fixed --keep-all-metadata to keep all additional metadata
- Disable tests if modulemd support is not enabled to prevent wrong failures
- Drop patches included in this release
  + 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  + 0002-fix-linking-when-Wl-no-undefined-is-set.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971201">- Update to 0.13.1
  + Fix tests to work properly when modulemd support is not enabled
- Enable modulemd support on openSUSE Leap 15.1+ and Tumbleweed</changelog>
  <changelog author="ngompa13@gmail.com" date="1557921600">- Update to 0.14.0
  + Fix crash when dumping updateinfo and module is omitted (rh#1707981)
  + Add --pkgorigins mode</changelog>
  <changelog author="ngompa13@gmail.com" date="1561809600">- Update to 0.14.2
  + Fix issue with createrepo_c hanging at the end (rh#1714666)
  + Don't include packages with forbidden control chars in repodata (boo#1110914)
  + Correct pkg count in headers if there were invalid pkgs (rh#1596211)
  + Prevent exiting with 0 if errors occur while finalizing repodata</changelog>
  <changelog author="FSchreiner@suse.com" date="1568721600">- Update to version 0.15.1:
  * Release 0.15.1
  * Fix null pointer crash in cr_dumper_thread() if it fails to get checksum
  * Fix search in string with missing terminating zero (rh#1750673)
  * Depend on DRPM minimum version 0.4.0
  * Release 0.15.0
  * Revise drpm dependency check and bump the minimum version to 0.3.0
  * Release 0.14.4
  * Update documentation and regenerate man pages to sync up
  * Use drpm_make from drpm instead of deltarpm (rh#1687843)
  * Fix some DEBUG build warnings
  * Switch off html timestamps on documentation (rh#1731050)
  * Update documentation for mergerepo_c merge methods (rh#1722803)
  * Update documentation for --retain-old-md and --compatibility
  * Fix --read-pkgs-list to only list actually read packages
  * Release 0.14.3
  * Add missing python metadata to python2/3-createrepo_c (rh#1695677)
  * detect plain tar file as non compressed</changelog>
  <changelog author="dmueller@suse.com" date="1568721601">- fix build by adding missing tarball and updating filelist</changelog>
  <changelog author="steven.kowalik@suse.com" date="1574078400">- Add BuildRequires on python3, it won't be pulled in side effect of
  requiring python3-nose</changelog>
  <changelog author="ngompa13@gmail.com" date="1574683200">- Update to 0.15.2
  + Fix file mode for cache (rh#1686812)
  + Honor umask on cache files (rh#1686812)
- Enable DeltaRPM support for openSUSE targets on Leap 15.2+ and TW</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Update to 0.15.3
  + Export all changelog entries in compatibility mode
  + Libmagic to follow symlinks (rh#1776399)
  + Add shortcut to detect *.yaml files as not compressed
- Ensure createrepo_c fully replaces createrepo on Tumbleweed
- Remove old and now unused dependency on deltarpm as drpm is used now</changelog>
  <changelog author="ngompa13@gmail.com" date="1575633600">- Update to 0.15.4
  + Add reboot_suggested field to UpdateRecord (rh#1772466)
  + Skip directory matching --exclude right away
  + Add restart_suggested to updatecollectionpackage</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Update to 0.15.6
  + Set global_exit_status on sigint so that .repodata are cleaned up
  + Fix various issues discovered by covscans (rh#1789707)
  + Enhance error handling when locating repositories (rh#1762697)
  + Switch updateinfo to explicitly include bool values (rh#1772466)
  + add --recycle-pkglist option
  + use pkg href for cache lookup with --update
  + Sync --excludes matching for dir-walk vs. --pkglist</changelog>
  <changelog author="ngompa13@gmail.com" date="1582027200">- Update to 0.15.7
  + Add relogin_suggested to updatecollectionpackage (rh#1779751)
  + Support issued date in epoch format in Python API (rh#1779751)</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1593518400">- Update to 0.15.11
  + Add python unittest for invalid date in updateinfo record get_datetime
  + Simplify case when attr is empty (prevents covscan warnings)
  + Fix couple of memory leaks, some mistakenly dead code and error handling
  + Add --arch-expand option
  + Fix spelling errors.</changelog>
  <changelog author="ngompa13@gmail.com" date="1594123200">- Update to 0.16.0
  + Never do dir walk when --recycle-pkglist specified
  + Add automatic module metadata handling for repos (rh#1795936)</changelog>
  <changelog author="FSchreiner@suse.com" date="1614340800">- removed %is_opensuse (CtLG)
- disabled drpm for SLE/Leap 15.3</changelog>
</package>
<package pkgid="75e5bfe2249fb89fd72a972cc85eaf25768da9c21f4b7c105040a87f22646cd7" name="createrepo_c" arch="ppc64le">
  <version epoch="0" ver="0.16.0" rel="3.3.1"/>
  <changelog author="ngompa13@gmail.com" date="1533124800">- Update to 0.11.1
  + Add support for RPMs with large files
  + Identify Requires(missingok) as Recommends correctly
  + Enable legacy tags by default
  + Fix missing packages in mergerepo_c with multiple VR of same name
  + Add mergerepo_c --repo-prefix-search and --repo-prefix-replace
  + Build against Python 3 by default for bindings
- Drop snapshot source service and snapshot tarball
- Use license macro for license file
- Drop trailing whitespace
- Fix comment about drpm support
- [boo#1125044] fix for huge rpm packages</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281600">- Update to 0.12.0
  + Add basic support for zchunk metadata
  + Add support for building wheels to upload to PyPI
- Drop Python 2 subpackage
- Enable drpm support
- Enable zchunk for openSUSE Leap 15.1+ and Tumbleweed
- Adjust changes entries to use full author identities</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281601">- Backport fixes from upstream
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch</changelog>
  <changelog author="FSchreiner@suse.com" date="1551441600">- Added upstream patches
  * 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  * 0002-fix-linking-when-Wl-no-undefined-is-set.patch
- Drop included patches
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch
- Disable drpm support
- Update to version 0.12.1:
  * Release 0.12.1
  * For make test, xz and zchunk (not just *-devel) are required.
  * Make cmake variable PYTHON_EXECUTABLE global
  * Add zchunk support already to Fedora 29
  * [spec] Fix spec to work for epel 7
  * Add CMake support for python interpreter path
  * Add space after if statement
  * Fix misc test
  * Add missing sentinal
  * Add zchunk support to mergerepo_c for extra files</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Use noun phrase in summary.</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971200">- Update to 0.13.0
  + Add support for handling modulemd
  + Add support for Koji simple merge mode
  + Add support for zchunked modulemd
  + Fixed --keep-all-metadata to keep all additional metadata
- Disable tests if modulemd support is not enabled to prevent wrong failures
- Drop patches included in this release
  + 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  + 0002-fix-linking-when-Wl-no-undefined-is-set.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971201">- Update to 0.13.1
  + Fix tests to work properly when modulemd support is not enabled
- Enable modulemd support on openSUSE Leap 15.1+ and Tumbleweed</changelog>
  <changelog author="ngompa13@gmail.com" date="1557921600">- Update to 0.14.0
  + Fix crash when dumping updateinfo and module is omitted (rh#1707981)
  + Add --pkgorigins mode</changelog>
  <changelog author="ngompa13@gmail.com" date="1561809600">- Update to 0.14.2
  + Fix issue with createrepo_c hanging at the end (rh#1714666)
  + Don't include packages with forbidden control chars in repodata (boo#1110914)
  + Correct pkg count in headers if there were invalid pkgs (rh#1596211)
  + Prevent exiting with 0 if errors occur while finalizing repodata</changelog>
  <changelog author="FSchreiner@suse.com" date="1568721600">- Update to version 0.15.1:
  * Release 0.15.1
  * Fix null pointer crash in cr_dumper_thread() if it fails to get checksum
  * Fix search in string with missing terminating zero (rh#1750673)
  * Depend on DRPM minimum version 0.4.0
  * Release 0.15.0
  * Revise drpm dependency check and bump the minimum version to 0.3.0
  * Release 0.14.4
  * Update documentation and regenerate man pages to sync up
  * Use drpm_make from drpm instead of deltarpm (rh#1687843)
  * Fix some DEBUG build warnings
  * Switch off html timestamps on documentation (rh#1731050)
  * Update documentation for mergerepo_c merge methods (rh#1722803)
  * Update documentation for --retain-old-md and --compatibility
  * Fix --read-pkgs-list to only list actually read packages
  * Release 0.14.3
  * Add missing python metadata to python2/3-createrepo_c (rh#1695677)
  * detect plain tar file as non compressed</changelog>
  <changelog author="dmueller@suse.com" date="1568721601">- fix build by adding missing tarball and updating filelist</changelog>
  <changelog author="steven.kowalik@suse.com" date="1574078400">- Add BuildRequires on python3, it won't be pulled in side effect of
  requiring python3-nose</changelog>
  <changelog author="ngompa13@gmail.com" date="1574683200">- Update to 0.15.2
  + Fix file mode for cache (rh#1686812)
  + Honor umask on cache files (rh#1686812)
- Enable DeltaRPM support for openSUSE targets on Leap 15.2+ and TW</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Update to 0.15.3
  + Export all changelog entries in compatibility mode
  + Libmagic to follow symlinks (rh#1776399)
  + Add shortcut to detect *.yaml files as not compressed
- Ensure createrepo_c fully replaces createrepo on Tumbleweed
- Remove old and now unused dependency on deltarpm as drpm is used now</changelog>
  <changelog author="ngompa13@gmail.com" date="1575633600">- Update to 0.15.4
  + Add reboot_suggested field to UpdateRecord (rh#1772466)
  + Skip directory matching --exclude right away
  + Add restart_suggested to updatecollectionpackage</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Update to 0.15.6
  + Set global_exit_status on sigint so that .repodata are cleaned up
  + Fix various issues discovered by covscans (rh#1789707)
  + Enhance error handling when locating repositories (rh#1762697)
  + Switch updateinfo to explicitly include bool values (rh#1772466)
  + add --recycle-pkglist option
  + use pkg href for cache lookup with --update
  + Sync --excludes matching for dir-walk vs. --pkglist</changelog>
  <changelog author="ngompa13@gmail.com" date="1582027200">- Update to 0.15.7
  + Add relogin_suggested to updatecollectionpackage (rh#1779751)
  + Support issued date in epoch format in Python API (rh#1779751)</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1593518400">- Update to 0.15.11
  + Add python unittest for invalid date in updateinfo record get_datetime
  + Simplify case when attr is empty (prevents covscan warnings)
  + Fix couple of memory leaks, some mistakenly dead code and error handling
  + Add --arch-expand option
  + Fix spelling errors.</changelog>
  <changelog author="ngompa13@gmail.com" date="1594123200">- Update to 0.16.0
  + Never do dir walk when --recycle-pkglist specified
  + Add automatic module metadata handling for repos (rh#1795936)</changelog>
  <changelog author="FSchreiner@suse.com" date="1614340800">- removed %is_opensuse (CtLG)
- disabled drpm for SLE/Leap 15.3</changelog>
</package>
<package pkgid="ffb74f8c08877026bc6a456335fa511673d0cd329cd0be15eadda7ca80675a8b" name="createrepo_c" arch="s390x">
  <version epoch="0" ver="0.16.0" rel="3.3.1"/>
  <changelog author="ngompa13@gmail.com" date="1533124800">- Update to 0.11.1
  + Add support for RPMs with large files
  + Identify Requires(missingok) as Recommends correctly
  + Enable legacy tags by default
  + Fix missing packages in mergerepo_c with multiple VR of same name
  + Add mergerepo_c --repo-prefix-search and --repo-prefix-replace
  + Build against Python 3 by default for bindings
- Drop snapshot source service and snapshot tarball
- Use license macro for license file
- Drop trailing whitespace
- Fix comment about drpm support
- [boo#1125044] fix for huge rpm packages</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281600">- Update to 0.12.0
  + Add basic support for zchunk metadata
  + Add support for building wheels to upload to PyPI
- Drop Python 2 subpackage
- Enable drpm support
- Enable zchunk for openSUSE Leap 15.1+ and Tumbleweed
- Adjust changes entries to use full author identities</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281601">- Backport fixes from upstream
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch</changelog>
  <changelog author="FSchreiner@suse.com" date="1551441600">- Added upstream patches
  * 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  * 0002-fix-linking-when-Wl-no-undefined-is-set.patch
- Drop included patches
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch
- Disable drpm support
- Update to version 0.12.1:
  * Release 0.12.1
  * For make test, xz and zchunk (not just *-devel) are required.
  * Make cmake variable PYTHON_EXECUTABLE global
  * Add zchunk support already to Fedora 29
  * [spec] Fix spec to work for epel 7
  * Add CMake support for python interpreter path
  * Add space after if statement
  * Fix misc test
  * Add missing sentinal
  * Add zchunk support to mergerepo_c for extra files</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Use noun phrase in summary.</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971200">- Update to 0.13.0
  + Add support for handling modulemd
  + Add support for Koji simple merge mode
  + Add support for zchunked modulemd
  + Fixed --keep-all-metadata to keep all additional metadata
- Disable tests if modulemd support is not enabled to prevent wrong failures
- Drop patches included in this release
  + 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  + 0002-fix-linking-when-Wl-no-undefined-is-set.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971201">- Update to 0.13.1
  + Fix tests to work properly when modulemd support is not enabled
- Enable modulemd support on openSUSE Leap 15.1+ and Tumbleweed</changelog>
  <changelog author="ngompa13@gmail.com" date="1557921600">- Update to 0.14.0
  + Fix crash when dumping updateinfo and module is omitted (rh#1707981)
  + Add --pkgorigins mode</changelog>
  <changelog author="ngompa13@gmail.com" date="1561809600">- Update to 0.14.2
  + Fix issue with createrepo_c hanging at the end (rh#1714666)
  + Don't include packages with forbidden control chars in repodata (boo#1110914)
  + Correct pkg count in headers if there were invalid pkgs (rh#1596211)
  + Prevent exiting with 0 if errors occur while finalizing repodata</changelog>
  <changelog author="FSchreiner@suse.com" date="1568721600">- Update to version 0.15.1:
  * Release 0.15.1
  * Fix null pointer crash in cr_dumper_thread() if it fails to get checksum
  * Fix search in string with missing terminating zero (rh#1750673)
  * Depend on DRPM minimum version 0.4.0
  * Release 0.15.0
  * Revise drpm dependency check and bump the minimum version to 0.3.0
  * Release 0.14.4
  * Update documentation and regenerate man pages to sync up
  * Use drpm_make from drpm instead of deltarpm (rh#1687843)
  * Fix some DEBUG build warnings
  * Switch off html timestamps on documentation (rh#1731050)
  * Update documentation for mergerepo_c merge methods (rh#1722803)
  * Update documentation for --retain-old-md and --compatibility
  * Fix --read-pkgs-list to only list actually read packages
  * Release 0.14.3
  * Add missing python metadata to python2/3-createrepo_c (rh#1695677)
  * detect plain tar file as non compressed</changelog>
  <changelog author="dmueller@suse.com" date="1568721601">- fix build by adding missing tarball and updating filelist</changelog>
  <changelog author="steven.kowalik@suse.com" date="1574078400">- Add BuildRequires on python3, it won't be pulled in side effect of
  requiring python3-nose</changelog>
  <changelog author="ngompa13@gmail.com" date="1574683200">- Update to 0.15.2
  + Fix file mode for cache (rh#1686812)
  + Honor umask on cache files (rh#1686812)
- Enable DeltaRPM support for openSUSE targets on Leap 15.2+ and TW</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Update to 0.15.3
  + Export all changelog entries in compatibility mode
  + Libmagic to follow symlinks (rh#1776399)
  + Add shortcut to detect *.yaml files as not compressed
- Ensure createrepo_c fully replaces createrepo on Tumbleweed
- Remove old and now unused dependency on deltarpm as drpm is used now</changelog>
  <changelog author="ngompa13@gmail.com" date="1575633600">- Update to 0.15.4
  + Add reboot_suggested field to UpdateRecord (rh#1772466)
  + Skip directory matching --exclude right away
  + Add restart_suggested to updatecollectionpackage</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Update to 0.15.6
  + Set global_exit_status on sigint so that .repodata are cleaned up
  + Fix various issues discovered by covscans (rh#1789707)
  + Enhance error handling when locating repositories (rh#1762697)
  + Switch updateinfo to explicitly include bool values (rh#1772466)
  + add --recycle-pkglist option
  + use pkg href for cache lookup with --update
  + Sync --excludes matching for dir-walk vs. --pkglist</changelog>
  <changelog author="ngompa13@gmail.com" date="1582027200">- Update to 0.15.7
  + Add relogin_suggested to updatecollectionpackage (rh#1779751)
  + Support issued date in epoch format in Python API (rh#1779751)</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1593518400">- Update to 0.15.11
  + Add python unittest for invalid date in updateinfo record get_datetime
  + Simplify case when attr is empty (prevents covscan warnings)
  + Fix couple of memory leaks, some mistakenly dead code and error handling
  + Add --arch-expand option
  + Fix spelling errors.</changelog>
  <changelog author="ngompa13@gmail.com" date="1594123200">- Update to 0.16.0
  + Never do dir walk when --recycle-pkglist specified
  + Add automatic module metadata handling for repos (rh#1795936)</changelog>
  <changelog author="FSchreiner@suse.com" date="1614340800">- removed %is_opensuse (CtLG)
- disabled drpm for SLE/Leap 15.3</changelog>
</package>
<package pkgid="23da0f2992c99ff24cb19e51815032102d53e76e51600111618456d3b4bdc4ca" name="createrepo_c" arch="src">
  <version epoch="0" ver="0.16.0" rel="3.3.1"/>
  <changelog author="ngompa13@gmail.com" date="1533124800">- Update to 0.11.1
  + Add support for RPMs with large files
  + Identify Requires(missingok) as Recommends correctly
  + Enable legacy tags by default
  + Fix missing packages in mergerepo_c with multiple VR of same name
  + Add mergerepo_c --repo-prefix-search and --repo-prefix-replace
  + Build against Python 3 by default for bindings
- Drop snapshot source service and snapshot tarball
- Use license macro for license file
- Drop trailing whitespace
- Fix comment about drpm support
- [boo#1125044] fix for huge rpm packages</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281600">- Update to 0.12.0
  + Add basic support for zchunk metadata
  + Add support for building wheels to upload to PyPI
- Drop Python 2 subpackage
- Enable drpm support
- Enable zchunk for openSUSE Leap 15.1+ and Tumbleweed
- Adjust changes entries to use full author identities</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281601">- Backport fixes from upstream
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch</changelog>
  <changelog author="FSchreiner@suse.com" date="1551441600">- Added upstream patches
  * 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  * 0002-fix-linking-when-Wl-no-undefined-is-set.patch
- Drop included patches
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch
- Disable drpm support
- Update to version 0.12.1:
  * Release 0.12.1
  * For make test, xz and zchunk (not just *-devel) are required.
  * Make cmake variable PYTHON_EXECUTABLE global
  * Add zchunk support already to Fedora 29
  * [spec] Fix spec to work for epel 7
  * Add CMake support for python interpreter path
  * Add space after if statement
  * Fix misc test
  * Add missing sentinal
  * Add zchunk support to mergerepo_c for extra files</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Use noun phrase in summary.</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971200">- Update to 0.13.0
  + Add support for handling modulemd
  + Add support for Koji simple merge mode
  + Add support for zchunked modulemd
  + Fixed --keep-all-metadata to keep all additional metadata
- Disable tests if modulemd support is not enabled to prevent wrong failures
- Drop patches included in this release
  + 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  + 0002-fix-linking-when-Wl-no-undefined-is-set.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971201">- Update to 0.13.1
  + Fix tests to work properly when modulemd support is not enabled
- Enable modulemd support on openSUSE Leap 15.1+ and Tumbleweed</changelog>
  <changelog author="ngompa13@gmail.com" date="1557921600">- Update to 0.14.0
  + Fix crash when dumping updateinfo and module is omitted (rh#1707981)
  + Add --pkgorigins mode</changelog>
  <changelog author="ngompa13@gmail.com" date="1561809600">- Update to 0.14.2
  + Fix issue with createrepo_c hanging at the end (rh#1714666)
  + Don't include packages with forbidden control chars in repodata (boo#1110914)
  + Correct pkg count in headers if there were invalid pkgs (rh#1596211)
  + Prevent exiting with 0 if errors occur while finalizing repodata</changelog>
  <changelog author="FSchreiner@suse.com" date="1568721600">- Update to version 0.15.1:
  * Release 0.15.1
  * Fix null pointer crash in cr_dumper_thread() if it fails to get checksum
  * Fix search in string with missing terminating zero (rh#1750673)
  * Depend on DRPM minimum version 0.4.0
  * Release 0.15.0
  * Revise drpm dependency check and bump the minimum version to 0.3.0
  * Release 0.14.4
  * Update documentation and regenerate man pages to sync up
  * Use drpm_make from drpm instead of deltarpm (rh#1687843)
  * Fix some DEBUG build warnings
  * Switch off html timestamps on documentation (rh#1731050)
  * Update documentation for mergerepo_c merge methods (rh#1722803)
  * Update documentation for --retain-old-md and --compatibility
  * Fix --read-pkgs-list to only list actually read packages
  * Release 0.14.3
  * Add missing python metadata to python2/3-createrepo_c (rh#1695677)
  * detect plain tar file as non compressed</changelog>
  <changelog author="dmueller@suse.com" date="1568721601">- fix build by adding missing tarball and updating filelist</changelog>
  <changelog author="steven.kowalik@suse.com" date="1574078400">- Add BuildRequires on python3, it won't be pulled in side effect of
  requiring python3-nose</changelog>
  <changelog author="ngompa13@gmail.com" date="1574683200">- Update to 0.15.2
  + Fix file mode for cache (rh#1686812)
  + Honor umask on cache files (rh#1686812)
- Enable DeltaRPM support for openSUSE targets on Leap 15.2+ and TW</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Update to 0.15.3
  + Export all changelog entries in compatibility mode
  + Libmagic to follow symlinks (rh#1776399)
  + Add shortcut to detect *.yaml files as not compressed
- Ensure createrepo_c fully replaces createrepo on Tumbleweed
- Remove old and now unused dependency on deltarpm as drpm is used now</changelog>
  <changelog author="ngompa13@gmail.com" date="1575633600">- Update to 0.15.4
  + Add reboot_suggested field to UpdateRecord (rh#1772466)
  + Skip directory matching --exclude right away
  + Add restart_suggested to updatecollectionpackage</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Update to 0.15.6
  + Set global_exit_status on sigint so that .repodata are cleaned up
  + Fix various issues discovered by covscans (rh#1789707)
  + Enhance error handling when locating repositories (rh#1762697)
  + Switch updateinfo to explicitly include bool values (rh#1772466)
  + add --recycle-pkglist option
  + use pkg href for cache lookup with --update
  + Sync --excludes matching for dir-walk vs. --pkglist</changelog>
  <changelog author="ngompa13@gmail.com" date="1582027200">- Update to 0.15.7
  + Add relogin_suggested to updatecollectionpackage (rh#1779751)
  + Support issued date in epoch format in Python API (rh#1779751)</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1593518400">- Update to 0.15.11
  + Add python unittest for invalid date in updateinfo record get_datetime
  + Simplify case when attr is empty (prevents covscan warnings)
  + Fix couple of memory leaks, some mistakenly dead code and error handling
  + Add --arch-expand option
  + Fix spelling errors.</changelog>
  <changelog author="ngompa13@gmail.com" date="1594123200">- Update to 0.16.0
  + Never do dir walk when --recycle-pkglist specified
  + Add automatic module metadata handling for repos (rh#1795936)</changelog>
  <changelog author="FSchreiner@suse.com" date="1614340800">- removed %is_opensuse (CtLG)
- disabled drpm for SLE/Leap 15.3</changelog>
</package>
<package pkgid="ba8bffccd4cb80aaf9fec70d90815ed87c9cd794a80bf1583d08ad0add023dd6" name="createrepo_c" arch="x86_64">
  <version epoch="0" ver="0.16.0" rel="3.3.1"/>
  <changelog author="ngompa13@gmail.com" date="1533124800">- Update to 0.11.1
  + Add support for RPMs with large files
  + Identify Requires(missingok) as Recommends correctly
  + Enable legacy tags by default
  + Fix missing packages in mergerepo_c with multiple VR of same name
  + Add mergerepo_c --repo-prefix-search and --repo-prefix-replace
  + Build against Python 3 by default for bindings
- Drop snapshot source service and snapshot tarball
- Use license macro for license file
- Drop trailing whitespace
- Fix comment about drpm support
- [boo#1125044] fix for huge rpm packages</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281600">- Update to 0.12.0
  + Add basic support for zchunk metadata
  + Add support for building wheels to upload to PyPI
- Drop Python 2 subpackage
- Enable drpm support
- Enable zchunk for openSUSE Leap 15.1+ and Tumbleweed
- Adjust changes entries to use full author identities</changelog>
  <changelog author="ngompa13@gmail.com" date="1549281601">- Backport fixes from upstream
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch</changelog>
  <changelog author="FSchreiner@suse.com" date="1551441600">- Added upstream patches
  * 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  * 0002-fix-linking-when-Wl-no-undefined-is-set.patch
- Drop included patches
  * 0001-zck_end_chunk-returns-number-of-bytes-written-or-1-f.patch
  * 0002-Add-missing-sentinal.patch
  * 0003-Fix-misc-test.patch
- Disable drpm support
- Update to version 0.12.1:
  * Release 0.12.1
  * For make test, xz and zchunk (not just *-devel) are required.
  * Make cmake variable PYTHON_EXECUTABLE global
  * Add zchunk support already to Fedora 29
  * [spec] Fix spec to work for epel 7
  * Add CMake support for python interpreter path
  * Add space after if statement
  * Fix misc test
  * Add missing sentinal
  * Add zchunk support to mergerepo_c for extra files</changelog>
  <changelog author="jengelh@inai.de" date="1552910400">- Use noun phrase in summary.</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971200">- Update to 0.13.0
  + Add support for handling modulemd
  + Add support for Koji simple merge mode
  + Add support for zchunked modulemd
  + Fixed --keep-all-metadata to keep all additional metadata
- Disable tests if modulemd support is not enabled to prevent wrong failures
- Drop patches included in this release
  + 0001-Find-correct-nosetests-version-even-when-which-comma.patch
  + 0002-fix-linking-when-Wl-no-undefined-is-set.patch</changelog>
  <changelog author="ngompa13@gmail.com" date="1556971201">- Update to 0.13.1
  + Fix tests to work properly when modulemd support is not enabled
- Enable modulemd support on openSUSE Leap 15.1+ and Tumbleweed</changelog>
  <changelog author="ngompa13@gmail.com" date="1557921600">- Update to 0.14.0
  + Fix crash when dumping updateinfo and module is omitted (rh#1707981)
  + Add --pkgorigins mode</changelog>
  <changelog author="ngompa13@gmail.com" date="1561809600">- Update to 0.14.2
  + Fix issue with createrepo_c hanging at the end (rh#1714666)
  + Don't include packages with forbidden control chars in repodata (boo#1110914)
  + Correct pkg count in headers if there were invalid pkgs (rh#1596211)
  + Prevent exiting with 0 if errors occur while finalizing repodata</changelog>
  <changelog author="FSchreiner@suse.com" date="1568721600">- Update to version 0.15.1:
  * Release 0.15.1
  * Fix null pointer crash in cr_dumper_thread() if it fails to get checksum
  * Fix search in string with missing terminating zero (rh#1750673)
  * Depend on DRPM minimum version 0.4.0
  * Release 0.15.0
  * Revise drpm dependency check and bump the minimum version to 0.3.0
  * Release 0.14.4
  * Update documentation and regenerate man pages to sync up
  * Use drpm_make from drpm instead of deltarpm (rh#1687843)
  * Fix some DEBUG build warnings
  * Switch off html timestamps on documentation (rh#1731050)
  * Update documentation for mergerepo_c merge methods (rh#1722803)
  * Update documentation for --retain-old-md and --compatibility
  * Fix --read-pkgs-list to only list actually read packages
  * Release 0.14.3
  * Add missing python metadata to python2/3-createrepo_c (rh#1695677)
  * detect plain tar file as non compressed</changelog>
  <changelog author="dmueller@suse.com" date="1568721601">- fix build by adding missing tarball and updating filelist</changelog>
  <changelog author="steven.kowalik@suse.com" date="1574078400">- Add BuildRequires on python3, it won't be pulled in side effect of
  requiring python3-nose</changelog>
  <changelog author="ngompa13@gmail.com" date="1574683200">- Update to 0.15.2
  + Fix file mode for cache (rh#1686812)
  + Honor umask on cache files (rh#1686812)
- Enable DeltaRPM support for openSUSE targets on Leap 15.2+ and TW</changelog>
  <changelog author="ngompa13@gmail.com" date="1575028800">- Update to 0.15.3
  + Export all changelog entries in compatibility mode
  + Libmagic to follow symlinks (rh#1776399)
  + Add shortcut to detect *.yaml files as not compressed
- Ensure createrepo_c fully replaces createrepo on Tumbleweed
- Remove old and now unused dependency on deltarpm as drpm is used now</changelog>
  <changelog author="ngompa13@gmail.com" date="1575633600">- Update to 0.15.4
  + Add reboot_suggested field to UpdateRecord (rh#1772466)
  + Skip directory matching --exclude right away
  + Add restart_suggested to updatecollectionpackage</changelog>
  <changelog author="ngompa13@gmail.com" date="1579435200">- Update to 0.15.6
  + Set global_exit_status on sigint so that .repodata are cleaned up
  + Fix various issues discovered by covscans (rh#1789707)
  + Enhance error handling when locating repositories (rh#1762697)
  + Switch updateinfo to explicitly include bool values (rh#1772466)
  + add --recycle-pkglist option
  + use pkg href for cache lookup with --update
  + Sync --excludes matching for dir-walk vs. --pkglist</changelog>
  <changelog author="ngompa13@gmail.com" date="1582027200">- Update to 0.15.7
  + Add relogin_suggested to updatecollectionpackage (rh#1779751)
  + Support issued date in epoch format in Python API (rh#1779751)</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1593518400">- Update to 0.15.11
  + Add python unittest for invalid date in updateinfo record get_datetime
  + Simplify case when attr is empty (prevents covscan warnings)
  + Fix couple of memory leaks, some mistakenly dead code and error handling
  + Add --arch-expand option
  + Fix spelling errors.</changelog>
  <changelog author="ngompa13@gmail.com" date="1594123200">- Update to 0.16.0
  + Never do dir walk when --recycle-pkglist specified
  + Add automatic module metadata handling for repos (rh#1795936)</changelog>
  <changelog author="FSchreiner@suse.com" date="1614340800">- removed %is_opensuse (CtLG)
- disabled drpm for SLE/Leap 15.3</changelog>
</package>
<package pkgid="aa2481c7f622fd58d2db2c8acb9579db578765ded74ceb8816cc33e7542ae419" name="crmsh" arch="noarch">
  <version epoch="0" ver="4.3.0+20210507.bf02d791" rel="5.50.1"/>
  <changelog author="XLiang@suse.com" date="1584100800">- Update to version 4.2.0+git.1584013187.b45cfcb6:
  * Fix: crmsh.spec.in: enable completion of crm command(bsc#1166329)
  * Low: crmsh.spec.in: sync contents from NHF's crmsh.spec file
  * Low: corosync: check whether local ip has already configured
  * Low: bootstrap: check whether init node is online while joining
  * Low: bootstrap: for udpu, don't check join node's ip was in the same network</changelog>
  <changelog author="XLiang@suse.com" date="1585137600">- Update to version 4.2.0+git.1585096577.f3257c89:
  * Low: corosync: Improve qdevice configure process
  * Fix: bootstrap: Change condition to add stonith-sbd resource(bsc#1166967)
  * Fix: bootstrap: use csync2 '-f' option correctly(bsc#1166684)</changelog>
  <changelog author="XLiang@suse.com" date="1590580800">- Add patches:
  - Low: bootstrap: Simplify bootstrap context
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  - High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1594382400">- Update to version 4.2.0+git.1594286044.7a596d12:
  * Low: hb_report: Fix collecting of binary data (bsc#1166962)
  * High: bootstrap: ssh key configuration improvement(bsc#1169581, ECO-2035)
  * High: bootstrap: bootstrap network improvement
  * Low: cibconfig: Avoid adding the ID attribute to select_* nodes
  * High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * Low: bootstrap: change ha-cluster-bootstrap log path
  * Low: ui_corosync: print cluster nodes while getting quorum and qnetd status
  * Low: bootstrap: exit with proper error messages when ssh return failed
  * Low: ui_cluster: use argparse choices to validate -i and -t option
  * Low: corosync: Use with statement  to open file
  * Fix: ui_resource: refresh &lt;Tab&gt; should complete resource first(bsc#1167220)
  * Low: ui_context: give warning if using alias command
  * Low: bootstrap: Simplify bootstrap context
  * Fix: doc: Update man page about completion example of crm resource(bsc#1166644)
- Remove patches:
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
</package>
<package pkgid="54fd5d8a43fbf6807e103f1aec1a4c9390a8f77096f7afae1f4c4352922b497a" name="crmsh" arch="src">
  <version epoch="0" ver="4.3.0+20210507.bf02d791" rel="5.50.1"/>
  <changelog author="XLiang@suse.com" date="1584100800">- Update to version 4.2.0+git.1584013187.b45cfcb6:
  * Fix: crmsh.spec.in: enable completion of crm command(bsc#1166329)
  * Low: crmsh.spec.in: sync contents from NHF's crmsh.spec file
  * Low: corosync: check whether local ip has already configured
  * Low: bootstrap: check whether init node is online while joining
  * Low: bootstrap: for udpu, don't check join node's ip was in the same network</changelog>
  <changelog author="XLiang@suse.com" date="1585137600">- Update to version 4.2.0+git.1585096577.f3257c89:
  * Low: corosync: Improve qdevice configure process
  * Fix: bootstrap: Change condition to add stonith-sbd resource(bsc#1166967)
  * Fix: bootstrap: use csync2 '-f' option correctly(bsc#1166684)</changelog>
  <changelog author="XLiang@suse.com" date="1590580800">- Add patches:
  - Low: bootstrap: Simplify bootstrap context
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  - High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1594382400">- Update to version 4.2.0+git.1594286044.7a596d12:
  * Low: hb_report: Fix collecting of binary data (bsc#1166962)
  * High: bootstrap: ssh key configuration improvement(bsc#1169581, ECO-2035)
  * High: bootstrap: bootstrap network improvement
  * Low: cibconfig: Avoid adding the ID attribute to select_* nodes
  * High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * Low: bootstrap: change ha-cluster-bootstrap log path
  * Low: ui_corosync: print cluster nodes while getting quorum and qnetd status
  * Low: bootstrap: exit with proper error messages when ssh return failed
  * Low: ui_cluster: use argparse choices to validate -i and -t option
  * Low: corosync: Use with statement  to open file
  * Fix: ui_resource: refresh &lt;Tab&gt; should complete resource first(bsc#1167220)
  * Low: ui_context: give warning if using alias command
  * Low: bootstrap: Simplify bootstrap context
  * Fix: doc: Update man page about completion example of crm resource(bsc#1166644)
- Remove patches:
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
</package>
<package pkgid="5a2874f38b8e4dda77adfaff03e4999b5b92e87b9450c7f7345727f114586676" name="crmsh" arch="noarch">
  <version epoch="0" ver="4.3.1+20210702.4e0ee8fb" rel="5.59.1"/>
  <changelog author="XLiang@suse.com" date="1594382400">- Update to version 4.2.0+git.1594286044.7a596d12:
  * Low: hb_report: Fix collecting of binary data (bsc#1166962)
  * High: bootstrap: ssh key configuration improvement(bsc#1169581, ECO-2035)
  * High: bootstrap: bootstrap network improvement
  * Low: cibconfig: Avoid adding the ID attribute to select_* nodes
  * High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * Low: bootstrap: change ha-cluster-bootstrap log path
  * Low: ui_corosync: print cluster nodes while getting quorum and qnetd status
  * Low: bootstrap: exit with proper error messages when ssh return failed
  * Low: ui_cluster: use argparse choices to validate -i and -t option
  * Low: corosync: Use with statement  to open file
  * Fix: ui_resource: refresh &lt;Tab&gt; should complete resource first(bsc#1167220)
  * Low: ui_context: give warning if using alias command
  * Low: bootstrap: Simplify bootstrap context
  * Fix: doc: Update man page about completion example of crm resource(bsc#1166644)
- Remove patches:
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
</package>
<package pkgid="a7535c90fd6ba4c1a3d1bb3a16f2e7e70a7bdf9c5f49d1aca49e55ab7cd560de" name="crmsh" arch="src">
  <version epoch="0" ver="4.3.1+20210702.4e0ee8fb" rel="5.59.1"/>
  <changelog author="XLiang@suse.com" date="1594382400">- Update to version 4.2.0+git.1594286044.7a596d12:
  * Low: hb_report: Fix collecting of binary data (bsc#1166962)
  * High: bootstrap: ssh key configuration improvement(bsc#1169581, ECO-2035)
  * High: bootstrap: bootstrap network improvement
  * Low: cibconfig: Avoid adding the ID attribute to select_* nodes
  * High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * Low: bootstrap: change ha-cluster-bootstrap log path
  * Low: ui_corosync: print cluster nodes while getting quorum and qnetd status
  * Low: bootstrap: exit with proper error messages when ssh return failed
  * Low: ui_cluster: use argparse choices to validate -i and -t option
  * Low: corosync: Use with statement  to open file
  * Fix: ui_resource: refresh &lt;Tab&gt; should complete resource first(bsc#1167220)
  * Low: ui_context: give warning if using alias command
  * Low: bootstrap: Simplify bootstrap context
  * Fix: doc: Update man page about completion example of crm resource(bsc#1166644)
- Remove patches:
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
</package>
<package pkgid="39358dc12a219d26deb805d32652233e155c5d863629c49e167d7ce045eee679" name="crmsh" arch="noarch">
  <version epoch="0" ver="4.3.1+20210811.2a30e37e" rel="5.62.1"/>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
</package>
<package pkgid="b007bd8708feaddd129ad60a5ed2456016fdf3226db4774c2dc837d3a9436a7c" name="crmsh" arch="src">
  <version epoch="0" ver="4.3.1+20210811.2a30e37e" rel="5.62.1"/>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
</package>
<package pkgid="9a1bbd74657853478ce2caa3e3aae47a4bfe333e40dcae02dd9aa46d5730ef24" name="crmsh" arch="noarch">
  <version epoch="0" ver="4.3.1+20210827.4fb174c4" rel="5.65.1"/>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
  <changelog author="XLiang@suse.com" date="1631188800">- Update to version 4.3.1+20210827.4fb174c4:
  * Fix: hb_report: Using python way to collect ra trace files (bsc#1189641)
  * Fix: bootstrap: adjust host list for parallax to get and copy known_hosts file(bsc#1188971)</changelog>
</package>
<package pkgid="59f68bbcfe154857dbee1a4aa26ac32b57ba10fb288837cba5dfafcfdb9239f6" name="crmsh" arch="src">
  <version epoch="0" ver="4.3.1+20210827.4fb174c4" rel="5.65.1"/>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
  <changelog author="XLiang@suse.com" date="1631188800">- Update to version 4.3.1+20210827.4fb174c4:
  * Fix: hb_report: Using python way to collect ra trace files (bsc#1189641)
  * Fix: bootstrap: adjust host list for parallax to get and copy known_hosts file(bsc#1188971)</changelog>
</package>
<package pkgid="c73cad798de4e32b7865177d2130cf23d890024d744e90cabda3ee415a294a01" name="crmsh" arch="noarch">
  <version epoch="0" ver="4.3.1+20211012.52d4086a" rel="5.68.1"/>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
  <changelog author="XLiang@suse.com" date="1631188800">- Update to version 4.3.1+20210827.4fb174c4:
  * Fix: hb_report: Using python way to collect ra trace files (bsc#1189641)
  * Fix: bootstrap: adjust host list for parallax to get and copy known_hosts file(bsc#1188971)</changelog>
  <changelog author="XLiang@suse.com" date="1634040000">- Update to version 4.3.1+20211012.52d4086a:
  * Fix: ui_resource: Parse lifetime option correctly (bsc#1191508)
  * Fix: utils: Improve detect_cloud function and support non-Hyper-V in Azure</changelog>
</package>
<package pkgid="6655c58444988a1d6067bc1235ad7c8cdba6ce33367aab89b047e36c3bf1a6de" name="crmsh" arch="src">
  <version epoch="0" ver="4.3.1+20211012.52d4086a" rel="5.68.1"/>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
  <changelog author="XLiang@suse.com" date="1631188800">- Update to version 4.3.1+20210827.4fb174c4:
  * Fix: hb_report: Using python way to collect ra trace files (bsc#1189641)
  * Fix: bootstrap: adjust host list for parallax to get and copy known_hosts file(bsc#1188971)</changelog>
  <changelog author="XLiang@suse.com" date="1634040000">- Update to version 4.3.1+20211012.52d4086a:
  * Fix: ui_resource: Parse lifetime option correctly (bsc#1191508)
  * Fix: utils: Improve detect_cloud function and support non-Hyper-V in Azure</changelog>
</package>
<package pkgid="35c32b7647ecb42416553f9a301f893b4cf50865ced8de221080af351779645d" name="crmsh-scripts" arch="noarch">
  <version epoch="0" ver="4.3.0+20210507.bf02d791" rel="5.50.1"/>
  <changelog author="XLiang@suse.com" date="1584100800">- Update to version 4.2.0+git.1584013187.b45cfcb6:
  * Fix: crmsh.spec.in: enable completion of crm command(bsc#1166329)
  * Low: crmsh.spec.in: sync contents from NHF's crmsh.spec file
  * Low: corosync: check whether local ip has already configured
  * Low: bootstrap: check whether init node is online while joining
  * Low: bootstrap: for udpu, don't check join node's ip was in the same network</changelog>
  <changelog author="XLiang@suse.com" date="1585137600">- Update to version 4.2.0+git.1585096577.f3257c89:
  * Low: corosync: Improve qdevice configure process
  * Fix: bootstrap: Change condition to add stonith-sbd resource(bsc#1166967)
  * Fix: bootstrap: use csync2 '-f' option correctly(bsc#1166684)</changelog>
  <changelog author="XLiang@suse.com" date="1590580800">- Add patches:
  - Low: bootstrap: Simplify bootstrap context
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  - High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1594382400">- Update to version 4.2.0+git.1594286044.7a596d12:
  * Low: hb_report: Fix collecting of binary data (bsc#1166962)
  * High: bootstrap: ssh key configuration improvement(bsc#1169581, ECO-2035)
  * High: bootstrap: bootstrap network improvement
  * Low: cibconfig: Avoid adding the ID attribute to select_* nodes
  * High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * Low: bootstrap: change ha-cluster-bootstrap log path
  * Low: ui_corosync: print cluster nodes while getting quorum and qnetd status
  * Low: bootstrap: exit with proper error messages when ssh return failed
  * Low: ui_cluster: use argparse choices to validate -i and -t option
  * Low: corosync: Use with statement  to open file
  * Fix: ui_resource: refresh &lt;Tab&gt; should complete resource first(bsc#1167220)
  * Low: ui_context: give warning if using alias command
  * Low: bootstrap: Simplify bootstrap context
  * Fix: doc: Update man page about completion example of crm resource(bsc#1166644)
- Remove patches:
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
</package>
<package pkgid="60db34b890a44516ff54b19be5c7ffa13e07a325c46179add24b2ce67673f812" name="crmsh-scripts" arch="noarch">
  <version epoch="0" ver="4.3.1+20210702.4e0ee8fb" rel="5.59.1"/>
  <changelog author="XLiang@suse.com" date="1594382400">- Update to version 4.2.0+git.1594286044.7a596d12:
  * Low: hb_report: Fix collecting of binary data (bsc#1166962)
  * High: bootstrap: ssh key configuration improvement(bsc#1169581, ECO-2035)
  * High: bootstrap: bootstrap network improvement
  * Low: cibconfig: Avoid adding the ID attribute to select_* nodes
  * High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * Low: bootstrap: change ha-cluster-bootstrap log path
  * Low: ui_corosync: print cluster nodes while getting quorum and qnetd status
  * Low: bootstrap: exit with proper error messages when ssh return failed
  * Low: ui_cluster: use argparse choices to validate -i and -t option
  * Low: corosync: Use with statement  to open file
  * Fix: ui_resource: refresh &lt;Tab&gt; should complete resource first(bsc#1167220)
  * Low: ui_context: give warning if using alias command
  * Low: bootstrap: Simplify bootstrap context
  * Fix: doc: Update man page about completion example of crm resource(bsc#1166644)
- Remove patches:
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
</package>
<package pkgid="d29e4db938bb74539ce51119d3c0879022b71ec53b26320a8eb010368d2fd43c" name="crmsh-scripts" arch="noarch">
  <version epoch="0" ver="4.3.1+20210811.2a30e37e" rel="5.62.1"/>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
</package>
<package pkgid="3b22eb3c9e7a52af26d65b2ccac336d0add46c3a9159da730fb18ca2ac2f0bec" name="crmsh-scripts" arch="noarch">
  <version epoch="0" ver="4.3.1+20210827.4fb174c4" rel="5.65.1"/>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
  <changelog author="XLiang@suse.com" date="1631188800">- Update to version 4.3.1+20210827.4fb174c4:
  * Fix: hb_report: Using python way to collect ra trace files (bsc#1189641)
  * Fix: bootstrap: adjust host list for parallax to get and copy known_hosts file(bsc#1188971)</changelog>
</package>
<package pkgid="fa59b31b46c43e6796aafc8fc33388b7db1a17cf247d5ed192037c5f4e1220a5" name="crmsh-scripts" arch="noarch">
  <version epoch="0" ver="4.3.1+20211012.52d4086a" rel="5.68.1"/>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
  <changelog author="XLiang@suse.com" date="1631188800">- Update to version 4.3.1+20210827.4fb174c4:
  * Fix: hb_report: Using python way to collect ra trace files (bsc#1189641)
  * Fix: bootstrap: adjust host list for parallax to get and copy known_hosts file(bsc#1188971)</changelog>
  <changelog author="XLiang@suse.com" date="1634040000">- Update to version 4.3.1+20211012.52d4086a:
  * Fix: ui_resource: Parse lifetime option correctly (bsc#1191508)
  * Fix: utils: Improve detect_cloud function and support non-Hyper-V in Azure</changelog>
</package>
<package pkgid="0f5452bcf46a569242cf4c7011a106cc66e67b4eca06b3550773f9ed16b1ed42" name="crmsh-test" arch="noarch">
  <version epoch="0" ver="4.3.0+20210507.bf02d791" rel="5.50.1"/>
  <changelog author="XLiang@suse.com" date="1584100800">- Update to version 4.2.0+git.1584013187.b45cfcb6:
  * Fix: crmsh.spec.in: enable completion of crm command(bsc#1166329)
  * Low: crmsh.spec.in: sync contents from NHF's crmsh.spec file
  * Low: corosync: check whether local ip has already configured
  * Low: bootstrap: check whether init node is online while joining
  * Low: bootstrap: for udpu, don't check join node's ip was in the same network</changelog>
  <changelog author="XLiang@suse.com" date="1585137600">- Update to version 4.2.0+git.1585096577.f3257c89:
  * Low: corosync: Improve qdevice configure process
  * Fix: bootstrap: Change condition to add stonith-sbd resource(bsc#1166967)
  * Fix: bootstrap: use csync2 '-f' option correctly(bsc#1166684)</changelog>
  <changelog author="XLiang@suse.com" date="1590580800">- Add patches:
  - Low: bootstrap: Simplify bootstrap context
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  - High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1594382400">- Update to version 4.2.0+git.1594286044.7a596d12:
  * Low: hb_report: Fix collecting of binary data (bsc#1166962)
  * High: bootstrap: ssh key configuration improvement(bsc#1169581, ECO-2035)
  * High: bootstrap: bootstrap network improvement
  * Low: cibconfig: Avoid adding the ID attribute to select_* nodes
  * High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * Low: bootstrap: change ha-cluster-bootstrap log path
  * Low: ui_corosync: print cluster nodes while getting quorum and qnetd status
  * Low: bootstrap: exit with proper error messages when ssh return failed
  * Low: ui_cluster: use argparse choices to validate -i and -t option
  * Low: corosync: Use with statement  to open file
  * Fix: ui_resource: refresh &lt;Tab&gt; should complete resource first(bsc#1167220)
  * Low: ui_context: give warning if using alias command
  * Low: bootstrap: Simplify bootstrap context
  * Fix: doc: Update man page about completion example of crm resource(bsc#1166644)
- Remove patches:
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
</package>
<package pkgid="cd462569d91551c7d781b85467638ace21844ffccfcaf36c8663b6a257c202cf" name="crmsh-test" arch="noarch">
  <version epoch="0" ver="4.3.1+20210702.4e0ee8fb" rel="5.59.1"/>
  <changelog author="XLiang@suse.com" date="1594382400">- Update to version 4.2.0+git.1594286044.7a596d12:
  * Low: hb_report: Fix collecting of binary data (bsc#1166962)
  * High: bootstrap: ssh key configuration improvement(bsc#1169581, ECO-2035)
  * High: bootstrap: bootstrap network improvement
  * Low: cibconfig: Avoid adding the ID attribute to select_* nodes
  * High: bootstrap: using class SBDManager for sbd configuration and management(bsc#1170037, bsc#1170999)
  * Low: bootstrap: change ha-cluster-bootstrap log path
  * Low: ui_corosync: print cluster nodes while getting quorum and qnetd status
  * Low: bootstrap: exit with proper error messages when ssh return failed
  * Low: ui_cluster: use argparse choices to validate -i and -t option
  * Low: corosync: Use with statement  to open file
  * Fix: ui_resource: refresh &lt;Tab&gt; should complete resource first(bsc#1167220)
  * Low: ui_context: give warning if using alias command
  * Low: bootstrap: Simplify bootstrap context
  * Fix: doc: Update man page about completion example of crm resource(bsc#1166644)
- Remove patches:
  * 0001-Low-bootstrap-Simplify-bootstrap-context.patch
  * 0002-High-bootstrap-using-class-SBDManager-for-sbd-config.patch</changelog>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
</package>
<package pkgid="8e48408e84a45f3fa23021d9b9c6981f4c4ecde0d07d3123526678e54f81bc72" name="crmsh-test" arch="noarch">
  <version epoch="0" ver="4.3.1+20210811.2a30e37e" rel="5.62.1"/>
  <changelog author="XLiang@suse.com" date="1595505600">- Update to version 4.2.0+git.1595517298.a06e892f:
  * Low: ui_corosync: copy ssh key to qnetd while detect need password(bsc#1174385)</changelog>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
</package>
<package pkgid="0ba8e6d99a7f4afa53ef32e45e29afdeaee12aa0cf8dc646baece4c93d222324" name="crmsh-test" arch="noarch">
  <version epoch="0" ver="4.3.1+20210827.4fb174c4" rel="5.65.1"/>
  <changelog author="XLiang@suse.com" date="1595937600">- Update to version 4.2.0+git.1595940615.c452cc00:
  * Low: corosync: handle the return code of corosync-quorumtool correctly(bsc#1174588)</changelog>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
  <changelog author="XLiang@suse.com" date="1631188800">- Update to version 4.3.1+20210827.4fb174c4:
  * Fix: hb_report: Using python way to collect ra trace files (bsc#1189641)
  * Fix: bootstrap: adjust host list for parallax to get and copy known_hosts file(bsc#1188971)</changelog>
</package>
<package pkgid="868c970c5f2c72faaa24989a7748208ac02aab2a3f5e23b150e8b44e3e2e5622" name="crmsh-test" arch="noarch">
  <version epoch="0" ver="4.3.1+20211012.52d4086a" rel="5.68.1"/>
  <changelog author="XLiang@suse.com" date="1598356800">- Update to version 4.2.0+git.1598257562.570eb99d:
  * Fix: bootstrap: revert ssh_merge function for compatibility(bsc#1175057)
  * Fix: bootstrap: adjust sbd config process to fix bug on sbd stage(bsc#1175057)</changelog>
  <changelog author="XLiang@suse.com" date="1599739200">- Update to version 4.2.0+git.1599702667.157fc6b5:
  * Low: bootstrap: check whether sbd package installed
  * Low: bootstrap: Improve qdevice configure process * More reasonable naming for variables * More function docstrings * Move function to more reasonable location * Create functions to integrate similar functions inside one * Change big function to small one, more easier for unit test, like: * Refactor functions * Create utils.cluster_run_cmd function to avoid using crm cluster run directly in code(jsc#ECO-1745)
  * Low: bootstrap: swap keys with other nodes when join_ssh(bsc#1176178)</changelog>
  <changelog author="XLiang@suse.com" date="1599825600">- Update to version 4.2.0+git.1599810948.3db12a7a:
  * Fix: hb_report: collect archived logs(bsc#1148873, bsc#1176441)</changelog>
  <changelog author="XLiang@suse.com" date="1601035200">- Update to version 4.2.0+git.1600915005.e8089225:
  * FIx start_delay with start-delay(bsc#1176569)
  * fix on_fail should be on-fail(bsc#1176569)
  * Low: config: Try to handle configparser.MissingSectionHeaderError while reading config file
  * Medium: ui_configure: Obscure sensitive data by default(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1602244800">- Update to version 4.2.0+git.1602225426.5f84efb5:
  * Fix: hb_report: fix sanitize functionality(bsc#1163581)</changelog>
  <changelog author="XLiang@suse.com" date="1604318400">- Update to version 4.2.0+git.1604052559.2a348644:
  * Fix: hb_report: collect corosync.log if it defined in config file(bsc#1148874)
  * Fix: ui_cluster: check service status while start/stop(bsc#1177980)
  * Dev: bootstrap: stop service which is active, not which is available
  * Fix: bootstrap: Stop hawk service when removing node(bsc#1175708)
  * Fix: cibverify: give warning if crm_verify return warning(bsc#1122391)
  * Dev: doc: remove score related in doc for rsc_order configure
  * Fix: parse: convert score to kind for rsc_order configure(bsc#1122391)
  * Fix: bootstrap: remove specific configured address while removing node(bsc#1165644)</changelog>
  <changelog author="XLiang@suse.com" date="1607083200">- Update to version 4.2.0+git.1607075079.a25648d8:
  * Fix: bootstrap: use class JoinLock to manage lock in parallel join(bsc#1175976)
  * Fix: utils: improve disable_service and enable_service function(bsc#1178701)
  * Fix: bootstrap: disable corosync-qdevice if not configured(bsc#1178701)
  * Dev: hb_report: change the default dest data format, more readable
  * Low: bootstrap: should include /etc/sysconfig/nfs into csync2.cfg(bsc#1178373)
  * Low: bootstrap: minor change for _get_sbd_device_interactive function(bsc#1178333)</changelog>
  <changelog author="XLiang@suse.com" date="1608292800">- Use Path.mkdir instead of mkdir command(bsc#1179999); Add patch:
  * 0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1610539200">- Update to version 4.2.0+git.1609987436.0d3a9bf5:
  * Fix: utils: skip if no netmask in the result of ip -o addr show(bsc#1180421)
  * Fix: bootstrap: add /etc/modules-load.d/watchdog.conf into csync.cfg(bsc#1180424)
  * Low: bootstrap: make invoke return specific error(bsc#1177023)
  * Fix: bootstrap: Refactor join_lock.py for more generic using purpose(bsc#1180149)
  * Dev: bootstrap: use ping to test host is reachable before joining
  * Low: bootstrap: check cluster was running on init node</changelog>
  <changelog author="XLiang@suse.com" date="1613995200">- Update to version 4.3.0+20210219.5d1bf034:
  * Fix: hb_report: walk through hb_report process under hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Fix: bootstrap: setup authorized ssh access for hacluster(CVE-2020-35459, bsc#1179999; CVE-2021-3020, bsc#1180571)
  * Dev: analyze: Add analyze sublevel and put preflight_check in it(jsc#ECO-1658)
  * Dev: utils: change default file mod as 644 for str2file function
  * Dev: hb_report: Detect if any ocfs2 partitions exist
  * Dev: lock: give more specific error message when raise ClaimLockError
  * Fix: Replace mktemp() to mkstemp() for security
  * Fix: Remove the duplicate --cov-report html in tox.
  * Fix: fix some lint issues.
  * Fix: Replace utils.msg_info to task.info
  * Fix: Solve a circular import error of utils.py
  * Fix: hb_report: run lsof with specific ocfs2 device(bsc#1180688)
  * Dev: corosync: change the permission of corosync.conf to 644
  * Fix: preflight_check: task: raise error when report_path isn't a directory
  * Fix: bootstrap: Use class Watchdog to simplify watchdog config(bsc#1154927, bsc#1178869)
  * Dev: Polish the sbd feature.
  * Dev: Replace -f with -c and run check when no parameter provide.
  * Fix: Fix the yes option not working
  * Fix: Remove useless import and show help when no input.
  * Dev: Correct SBD device id inconsistenc during ASR
  * Fix: completers: return complete start/stop resource id list correctly(bsc#1180137)
  * Dev: Makefile.am: change makefile to integrate preflight_check
  * Medium: integrate preflight_check into crmsh(jsc#ECO-1658)
  * Fix: bootstrap: make sure sbd device UUID was the same between nodes(bsc#1178454)</changelog>
  <changelog author="XLiang@suse.com" date="1615204800">- Update to version 4.3.0+20210305.9db5c9a8:
  * Fix: bootstrap: Adjust qdevice configure/remove process to avoid race condition due to quorum lost(bsc#1181415)
  * Dev: cibconfig: remove related code about detecting crm_diff support --no-verion
  * Fix: ui_configure: raise error when params not exist(bsc#1180126)
  * Dev: doc: remove doc for crm node status
  * Dev: ui_node: remove status subcommand</changelog>
  <changelog author="XLiang@suse.com" date="1617192000">- Update to version 4.3.0+20210315.5d07d43e:
  * Fix: ui_resource: change return code and error to warning for some unharmful actions(bsc#1180332)
  * Fix: bootstrap: raise warning when configuring diskless SBD with node's count less than 3(bsc#1181907)</changelog>
  <changelog author="XLiang@suse.com" date="1618315200">- Update to version 4.3.0+20210330.06bf9cad:
  * Dev: ui_cluster: enable/disable corosync-qdevice.service
  * Fix: bootstrap: parse space in sbd device correctly(bsc#1183883)
  * Dev: preflight_check: move preflight_check directory into crmsh
  * Fix: bootstrap: get the peer node name correctly (bsc#1183654)
  * Fix: update verion and author (bsc#1183689)
  * Dev: bootstrap: enable configuring qdevice on interactive mode (jsc#ECO-3567)</changelog>
  <changelog author="XLiang@suse.com" date="1620388800">- Update to version 4.3.0+20210507.bf02d791:
  * Fix: bootstrap: add sbd via bootstrap stage on an existing cluster (bsc#1181906)
  * Fix: bootstrap: change StrictHostKeyChecking=no as a constants(bsc#1185437)
  * Dev: bootstrap: disable unnecessary warnings (bsc#1178118)
  * Fix: bootstrap: sync corosync.conf before finished joining(bsc#1183359)
  * Dev: add "crm corosync status qdevice" sub-command
  * Dev: ui_cluster: add qdevice help info</changelog>
  <changelog author="XLiang@suse.com" date="1623844800">- Update to version 4.3.0+20210616.cdcfe52e:
  * Fix: history: use Path.mkdir instead of mkdir command(bsc#1179999, CVE-2020-35459)
  * Dev: crash_test: Add big warnings to have users' attention to potential failover(jsc#SLE-17979)
  * Dev: crash_test: rename preflight_check as crash_test(jsc#SLE-17979)
  * Fix: bootstrap: update sbd watchdog timeout when using diskless SBD with qdevice(bsc#1184465)
  * Dev: utils: allow configure link-local ipv6 address(bsc#1163460)
  * Fix: parse: shouldn't allow property setting with an empty value(bsc#1185423)
  * Fix: help: show help message from argparse(bsc#1175982)
- Remove patches:
  0001-Fix-history-use-Path.mkdir-instead-of-mkdir-command-.patch</changelog>
  <changelog author="XLiang@suse.com" date="1624536000">- Update to version 4.3.1+20210624.67223df2:
  * Fix: ocfs2: Skip verifying UUID for ocfs2 device on top of raid or lvm on the join node (bsc#1187553)</changelog>
  <changelog author="XLiang@suse.com" date="1625227200">- Update to version 4.3.1+20210702.4e0ee8fb:
  * Fix: bootstrap: check for missing fields in 'crm_node -l' output (bsc#1182131)
  * Fix: resource: make untrace consistent with trace (bsc#1187396)
  * Dev: sbd: enable SBD_DELAY_START in virtualization environment</changelog>
  <changelog author="XLiang@suse.com" date="1628683200">- Update to version 4.3.1+20210811.2a30e37e:
  * Dev: ui_resource: Enhancement trace output
  * Fix: doc: Note that resource tracing is only supported by OCF RAs(bsc#1188966)
  * Medium: ra: performance/usability improvement (avoid systemd)
  * Dev: ui_context: Add info when spell-corrections happen
  * Fix: parse: Should still be able to show the empty property if it already exists(bsc#1188290)</changelog>
  <changelog author="XLiang@suse.com" date="1631188800">- Update to version 4.3.1+20210827.4fb174c4:
  * Fix: hb_report: Using python way to collect ra trace files (bsc#1189641)
  * Fix: bootstrap: adjust host list for parallax to get and copy known_hosts file(bsc#1188971)</changelog>
  <changelog author="XLiang@suse.com" date="1634040000">- Update to version 4.3.1+20211012.52d4086a:
  * Fix: ui_resource: Parse lifetime option correctly (bsc#1191508)
  * Fix: utils: Improve detect_cloud function and support non-Hyper-V in Azure</changelog>
</package>
<package pkgid="a141751b9c68d20fb22ce6141b323e17e9e8ab7473147ab6f3c556d3aee09f42" name="cron" arch="aarch64">
  <version epoch="0" ver="4.2" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="4092f08b7e14f4bb32dacc007a7b4e22d03e128923fc8692775f6a84c35df8f3" name="cron" arch="ppc64le">
  <version epoch="0" ver="4.2" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="cab121f330a8efe881a20ef11c75ad1daff0da30c0c97684e3547b9e9e26aa64" name="cron" arch="s390x">
  <version epoch="0" ver="4.2" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="7c22975ecb296efd147fd9b4b446b9ecca2a7947f4105c2660d62d72605bb6b9" name="cron" arch="x86_64">
  <version epoch="0" ver="4.2" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="495c7ddf01fb5450a248aab8d9e01985b07bf83c35b6ac6ed2e39b0add997252" name="cronie" arch="aarch64">
  <version epoch="0" ver="1.5.1" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="523c04f5e8ae90135a01ae5da2466951c2da7f2b12ccdfbe32805b9c7f4544af" name="cronie" arch="ppc64le">
  <version epoch="0" ver="1.5.1" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="406141141a6b6d68a33ab63579d384c04961f1cd184e8cb176797e8c44b2fb1c" name="cronie" arch="s390x">
  <version epoch="0" ver="1.5.1" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="b741a847b3157facb08b25113b00f52ab998a978551584f693647d6d1f5c2cd6" name="cronie" arch="src">
  <version epoch="0" ver="1.5.1" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="3ddb0107222450aeff959e0b03fb263e0c5d2311b8c9e4c039169c9931de447c" name="cronie" arch="x86_64">
  <version epoch="0" ver="1.5.1" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="44b3cd020e3d50816dcf6f4cd26ad0cd97e5eb7caa87ff5bf65e342475488fe0" name="cronie-anacron" arch="aarch64">
  <version epoch="0" ver="1.5.1" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="4856a189ec39b60deb7957aec694e9b71c2ee8edb78d4d36f5630c4de968aa4d" name="cronie-anacron" arch="ppc64le">
  <version epoch="0" ver="1.5.1" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="a8fe1c68481b88c023b749f3eb20d395fc203f5b6b00b6623bd310dea37d76a9" name="cronie-anacron" arch="s390x">
  <version epoch="0" ver="1.5.1" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="95e9b05ffd702d97fd2a785c95152232c992674b6c045c821c06422da8a0ffef" name="cronie-anacron" arch="x86_64">
  <version epoch="0" ver="1.5.1" rel="70.14.4.1"/>
  <changelog author="tchvatal@suse.com" date="1434974400">- Redo the post/pre update approach to fix migration from SLE11.
  Should fix bnc#919028</changelog>
  <changelog author="tchvatal@suse.com" date="1435060800">- Start cron after sssd.service bnc#926961</changelog>
  <changelog author="jmatejek@suse.com" date="1435233600">- add support for MAILFROM, MAIL_CONFIG and different mailer binaries
  in run-crons (bnc#812367, bnc#366762)</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435233601">- revert last change, it is a bug in sssd.service, fixed in
  SR#313709</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1435752000">- cron.service: Use KillMode=process like upstream does.</changelog>
  <changelog author="tchvatal@suse.com" date="1473336000">- Add fix for bnc#983925 to run crons even when not on AC_POWER
  * Nowdays it does not make much sense to not run crons when on
    battery and actually it can even confuse people</changelog>
  <changelog author="kstreitova@suse.com" date="1475236800">- remove the omc xml config that is useless nowdays</changelog>
  <changelog author="kstreitova@suse.com" date="1490270400">- cleanup with spec-cleaner</changelog>
  <changelog author="kstreitova@suse.com" date="1490702400">- update to 1.5.1
  * crontab: Use temporary file name that is ignored by crond.
  * crond: Inherit PATH from the crond environment if -P option
    is used.
  * crond: Remove hardcoded "system_u" SELinux user, use the
    SELinux user
    of the running crond.
  * anacron: Small cleanups and fixes.
  * crond: Fix longstanding race condition on repeated crontab
    modification.
- refresh cronie-pam_config.diff
- get rid of %{name} macros in the patch names
- use %{ext_man} macro for anacron man pages
- fedorahosted.org was retired on March 1st, 2017
  * update Url and Source address</changelog>
  <changelog author="kukuk@suse.de" date="1503316800">- Require group trusted if we use them</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="kstreitova@suse.com" date="1511524800">- Requires smtp_daemon (not just Recommends) as it's needed by
  run-crons script [bsc#1064834]</changelog>
  <changelog author="jsegitz@suse.com" date="1511784000">- Ensure that /etc/cron.{hourly,daily,weekly,monthly} have proper
  permissions and owner. This is racy but prevents some LPE vectors</changelog>
  <changelog author="rbrown@suse.com" date="1512043200">- Requires mail as it's really needed by cron-crons script, not
  smtp_daemon [bsc#1070565] [bsc#1064834]</changelog>
  <changelog author="kstreitova@suse.com" date="1552824000">- add cronie-1.5.1-huge_crontab_DoS.patch to fix two security issues
  where users can cause DoS of the crond by loading huge crontab
  files. We now allow maximum 1000 environment variables and 1000
  crontab entries. Also the comments and whitespace between the
  entries and variables are now limited to 32768 characters.
  [bnc#1128937] [CVE-2019-9704] and [bnc#1128935] [CVE-2019-9705]</changelog>
  <changelog author="kstreitova@suse.com" date="1553860800">- update cronie-1.5.1-huge_crontab_DoS.patch to fix a regression
  that caused that only the first job from a crontab was being run
  [bsc#1130746]</changelog>
  <changelog author="kstreitova@suse.com" date="1558008000">- remove cronie-nofork-nopid.patch that allowed running of multiple
  "cron -n" instances at once which is an unwanted behaviour
  [bsc#1133100]</changelog>
  <changelog author="kstreitova@suse.com" date="1572955200">- update cronie-nheader_lines.diff so it doesn't print the first 3
  crontab lines (static comments) with the 'crontab -l' command
  [bsc#1155114]</changelog>
  <changelog author="kstreitova@suse.com" date="1574251200">- drop 'checkproc' line from the run-crons as the usage is bogus
  [bsc#1155929]</changelog>
  <changelog author="danilo.spinella@suse.com" date="1628251200">- Increase limit of allowed entries in crontab files to fix bsc#1187508
  * cronie-1.5.1-increase_crontab_limit.patch</changelog>
</package>
<package pkgid="43bf80dcbe5b89f1cf3e8bd8477d2b4c70eb041168155f72da0bf7147f46b787" name="cross-aarch64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="7f7da789223d064fabbc0aef99956bd5bb6e94310ce2f007bc913b52f30ffa55" name="cross-aarch64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="524dd2d4c0aa52668a0e048d9cb1c01653721e35c4fdd7679cd6b351cf49e811" name="cross-aarch64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="9e9173109937990f5b1087e5048ca5bc3fc1f1daf53e33e3cbd4a816822a0ea0" name="cross-aarch64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="c68b3a02280b4d2f9b8097fa0a4577a1c3eb874df7dbff12773f458df182094a" name="cross-aarch64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="5c14c370613c661817830f4e5f2cc984439037a887a003855f7bd9b64640f734" name="cross-aarch64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="9a7fb6068d78afd87c654e5bf05bd969f019b123ece76445afa840e5a9ac7488" name="cross-aarch64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="2067b7658b42a08ade9758afa138e799d141d9ffb67e6ac59ca462763417962c" name="cross-aarch64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="0061df9e417628cadd8c8e72e497f43a1920212eeb87618e1128337c90d37ee0" name="cross-aarch64-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="7a3fcf7bb1bf117c21cfe513bb376e8039a2188bbba9574698d4744768e2d24f" name="cross-aarch64-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="1b6add1004e7967b9b636f3e56854ac187dea18f6f8120efdb904446202f3de0" name="cross-aarch64-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="3d4009c7289a7650b12698ac964f3694395ab40e968ffed00d901448a77ab48a" name="cross-aarch64-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="0fd8046fb7c0ad6d85858e6ee4a25a1815ddf18ae74d493041c17c2b2f126b65" name="cross-aarch64-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="c8e71ae1ad4a3b27b8ce95278c5d2694ba86a1aade3d47004842ef42ed090714" name="cross-aarch64-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="ff2d4ba47116ef691d72f566de475b221e15270af1aa2b574b8229acecea119b" name="cross-aarch64-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="e439495a202ff2aabd29304de8b4a71e83fb2a72770ac1c3891332e0ff51fe5c" name="cross-arm-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="a57846fbfe4ec079323bc32226f58f5c6a09c5de8ae6ddb06cf6bd8d8891b1a3" name="cross-arm-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="b14bab263ea7c60d24b43330997754c72d00d883e21534baae5d8173d2f6581a" name="cross-arm-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="40502f1205af04a75fa316c35037b42ef307796123830f147862daa5426cd7f1" name="cross-arm-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="292d2f48ab9819f3f6c0ed4e504ddfa19a6437de73958c28e9d18812b1b819b0" name="cross-arm-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="fe87c6096f3d5a21ef166bd35742c0a9201eb8cc4c259ec6c68d5c31d78efe9d" name="cross-arm-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="cab2b7463f2f9e923298ab9b32c87bc038e8c4e0851a7c94ab6810e12787517a" name="cross-arm-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="57847e5e72b5bfdcfea5211540ae19f6502126da0480de3f1ae9ff83f9bd1d1c" name="cross-arm-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="55a99a69a1294afc4371ad7f65089a492a228e2a99243c390bad3e6f67a49bd4" name="cross-arm-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="7e226d6d573367978a9036ed873c59ab9163f3f693cc7ee05634dadbd8535116" name="cross-arm-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="b12fba474ec61a71976c7fb264f25a04a55a4a5cee874f8984bab371828bd362" name="cross-arm-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="653676963b65b1e750025a6f78c00b419ab2fa9c9aadbed3f30a8cc2f92c8031" name="cross-arm-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="2e8905297c7eb245d8fb9fb6d037fb87423fb46c458fd7edd551f7c11f0cf920" name="cross-arm-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="fbb27a892deb19aa26c9ed28883e295190d76a0451693cc28d7425ac8de932ed" name="cross-arm-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="c6f667d68b9ec2d1d15d61317754e1c44702b2cb122eebeb8da1a806167a76b3" name="cross-arm-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="1ae55fe91467a0946ddc3faa8365d611ca1f299f0263d115d421008afe4f8a03" name="cross-arm-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="1fb9123ee7e504fe7a1b510e321b2cfbb7759c18c8a39adf9544825035c3e8ed" name="cross-arm-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="c4b50b11f7ffb18f307c1120405c6c5937cd24e2f372a8ffd30eb059ac05e7d8" name="cross-arm-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="4ef5d8640b5e38667985ead3350de59cb2609f5480f770fadd886be02c825dbc" name="cross-arm-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="0cccb1febd0b01b02d79a302ced31f47167188e27a5a70fea3542fa539554d3e" name="cross-avr-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="b4b63c3f2f889ee9f617b990434e1fc32670e46b09f5c130833aa94d3767cbe4" name="cross-avr-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="bc739785454fc53661437a3ef1e436c20f1ec5700f0a847be1ff99d921d69d64" name="cross-avr-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="fc39dff775ef5e5c64f5d9d19a3eea0a5b98ad3d04786952da9f552f3c5d5313" name="cross-avr-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="bff308fb3fd115adede6c2a77bb5d4b246e1a2432683fe874ee533bba4db1a0f" name="cross-avr-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="777ba7a3a2953495e32264d0e498c0c72640de5319bbfcb600b1f09d560c7dcf" name="cross-avr-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="6c7bc77fea74284364712471b20a4e59ef8e865e4429980dca1156b4ed9b25b9" name="cross-avr-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="996f90dd95bea83d8ea4bc9085f802449bc8aea3a40b033f3e60f7025b5196db" name="cross-avr-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="abae0189bde51c0ff9e33192630dad0030b170df5a7232569fcfb4b5038a794d" name="cross-avr-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="fe9c7320a679d7b3dd9dbf8c14619130cd93e9366fbbcbe506a084df962c5779" name="cross-avr-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="ff8758e6b0d826c4739b6f3b5f1acb0a073a863f0fb08a7ee100a05500a3f824" name="cross-epiphany-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="4febe0c9e3624a891e0c56a4eb2480d8a6eb2f50b69d516e1cad72a3aca06bcc" name="cross-epiphany-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="c0e3e82a6e53b72d68e5c6444fb360ddbcf951cf5a49855961f0423d67e863f5" name="cross-epiphany-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="0a226ec99e715d864135494da8b2ce21553b67ba99817c6e940029c2965e10a4" name="cross-epiphany-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="6e74cd012603fea0d14b57e115a60fbbe2c59a88c99ec3b5abafef48dae21a04" name="cross-epiphany-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="1f5973d3d9743987439568809aa431356938a442fb0faff18cc648982812d8df" name="cross-epiphany-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="d824a3a26d9b858ee4242018dbc898e5b0604a76f24191c925f63ff21b6c17ce" name="cross-epiphany-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="e9bc4cb4a5fe73f86405ceb2f13e7f58c6de210944a0bf4eb7fd891cbd96aaa0" name="cross-epiphany-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="37fb3280513bc44ce8fec23321e0410eb1878477ce4c0595993a44bff970630b" name="cross-epiphany-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="0957208e8883d27c520fec5f87b6c4efbbd1766df746d895b951b2b64e7d362c" name="cross-epiphany-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="0f9f9376d610379d4a52bbf36cd25f86b952a38d324c9552c2bc7a5ebba9f810" name="cross-hppa-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="b3ac3eaccef18c3f62344e5dda8bfee9516535806d4d35d94c3779c20ded7818" name="cross-hppa-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="dc46e3f482af709d78a5322a9a06dbfb59ddf2ab55976dfb92b087d3c5e10e62" name="cross-hppa-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="c205053c96e8c283b582ce49c31c194ce5f68f0335397a708f9e2c80210e7ee0" name="cross-hppa-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="a0cbf913bead2d6a685e2db46638fa17872dcf8ef1548ea8204dd87c0b7c447f" name="cross-hppa-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="7849db75282cb975610e8fe76b019e55a5cc14245b522b5dbc1d105eee713050" name="cross-hppa-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="d476361272a680c8a35e32fa77bc76fcfd179f2a28840947ecafbb7a6890165b" name="cross-hppa-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="e3272d6183a1b68b1e54686a28a2f50be4f92fdce06cb5adee3fcafb55f41de4" name="cross-hppa-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="0390c953b38cd3a8f1869155c5495c0d458964e3478d0b7b5831df1e1286503d" name="cross-hppa-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="53743fdadd2c4171ca56162ffef20579337975ae57028959be9fc997881f063c" name="cross-hppa-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="54cb7b5e9a441ce0d81b151796897d31b8aa359191c3499fb3556b19469de4d1" name="cross-hppa-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="0fb1065436d3f5edfacf620c39201f9d27f694c12f356cc3293aedfd8a35979e" name="cross-hppa-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="6d0fd957bb53348a69c4a9fb36abd27d4b5c5489b1315fe061a60f8f1cc5a6f6" name="cross-hppa-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="2de18b8fcfab80d3627cce5f0703e4d0dd7b2ee230d7e5db7a115e72ea11affa" name="cross-hppa-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="91b44e60bdf8aca2b002ae8c14822505377ca38253ed4e6092390ec287695e22" name="cross-hppa-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="5602da269a1a24a533330dca26eaa33b98b09bf20d5a0ad813955b4df6d46180" name="cross-hppa-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="841843f993fa228f68135a4d4a33822e6038f2fd5db296b5f0a871eddd4d1814" name="cross-hppa-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="22b1036138560eb6765bcc31f25cba453a9657441aa6d829675013fe10c33d70" name="cross-hppa-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="ffbef0a4d0198d2a11b498a823de2fab8fa8735208fa4b590d60a63b4060dd5c" name="cross-hppa-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="c77ae9eefa0ef07f1add465f3e3463b9ab651c3e9eeb3dc65d86c76175a1327a" name="cross-hppa64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="db31ff40d5a21fccc8793b9950eb70df990144c136633c255e93754cc2057c50" name="cross-hppa64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="13ccaae4230b6ecb3b24613b9ddc755add0c29056d87044fe6337c6eea0a832a" name="cross-hppa64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="96b4ee2663c64a72a7b99c73839c99a08843d8f30ba79c4f0d470eb0275fb1e3" name="cross-hppa64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="9005c3bdd3bdedc15bb385381364af8acbe196f2aa0af52e6116d30427217513" name="cross-hppa64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="8eaa916ed42dc904ebe09014f6b424a4bd080aa91872e21c5f51a96c913ce9f6" name="cross-hppa64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="9d22587dcae7a77ed76447750ac237745958416b78e77ba8c2918bb47c4cf0e8" name="cross-hppa64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="04ca0bec2ee81fbca60ae3b1b16e1b2f8cb3980518500a536c0a658944c12f19" name="cross-hppa64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="9ee7255413658edbb57601e9c46027fa56cd0b1328e7f0c4c9d7ac4e3d6ce6a6" name="cross-hppa64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="51c346fe253c18a53130fac481515612862213e2339bfe43de63b23fac269584" name="cross-hppa64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="8938607bbd4d7068dc124e4aa18b376daf5b69912102678b5d73871fc84c9cae" name="cross-i386-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="93504cd16ba7a9ebb272273a3dc58b1fa6a36cbb5fe933c0561ce27a495abb24" name="cross-i386-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="1959029a3e20fa2f04b2f60ead886f3bbb728d3c63009027451b339fae00b73e" name="cross-i386-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="c77f44a19d4fe02ca0ac2bef165b93457b67726425455aa3f9b73d930d5dea8b" name="cross-i386-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="4a59b45997dd1b3afa8c5c7a5573d259eed41e3490753599ca4d20e05765a364" name="cross-i386-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="d43a85bf8cbaea4be3e345dff0bf34dd40419380439dbe7660bfd8280933e559" name="cross-i386-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="7a8e14e715e57bc8f206806dfa74f0d2fdb22e845c6df3baa1e973eebffc5bc2" name="cross-i386-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="7ff879d291f2d21af110d3ad815656f250565adae49bda4a7814180280f199ee" name="cross-i386-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="6e91824640f5173432c7d1ae320ce98d1b4abaabfb3e763cce3c0c0d1cb805bd" name="cross-i386-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="dc099628e5d34e390cca0ea714307159cedd25763e03296b36829d93b461388e" name="cross-i386-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="e3f06da2f50128d5752d3b4714726519655028b314a50116e54ca0a95658ddef" name="cross-i386-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="6af794eae0db28f7cbcd09374f2f309d269fcc3d3c37cc2ee17705cb83b40626" name="cross-i386-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="780f944f258b8fab0e0d6e5d43bb3e43a2e429bcaf9597c7306b7d6f6147f998" name="cross-i386-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="ed29c512d8afb7cab1bbd08f2e74ede6c0a27357e4561794882f937d1c648385" name="cross-i386-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="43dac4b85ea4057a894cee03bce82a95ca8e02f89f096cf91a1e43764d50a863" name="cross-i386-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="2d9fb4d50839247c9b0846b9f3a3a25af8dab8ef629c4f520289c2d2ea5a7b01" name="cross-i386-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="3cec72fa9651142df07c8c82c5366848c2db4ecddc4dbc72b20478289b5d63a2" name="cross-i386-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="c5f231e3663b3fb019df44082afad9080bfd9a4a1c3ca0df36b2461ef8816f85" name="cross-i386-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="b15acd1e82eec851b765c443e5eaa8be2ab299152d55c788445922d1fc74eef6" name="cross-i386-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="78b5060dfd158cf9d354cb77086070e843cb71d24ad7e341ffca38b847a5e785" name="cross-ia64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="e1364f3e6c1574b89b30c39643a7d4cc8b78906cbb1cac67c276564345d879ec" name="cross-ia64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="68f2d40bae9f59cf877dff5a9f564d4b8ce10d79cabae72c05ba79a8ccd4b366" name="cross-ia64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="5d668ec93baea2a174bdca91500392fbc14581c8f881b01f3062bfe0a1264cd4" name="cross-ia64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="af7fc93c4e98d738c42b9254d8945f08f7771df6d6a9ce368df458f7ad25c1d2" name="cross-ia64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="b9fa4456b445c41a97ee56b671d4029e50b4e61dcf17442c3052aaf3c72e9ff8" name="cross-ia64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="3d3fad0b5e09f4d910bc19c0856539e881bda92dc54bd8eaaad6b405713466e8" name="cross-ia64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="8707055ff790f8a7bc3a4848d418cb72f8b2fda980975c34bfbfb5b367467503" name="cross-ia64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="6e836dd28972328d2c45095e2c925925110ff0e9714a71a18e20c786ca1902dc" name="cross-ia64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="137dcfa64f617da519aa359671461c26c486a4e03e28fa8fad38538dc9ae19e0" name="cross-ia64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="2d0249b0ef0699d2c74c3e6d024089bcf2b737887f6d998ef1fd48d8158b1b00" name="cross-m68k-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="92ff5389c4e60888afff352631e4182143ac84bf492477473074182ba5c823a4" name="cross-m68k-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="e89802a34db7040978074e54c789befb17e9c19348f132ebe22bc7718991fe00" name="cross-m68k-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="cd905921a83e49969a60d3e795d32dd7b9a1ec0676d9a8d5b5b046fdbd3deace" name="cross-m68k-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="cb71b305e4130f5ac3f770a11d113e07685e14be7fe95b330067278659ca4de5" name="cross-m68k-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="3ce30eca765327419b5a44489e5f20e0160923f2028dd1e6712c78032af7116f" name="cross-m68k-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="b778d0196a07fc9bf68ffaeac56e095caf1f618322be2984b0f6ee35a55da6de" name="cross-m68k-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="05d4302bafa7f549be5ee7860b8057776e537dd02232701a5442f07f9e2b9702" name="cross-m68k-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="4181d5323167dfdc4237900fbf30d2d691ed73fbfdcd9b71b9a3a83a4ec4862e" name="cross-m68k-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="34a8c2bb7c31d6e60a828436c7b12bda1f86cf57dac5b2718933875e384976ba" name="cross-m68k-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="ad004128ed106920b2d26124c0ef6c748276e849091df470f3ad4cb89e97f15f" name="cross-m68k-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="30198cfdd7384ed0ad3f72eb3c790edcdabfa1b97403c55748ce16f2e664a35e" name="cross-m68k-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="fbb03ed05786272164ff0349f7f756c8d936e6be2b81e77b52c6902c7cb6a934" name="cross-m68k-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="cb6a7442651a9cb5c7bf0758a0385ebb2aab48fe0dc4d936dc47263024293a8f" name="cross-m68k-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="640a7b20d2d66e70a24a5d7cadcc978b4be1035e8081c5d2f184f8ce6d763191" name="cross-m68k-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="4fcb6756de035a78ebd90cdbd5f6adc4afdf0ad2705ad543b912356aff18f246" name="cross-m68k-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="bbaf86f55f1b4527771fe86b01b4133cf79eca1f69ebacb1d21ce5aed8e458af" name="cross-m68k-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="02f30945f0901fc3c836c90d9e572eed03475d3a9254d4553bafe2de3adf1c65" name="cross-m68k-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="255236f20e8e670945fb262a5d9753b0dd1b7441946c17dcf119c3e96fb333bc" name="cross-m68k-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="159c687c90e41a2e8c2cf668b5c369cc6690e494d2eac305e8700a9e30b7786b" name="cross-mips-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="eddf3aeeb486a0bf7195a23829fc35abf091af73e5a2889925b226415710f555" name="cross-mips-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="47c13d2979611e6732ed10e773a56e01d4628f1e1e148af80d270159b3e91fa1" name="cross-mips-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="49fd75c8dd3cc54af0a0fac1408a524e5337ff45055dfab170676e8e4b1e2ca1" name="cross-mips-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="6d655cb33b3d7073777ce8bce2588816676a5a353411d480663ccc263ed5b88b" name="cross-mips-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="76570557c5085b7d044edda758de95d1f3f011c4ecf85cdd25cce37ef7b9ea88" name="cross-mips-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="ed04301c0105f90575df49223a573524fb9ac006e8d7a47679c3c76ea85fcf7d" name="cross-mips-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="8492cdfc84e077270aea96907d906fc0b40d8f4adafd9254d2eee1116c1b7670" name="cross-mips-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="a1a5eb5efe61eef792cae8a4776ab931df8b75c65d93bffbac1d53ffff8e230b" name="cross-mips-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="966127e6d50017883726468accd52e9ce4f96164b69d9670d2755b7fd0d075a1" name="cross-mips-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="f91ebfc39d04887e0723b298fe091994ca5d39d8d8cfae476c2a24be1f11cb3c" name="cross-mips-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="53e6e22747ab803871823e53242c4dbf0d1031866325308d0c49a8f38e57f53e" name="cross-mips-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="4870dcb90bde93730f2c2b6dcad27d0effefcfc6c938599518409e2dc6b4f803" name="cross-mips-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="45b878e0e76c694dbe6c6186ee78919b77047b2b23db94d78cf324ac8fa69e3d" name="cross-mips-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="dce3700f83fa210774e243d0e859af70ee8dcd801b7f65e64eb0fbe4e11ea4aa" name="cross-mips-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="d3f8abc017b2ed826f8699bf9520fde07cc6aeaf02cc3af3f69f4aa063fa56c4" name="cross-mips-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="870f7f777369b3e6fdd7101ee567ea2acb349869831fd94d127ae3cb30c78319" name="cross-mips-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="af9f1814f427cba065119bc9c90d839c3464ee87c504f28e92dee3dfafb825df" name="cross-mips-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="32d65db73565648ec01c836ada95f683d0959a489d10d3ce85b5b40b270a649b" name="cross-mips-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="8ac10ff63ce2894f62d0c88e5c2196355b7a41d0ff37b9834a29e9186d63e464" name="cross-nvptx-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="79ee4b241b45b4c33f9621b0c652841f92aad0698659cf6d0fe14656c7f4ac63" name="cross-nvptx-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="a2f7ccb4f2699065c434ed6a2bf597fc56062d6ee0c558bb0d964ec999d45762" name="cross-nvptx-newlib10-devel" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="5d3f0d9009068371b27a83e8ac0ba60c5ce577f79f46989db52b1e46ec23853a" name="cross-ppc-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="560fbbe8fe9f9eb72bd8b162c68c608ab695c7f72b0041269d0aaf81d8f43062" name="cross-ppc-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="b772e2b7a0ce7eec5264b87f92f305f3d41c649dea251c9ef23298ae10e08bb5" name="cross-ppc-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="ad8813fe93808a401efa45b094a8b1f9ee3d1db97f74229aeec2869f6d07a1a6" name="cross-ppc-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="e9a74bfc23266acb5013307b8164fec8a26c378db9df09d3dd80185e75a849e5" name="cross-ppc-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="c315742284742a374ce19ac69de1de6dc51f0316a90d507f152fa5ed3bea6d1e" name="cross-ppc-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="5d8d2edab6c14b485acf391a1a8e1cd3764eb7c4c88a2fd78e520906620c1543" name="cross-ppc-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="a5e1044817f1a6949b4aee6f5a9a1d2e18d5433c881fd0c8472f883a7ebcb474" name="cross-ppc-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="61f30a334cf2a2e296cfefaf55490b6fefb531f327d75eb14bd10f5451437d7c" name="cross-ppc-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="c18a320455af99793ca3e3040e827576d711c25896627bf670da4b374b36a81a" name="cross-ppc-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="f4db4d7638db57136da399d5b4e1d017a771fa886b4b0e6ae20ca66a3fa52dfe" name="cross-ppc64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="05ded6c563d7df24907ee1582f1514f54db11fb389a70022e10375d819d194e8" name="cross-ppc64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="15debb18762f52402dfdf40cf80ae2da3a5ae67223e733c0e1a9da570bc54634" name="cross-ppc64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="4cf50564474f08d389653ba0762c644c81017cbfdf7c555fcfaea9249ed06344" name="cross-ppc64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="1e036518fe9f24ace50bfaccb02cd52c0002d048d723f48149fd0934eac6ceb4" name="cross-ppc64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="5738f44a959f6bcb6338706afb006ccab1b3087f79a33662452624b6ad535f05" name="cross-ppc64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="ef18b4dadb90fd129957c6443e326564477517d0b06bfb7b16f4088c083486af" name="cross-ppc64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="18c049914f8661dbb25a7cdd57cd509fd61691febc8adb735db0683d6b154bb5" name="cross-ppc64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="3029bfba463169d6caabe700bc4f2c0d9483478d020a39484358ea72db009fec" name="cross-ppc64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="acd8773f6c1af04b610e0177d780322193de0f62fd8640909c91d7afde8c3158" name="cross-ppc64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="f08f15ceaf3c22defd9588f38ea837c1728e8906e4ab311569f25a43ed7e37da" name="cross-ppc64-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f4505eecd244450e01784751315914e83c594b41318ffa4895555e2011eb94bd" name="cross-ppc64-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="538ec0c617fdd119be3d46fff2eda0ebc8d37bd7cc4fb4eab19950922afc0ada" name="cross-ppc64-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="5d1e04764bc43040194fc55f1b1ebf780547ff396c3666577eb7e8fb47fadfc6" name="cross-ppc64-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="9bc3cf4f1166d9b6bf8a2cd0e8febc3c0b069442f85bd3ffadf87531b05181fb" name="cross-ppc64-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="d1ec90385ae3209b9414bc30a328568990cf02734939b3b6def8f803b38f599c" name="cross-ppc64-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="e356cdd9ba1c05e582867e69ec3fbb6dd406f0e66bf47040c9ac002a43b4c96b" name="cross-ppc64-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="d7703a63b2a14bfbecb7a1b446515739e51de900b632690dd4a37619b7ecf4d1" name="cross-ppc64-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f5975474d75e4b9c4000e62465ec4083a598bd03f7f7dc176cbfd6fda54a6b56" name="cross-ppc64-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="9fd2a06b348e06b007263d870f1c91c3c1fc73deeb6e6b1e20b36acdef27d65d" name="cross-ppc64le-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="6db343f0f5bed779acc2eee22b97805f59e869c10ef3b8769d6ed399c92908ce" name="cross-ppc64le-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="9f9bc23b3a396de597bd75bf50c8b3d516cf150a54152289446c5cbb0834b466" name="cross-ppc64le-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="6f873e83577de12ba838cdd29173e4ca1ada40db66b5557488264b6358c662b8" name="cross-ppc64le-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="620263ad11855643521e253140847bd7400ea565647f0a4520cc38876124bd0b" name="cross-ppc64le-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="cb6b77d25014eae81bfe1019414a3d89c101295ede73835c08e64bcbfb2c7eb0" name="cross-ppc64le-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="4f10b5a28d01d823051905808520175a041d94b1e8b84a83c85fa6b705ead66d" name="cross-ppc64le-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="67470362bc79e3e8ee3cd521df760d749a12a6e88c1256e592a97b575f1f7876" name="cross-ppc64le-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="dced17cba01f76a3f0f7784747c835c472b646301d932073e5a1e13bd6202f3c" name="cross-ppc64le-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="731e7f3bce825dbb4e3655d4056db7b8c81d80efdc2e9b0d02901963caeae114" name="cross-ppc64le-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f433010ed82f30dee6c31ec948be559b81714600c4e59318a381c30484f2622f" name="cross-ppc64le-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="63bddbb087ac496806495f198d9bf95bc401dd81f86bac27a68c8242a1b79142" name="cross-ppc64le-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="044fe07105f6be1ca3a74b5972244c564e943b76905256dea851a5724308659f" name="cross-ppc64le-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="e602e24cfe2bd6e8b79a57aaf8cae797ea83f8ca826e779fd9579e2afc34046c" name="cross-ppc64le-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="beeeb9439d9d9e093a3ba3d83a8671ad754d36d497802a6161ddb27b76b1539c" name="cross-ppc64le-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="b33e6270f51772e19e7b5582ab79e854486ca52d4068e0639fd5176a141339ac" name="cross-riscv64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="000ce9ce316c3bb40e0c95b7d34c9fcfdf6f881aec7e92e56c66cea48f89395b" name="cross-riscv64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="44e696080455592ea3b0c77356e4aff87808d3c8fbecf3ed2d8205b241e4e293" name="cross-riscv64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="8f96ecaa411e0e7c2950a95484595c610adb4e6433971c68f39647da8b67adf2" name="cross-riscv64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="37263997dc84d7a5200902d64e28bd4e6c271261f1f4878e9a5a3d0284f98485" name="cross-riscv64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="b36d1182c05912ded82ad8acf0eab6a583fd5bc06959921c4d96e1c425eec27b" name="cross-riscv64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="772584936b03fdb56e05f4051fbd4aefee9f69b63a895bd34df06a6b66330d18" name="cross-riscv64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="02577b958c3adc1dede83f2bf26e40f99f05d85c6008c8c2afd34d9c48775b8c" name="cross-riscv64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="c16695f002965e7126e1b25c4d28a5fd60612928c433d2c4db6d7487f4ddeb45" name="cross-riscv64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="932d2f07b1d0bf4882ab6ca27de85d16cbcd14c5e44d8c7f5691a543baa2d95b" name="cross-riscv64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="c8b4a68d14d859274a9668092045afbab81a95c0dacf177662e14386de05f7f1" name="cross-riscv64-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="c67c4d0e858f156cce27e145b89849dc867456fc57cafe6a49308ed41fa0533d" name="cross-riscv64-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="786055097776f16821d9bcf91a3c468b8c2261c499f8b811688ca1c9155e4d36" name="cross-riscv64-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f50fdaff422514f494bdb38c53175ac7774444731fcfe4113e840f8ece8c8b92" name="cross-riscv64-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="54b0314098840b23bf3941326d7132b4f3c3d9b484a8cc849f683c29fa4a5c4c" name="cross-riscv64-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="eb03f4e7b94f7ffc10e6cbb1e8ba25edeeed6ea2da1a563d9ee3f37d7a232dc5" name="cross-riscv64-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="2dbb382a8e605aced1bb1f2692e7e02ebd384c12007fe5e4387d7f76489b3860" name="cross-riscv64-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="35a681781680fd319442808474cfc0565d401912175db0ea0f0f638ef84c0b95" name="cross-riscv64-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="9cd3ce081548b0c840a0fb284aeee000fecbd8cb51d3ea1bec0864f112214956" name="cross-riscv64-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="84fddeb6da711a5830d695fd66666e86f0fa8ea5ae6f085934e8ca3edc9829c0" name="cross-rx-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="91383b4e93458819eead3e31b87c37289f30c79115f3a99e99e913ba48401189" name="cross-rx-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="db19c69f0238656ec22ed587e852c0482910ad27ab9d1e3a3c0a48f66acf5303" name="cross-rx-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="714618c98917b1275b6c075392b09cc251da10c6297d1c2d5cdda17d9771bc35" name="cross-rx-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="ce8a6ec297d782c1acbdbefd92f4e626ac30c899b7d2283178b1146c6243ad61" name="cross-rx-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="9e3ba165d5c0c43378d82286c603e6dee653ef63a2173fae41fbb744ae4ccf08" name="cross-rx-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="f9dfba5e201f0153739ba024b3ee44133699aeb1389ec77e56d8f2c3306b060c" name="cross-rx-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="5d4dd2608c8e776eeb3a49cfeb4674b1dd033238bf33cb9078e955e5315066b4" name="cross-rx-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="61979d8ad6ca58597feb255a093aca20b9a77f1b35a67f207897c39016425685" name="cross-rx-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="e12a26ff5d18c61f44737f2d051c1dde1d3b00a21af0eba6a1ad2b7caa0493ed" name="cross-rx-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="def579f029d99876609dda0e322e25ce529be2846fc807bd03ccf40442fc85cf" name="cross-s390-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="ce7ce2c86ac1755df7a3b6ea216db428a9bb8afe472e8b19455fddfd58b5154c" name="cross-s390-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="4a58493aa4be4b48aa5b830e7fa9671b040ffe4724e3e66cac7a98ca22a4f028" name="cross-s390-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="14ea174450c5a401749ab6406d5a24ac5ecdb04f04882c36ee71439c64bb51bf" name="cross-s390-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="6e99579660ed85916de01b5a1c1f1a135239eb425b809038331aca18b2a52048" name="cross-s390-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="2d419d16eef9d42f1c6dd353e7b9fb452d92fc4da6184994023d44cc042ac2b5" name="cross-s390-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="745feb340c2ebd5ea1cde304c2b8a4175ba6ad1213159e6991a6be6d54490e25" name="cross-s390-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="ac0a20d35865314ca66e73b127b0b997fbffa051b010a888db8e41d07fd852f6" name="cross-s390-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="8772526956c899f50191b7bc1bca02f0c51b8f276779bcba6c2dfbdd84e947b2" name="cross-s390-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="c920fee9622b1911a3e2cc88cc0b6f76f582e76ffdc6f2094c2a1c17af57dea8" name="cross-s390-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="aaf1dd4d7081cc416602529304681c48191cca81f8d8444a0aaecac75f4c63ac" name="cross-s390x-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="5a2857371e312e27101c8d0ba00a5628379529845fcfaf2ad40d1b4510da9561" name="cross-s390x-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="63a2ad8d88c16c38e0799d1598b982d0c13580ca848315aad22a250fe0d2864d" name="cross-s390x-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="d01892d3a9b625010ef07fdb397153d66cc14f977faa1999dcd9049b0d628237" name="cross-s390x-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="a04a52f0a5bfd99b4c45d04f236cc2d69d6f5c073dfa1288bbd88c74ddabad71" name="cross-s390x-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="47e82f6d425c35a5b4e978825069530a2b08bec4bc31055c7351fd423b741c80" name="cross-s390x-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="5e0582e7a4e7731aa3df58eb8fd18476bc8b9f5cfddb3ad3f99179bafe517c86" name="cross-s390x-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="60193e567a873d1f529253990111bf38439c73ca5f3d184b5d2018512413ebb2" name="cross-s390x-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="7807e68344f37d499e1ed8f8eff4bcf80f8a90b60155f02e0692a7f3b101110b" name="cross-s390x-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="e3f99a910db101a0774e24bb2aa643f7f013f22f152693cc94721ac931173330" name="cross-s390x-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="a9b0c07024880fe0197996a59d1cd1c46dbaae6411a68935eb89d42227f18ba3" name="cross-s390x-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="e7163c0fdce18dd2c22b1eb832dcbfad23d1d48bbf0e92cb2a743d23385f99fe" name="cross-s390x-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="4eb36e5561f99c26d3a4d010423a6a90bdfb36518df3b54646b502b6b00c10e0" name="cross-s390x-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="bd8052f93b016f9e314b79d2572c23a9b66808661c983af68b1216c1b5db8fef" name="cross-s390x-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="084f7f06235803835db2e2c25e0750d6f573b219504d7e72b62178792e9f4d94" name="cross-s390x-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="d05c441cdd5a5ce7f9dbb8042234409ead00b7eb607975f7145e3352daacb813" name="cross-sparc-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="8efe2def094b9bcdc4b29c8643046c1fb4395e8dcaaf49b5b1176983245ad985" name="cross-sparc-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="8f6dc90b09e2a1ac20d9f2aa24aaf2eb53dbfe6871793f2e9966e351c7a53d21" name="cross-sparc-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="78f5e374eb61588802d91acbad6d2d02f742c8377cbaac61b18bd00c85c95d86" name="cross-sparc-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="fb2f481bec32279a705d3c8ab3cc7d970a008347c795c1bb1760e007e83bca6d" name="cross-sparc-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="358ac213934a4c3314cd1dd151c00531edb9c182bc4664ad2b22aacc8a58a2a9" name="cross-sparc-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="72ff4fc4fee65f77813c4bfada485cda27fa0017e2ae190fc82af0e487590580" name="cross-sparc-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="ccb9136e6d0aae69dbb86ab7b747d62b90c3e93a87088cf88ed4ae5cbed76d1e" name="cross-sparc-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="2369a61f34f72815f11ee34052015917f703544d25ece8a346a76b4da1559815" name="cross-sparc-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="68b92079008bbd3107a32594b01a446cc33602144e0614a297abb963c5f2eb46" name="cross-sparc-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="402fca587ce81ae6baf95ea2ff8a226f494d24d4499e80897605ac322200f068" name="cross-sparc-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="aad8e0cd281ac97021e5155482124278b9b62db3dde9fbf5b7bd352f1a060eb7" name="cross-sparc-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="d76d2d5adb8d08fb70889560c45bf6290f815fc0b1e641bea32ef3ba5550b8bb" name="cross-sparc-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="e1d5ff4e83a3c732677cd46f33ffc26e4c87988fa9821757cbe19eed4bc0c88c" name="cross-sparc-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="7e2f7c43b9bdff5980733bb6d0803362da30d890780c69c5aa05d1afe0bfb846" name="cross-sparc-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="559897b53a3e2ab3dd3c82c0de0aa6e5c4992aba041b689739a36f298babdc4e" name="cross-sparc64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="45f56f745b417e0b071bc8e4fea67bae5caaa7a7e5887c6a891d1d78ef473449" name="cross-sparc64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="e2df7e575f1c7c0470a25a55cdcf6a38e900a5f69223943525b0b801141d76a0" name="cross-sparc64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="fb893bd58d6b4ccafe66defa877ac2f4bbdf2afae450839ef8f9ef86743b848d" name="cross-sparc64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="a8394ab03b97e587242e8e71a6c2af86e2f30ba4b35fa3b254fe4ec350cf63f9" name="cross-sparc64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="41d9b4b1ec0b7eb055bfd04ac87cb6f9810f699596f4c2bc21a4c352816c4305" name="cross-sparc64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="ae0ff2f77539e4d036a12d5da93024925a2fb7a4ff49f8b16d2e408d5d7ad8e6" name="cross-sparc64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="972ae0094bef5548a370c5152c879be628f0ac5586423fcbf050285db160cd6e" name="cross-sparc64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="246d359d13d1821a61a7af3633f83726a1606e3c3ce8469fc4dafa3201b77ed8" name="cross-sparc64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="6801738281ac26a508f581b8f4fbb2826fd4c693878ed95bad4fc68fac66c417" name="cross-sparc64-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="27ce1cf952a1d768d71f05c31c981584325be17988c9d6f1cfe035c5d9cd373b" name="cross-sparc64-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="770ad1a84303a6a50dc5ec90fece9f0a2d91096c018bffc0c6abd45d3e247560" name="cross-sparc64-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="eaccf33ae2a3ef5ad0f7f27d116ab3fafbd7457b16fdced34883143438caaefb" name="cross-sparc64-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="845794429731f85519d28a028459a6b3e4e791ae6e69900c2d318d2faae6c0bc" name="cross-sparc64-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="a5a0dc80ac1de0290e5c049f15bec9cf05f5af8cf324eb80d4b218e32d9d1ad3" name="cross-sparc64-gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="61424501639a34f94d68f94075a793d3142b97c6ca29eb8e6dcb490245584f23" name="cross-sparc64-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="7b37d51308b6b96014c9d3e8221b0ff144cb3c8ade1aeb27db2d50416c9e3be5" name="cross-sparc64-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="93521560b361efa9cbc97da58bb1aa2abc67ec39046f4564e3f5a0d8bdfc0976" name="cross-sparc64-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="a814ed776e380ea629d7febcfb206ca9808c154b01b26e6f4f3812f83aa9cf17" name="cross-sparc64-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f955f9ef82ef15660c9666160bb0da4899a032c103bbaf68c8ab8a59e7c2ea26" name="cross-sparcv9-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="0ecc60b761d3795e19f3dbd0051916a2711f9e95cd5f3c773bc202c5356f8280" name="cross-sparcv9-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="531cf4b32b7ac131110ff85e541afd0c1a5cd41e5f7d65d4add02c184a686dda" name="cross-sparcv9-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="38437a0bfb3b603bd0654ff0e1a686c2dc458772616c725830d379b93fe78fa7" name="cross-sparcv9-gcc10-icecream-backend" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="df7286253ce4f6cb6d346a894504f16d062b6264ac62f1a166a2605df7888e10" name="cross-spu-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="817ffaf0ae6f86e28ea5d0efd8c501625e2c5fae7e4f5a492468b10a34e23e4a" name="cross-spu-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="f533bc3e7ab240cb9a3afac5067c0cfb0bba1b48e81944601159716b31098901" name="cross-spu-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="38588396501d8d4a58af1064385067a120d2ef1085d75fd78230b09d182ecaaa" name="cross-spu-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="722d18ed94098d6e013cc3e8acc264b5d74c9cffbd38698934b231efa87e7d3a" name="cross-spu-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="83a283de423ff2280dd318fb4596c710aed89443567e512f23bd594964202b28" name="cross-spu-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="13843a5105935191d26f838249b2e52fe711668314df74b8c125bd06f2ebb517" name="cross-spu-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="3d277f69d8916ac9f768ded169b322eab7ec104edc3ca38908aba88c4452f459" name="cross-spu-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="429ea763f86ad5ee7da4d11437cd9b973e52bd38a503e91bd1cb15a3f62d40dd" name="cross-spu-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="546e146f03b3aeed6b0bb37eb4b0f33e3b7a31f8868d40df866bd4384c9f0ad5" name="cross-spu-binutils" arch="x86_64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="45ca7f4190b50828482a87c292c72451e4202953b32ab0d64e2c1c3f175d5ed8" name="cross-x86_64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="be1382c291b40ec0ce50b63f8433b96fec1f2849ce3c4972ffddbefa60359b34" name="cross-x86_64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="5926fd724ecc4fb0e97f3df9ef8bf0b2f7b129bd5dd5ad777efa06585d1e8c8c" name="cross-x86_64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="9c3cd3649c63cb6fba1071ecc7322cf08dba8e56aace122f93c840c4f74f7235" name="cross-x86_64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.21.1"/>
  <changelog author="mliska@suse.cz" date="1597492800">- Add binutils-2.35-branch.diff.gz: it includes fix for
  nm -B for objects compiled with -flto and -fcommon.</changelog>
  <changelog author="matz@suse.com" date="1600171200">- Update binutils-2.35-branch.diff.gz to commit 23f268a0:
  * Add xBPF target
  * Fix various problems with DWARF 5 support in gas
- Toolchain module update for SLE15 [jsc#ECO-2373]
- Includes changes that were SLE-only in binutils-add-z15-name.diff
  for [bsc#1160590, jsc#SLE-7903 aka jsc#SLE-7464]
- Amend binutils-revert-plt32-in-branches.diff to adjust also new
  testcases.</changelog>
  <changelog author="mliska@suse.cz" date="1600689600">- Update to 2.35.1 and rebased branch diff:
  * This is a point release over the previous 2.35 version, containing bug
  fixes, and as an exception to the usual rule, one new feature.  The
  new feature is the support for a new directive in the assembler:
  ".nop".  This directive creates a single no-op instruction in whatever
  encoding is correct for the target architecture.  Unlike the .space or
  .fill this is a real instruction, and it does affect the generation of
  DWARF line number tables, should they be enabled.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1602504000">- Reapply spec file cleanup from format_spec_file
- Remove a SLE10 version check</changelog>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
</package>
<package pkgid="41403d6e8018c873d32f72e0850bf9c9130670c85c7569308e4a03ebeb4a5176" name="cross-x86_64-binutils" arch="aarch64">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="24306f1b52ec55e3dd7b124bedd24de5de3e9af3326e3a8f279769dd3f5ad645" name="cross-x86_64-binutils" arch="ppc64le">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="e905fc3320050037e38ea9a42f1e5991946c908829e8bd7be33b7a8dd6770610" name="cross-x86_64-binutils" arch="s390x">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="1542dcc33cf429f6931270a7288b25f3442b6f4fba9f4e4a8248dda3379ac13b" name="cross-x86_64-binutils" arch="src">
  <version epoch="0" ver="2.37" rel="7.26.1"/>
  <changelog author="matz@suse.com" date="1606132800">- Update binutils-2.35-branch.diff.gz to commit 1c5243df:
  * Fixes PR26520, aka [bsc#1179036], a problem in addr2line with
    certain DWARF variable descriptions.
  * Also fixes PR26711, PR26656, PR26655, PR26929, PR26808, PR25878,
    PR26740, PR26778, PR26763, PR26685, PR26699, PR26902, PR26869,
    PR26711
  * The above includes fixes for dwo files produced by modern dwp,
    fixing several problems in the DWARF reader.</changelog>
  <changelog author="matz@suse.com" date="1607083200">- Add binutils-fix-relax.diff to fix linking relaxation problems
  with old object files hitting some enterprise software. [bsc#1179341]</changelog>
  <changelog author="mliska@suse.cz" date="1611489600">- Update to binutils 2.36:
  New features in the Assembler:
    General:
  * When setting the link order attribute of ELF sections, it is now
    possible to use a numeric section index instead of symbol name.
  * Added a .nop directive to generate a single no-op instruction in
    a target neutral manner.  This instruction does have an effect on
    DWARF line number generation, if that is active.
  * Removed --reduce-memory-overheads and --hash-size as gas now
    uses hash tables that can be expand and shrink automatically.
    X86/x86_64:
  * Add support for AVX VNNI, HRESET, UINTR, TDX, AMX and Key
    Locker instructions.
  * Support non-absolute segment values for lcall and ljmp.
  * Add {disp16} pseudo prefix to x86 assembler.
  * Configure with --enable-x86-used-note by default for Linux/x86.
    ARM/AArch64:
  * Add support for Cortex-A78, Cortex-A78AE and Cortex-X1,
    Cortex-R82, Neoverse V1, and Neoverse N2 cores.
  * Add support for ETMv4 (Embedded Trace Macrocell), ETE (Embedded
    Trace Extension), TRBE (Trace Buffer Extension), CSRE (Call
    Stack Recorder Extension) and BRBE (Branch Record Buffer
    Extension) system registers.
  * Add support for Armv8-R and Armv8.7-A ISA extensions.
  * Add support for DSB memory nXS barrier, WFET and WFIT
    instruction for Armv8.7.
  * Add support for +csre feature for -march. Add CSR PDEC
    instruction for CSRE feature in AArch64.
  * Add support for +flagm feature for -march in Armv8.4 AArch64.
  * Add support for +ls64 feature for -march in Armv8.7
    AArch64. Add atomic 64-byte load/store instructions for this
    feature.
  * Add support for +pauth (Pointer Authentication) feature for
  - march in AArch64.
    New features in the Linker:
  * Add --error-handling-script=&lt;NAME&gt; command line option to allow
    a helper script to be invoked when an undefined symbol or a
    missing library is encountered.  This option can be suppressed
    via the configure time switch: --enable-error-handling-script=no.
  * Add -z x86-64-{baseline|v[234]} to the x86 ELF linker to mark
    x86-64-{baseline|v[234]} ISA level as needed.
  * Add -z unique-symbol to avoid duplicated local symbol names.
  * The creation of PE format DLLs now defaults to using a more
    secure set of DLL characteristics.
  * The linker now deduplicates the types in .ctf sections.  The new
    command-line option --ctf-share-types describes how to do this:
    its default value, share-unconflicted, produces the most compact
    output.
  * The linker now omits the "variable section" from .ctf sections
    by default, saving space.  This is almost certainly what you
    want unless you are working on a project that has its own
    analogue of symbol tables that are not reflected in the ELF
    symtabs.
  New features in other binary tools:
  * The ar tool's previously unused l modifier is now used for
    specifying dependencies of a static library. The arguments of
    this option (or --record-libdeps long form option) will be
    stored verbatim in the __.LIBDEP member of the archive, which
    the linker may read at link time.
  * Readelf can now display the contents of LTO symbol table
    sections when asked to do so via the --lto-syms command line
    option.
  * Readelf now accepts the -C command line option to enable the
    demangling of symbol names.  In addition the --demangle=&lt;style&gt;,
  - -no-demangle, --recurse-limit and --no-recurse-limit options
    are also now availale.
- Includes fixes for these CVEs:
  bnc#1179898 aka CVE-2020-16590 aka PR25821
  bnc#1179899 aka CVE-2020-16591 aka PR25822
  bnc#1179900 aka CVE-2020-16592 aka PR25823
  bnc#1179901 aka CVE-2020-16593 aka PR25827
  bnc#1179902 aka CVE-2020-16598 aka PR25840
  bnc#1179903 aka CVE-2020-16599 aka PR25842
  bnc#1180451 aka CVE-2020-35493 aka PR25307
  bnc#1180454 aka CVE-2020-35496 aka PR25308
  bnc#1180461 aka CVE-2020-35507 aka PR25308
- Rebase the following patches:
  * binutils-fix-relax.diff
  * binutils-revert-nm-symversion.diff
  * binutils-revert-plt32-in-branches.diff
- Add missing dependency on bc (ld.gold testsuite uses it).
- Use --enable-obsolete for cross builds as ia64 is deprecated now.
- Add binutils-2.36-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1612267200">- Add temporary upstream fix for PR27311
  0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612353600">- Update 2.36 branch diff which should fix PR27311 completely.
  It fixes also PR27284.
- Remove temporary fix 0001-PR27311-ld.bfd-symbol-from-plugin-undefined-referenc.patch.</changelog>
  <changelog author="mliska@suse.cz" date="1612440000">- Bump 2.36 branch diff.</changelog>
  <changelog author="mliska@suse.cz" date="1614600000">- Bump 2.36 branch diff (includes fix for PR27441 aka bsc#1182252).</changelog>
  <changelog author="mliska@suse.cz" date="1614772800">- Do not run make TARGET-bfd=headers separately.</changelog>
  <changelog author="mliska@suse.cz" date="1616760000">- Update 2.36 branch diff which fixes PR27587.</changelog>
  <changelog author="schwab@suse.de" date="1620388800">- ppc-ensure-undef-dynamic-weak-undefined.patch: PPC: ensure_undef_dynamic
  on weak undef only in plt
- ppc-use-local-plt.patch: PowerPC use_local_plt (prerequisite for above
  patch)</changelog>
  <changelog author="mliska@suse.cz" date="1626955200">- Update to binutils 2.37:
  * The GNU Binutils sources now requires a C99 compiler and library to
    build.
  * Support for the arm-symbianelf format has been removed.
  * Support for Realm Management Extension (RME) for AArch64 has been
    added.
  * A new linker option '-z report-relative-reloc' for x86 ELF targets
    has been added to report dynamic relative relocations.
  * A new linker option '-z start-stop-gc' has been added to disable
    special treatment of __start_*/__stop_* references when
  - -gc-sections.
  * A new linker options '-Bno-symbolic' has been added which will
    cancel the '-Bsymbolic' and '-Bsymbolic-functions' options.
  * The readelf tool has a new command line option which can be used to
    specify how the numeric values of symbols are reported.
  - -sym-base=0|8|10|16 tells readelf to display the values in base 8,
    base 10 or base 16.  A sym base of 0 represents the default action
    of displaying values under 10000 in base 10 and values above that in
    base 16.
  * A new format has been added to the nm program.  Specifying
    '--format=just-symbols' (or just using -j) will tell the program to
    only display symbol names and nothing else.
  * A new command line option '--keep-section-symbols' has been added to
    objcopy and strip.  This stops the removal of unused section symbols
    when the file is copied.  Removing these symbols saves space, but
    sometimes they are needed by other tools.
  * The '--weaken', '--weaken-symbol' and '--weaken-symbols' options
    supported by objcopy now make undefined symbols weak on targets that
    support weak symbols.
  * Readelf and objdump can now display and use the contents of .debug_sup
    sections.
  * Readelf and objdump will now follow links to separate debug info
    files by default.  This behaviour can be stopped via the use of the
    new '-wN' or '--debug-dump=no-follow-links' options for readelf and
    the '-WN' or '--dwarf=no-follow-links' options for objdump.  Also
    the old behaviour can be restored by the use of the
    '--enable-follow-debug-links=no' configure time option.
    The semantics of the =follow-links option have also been slightly
    changed.  When enabled, the option allows for the loading of symbol
    tables and string tables from the separate files which can be used
    to enhance the information displayed when dumping other sections,
    but it does not automatically imply that information from the
    separate files should be displayed.
    If other debug section display options are also enabled (eg
    '--debug-dump=info') then the contents of matching sections in both
    the main file and the separate debuginfo file *will* be displayed.
    This is because in most cases the debug section will only be present
    in one of the files.
    If however non-debug section display options are enabled (eg
    '--sections') then the contents of matching parts of the separate
    debuginfo file will *not* be displayed.  This is because in most
    cases the user probably only wanted to load the symbol information
    from the separate debuginfo file.  In order to change this behaviour
    a new command line option --process-links can be used.  This will
    allow di0pslay options to applied to both the main file and any
    separate debuginfo files.
  * Nm has a new command line option: '--quiet'.  This suppresses "no
    symbols" diagnostic.
- Includes fixes for these CVEs:
  bnc#1181452 aka CVE-2021-20197 aka PR26945
  bnc#1183511 aka CVE-2021-20284 aka PR26931
  bnc#1184519 aka CVE-2021-20294 aka PR26929
  bnc#1184620 aka CVE-2021-3487 aka PR26946
  bnc#1184794 aka CVE-2020-35448 aka PR26574
- Also fixes:
  bsc#1183909 - slow performance of stripping some binaries
- Rebased patches: binutils-build-as-needed.diff, binutils-fix-abierrormsg.diff,
  binutils-fix-invalid-op-errata.diff, binutils-fix-relax.diff,
  binutils-revert-nm-symversion.diff, binutils-revert-plt32-in-branches.diff
- Removed patches (are in upstream): ppc-ensure-undef-dynamic-weak-undefined.patch and
  ppc-use-local-plt.patch.
- Add binutils-2.37-branch.diff.gz.</changelog>
  <changelog author="mliska@suse.cz" date="1626955201">- Use LTO &amp; PGO build.</changelog>
  <changelog author="mliska@suse.cz" date="1627992000">- Bump binutils-2.37-branch.diff: fixes PR28138.</changelog>
  <changelog author="matz@suse.com" date="1631102400">- Adjust for testsuite fails on older products that configure
  binutils in different ways, adds  binutils-compat-old-behaviour.diff
  and adjusts binutils-revert-nm-symversion.diff and
  binutils-revert-plt32-in-branches.diff.</changelog>
  <changelog author="Stefan Schubert schubi@suse.de" date="1631275200">- Using libalternatives instead of update-alternatives.</changelog>
  <changelog author="matz@suse.com" date="1633694400">- Configure with --disable-x86-used-note on old code streams.
- Disable libalternatives temporarily for build cycle reasons.
- make TARGET-bfd=headers again, we patch bfd-in.h
- This state submitted to SLE12 and SLE15 code streams for annual
  toolchain update. [jsc#PM-2767, jsc#SLE-21561, jsc#SLE-19618]
- Bump binutils-2.37-branch.diff to 66d5c7003, to include fixes for
  PR28422, PR28192, PR28391.  Also adds some s390x arch14
  instructions [jsc#SLE-18637].</changelog>
  <changelog author="mliska@suse.cz" date="1635768000">- Update binutils-skip-rpaths.patch with contained a memory corruption
  (boo#1191473).</changelog>
  <changelog author="matz@suse.com" date="1635854400">- Fix empty man-pages from broken release tarball [PR28144].</changelog>
  <changelog author="mliska@suse.cz" date="1635940800">- Rebase binutils-2.37-branch.diff: fixes PR28523 aka boo#1188941.</changelog>
  <changelog author="matz@suse.com" date="1636113600">- Add binutils-revert-hlasm-insns.diff for compatibility on old
  code stream that expect 'brcl 0,label' to not be disassembled
  as 'jgnop label' on s390x.  [bsc#1192267]</changelog>
</package>
<package pkgid="481546e40d5b757a675a28bcf0bcc51bb0f889cd1194527d0eda25d403e1e8ac" name="cross-x86_64-gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="6757a1c6f06c20e69046cc5da9e88a82a71c0aeba78495f50fda985ec09faf00" name="cross-x86_64-gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="88196cd53206a34361575b705bea762dd2711964334af1eaaea84f2ad58a89b7" name="cross-x86_64-gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f8859fbc5d97f5006a95037ce849396e406afced1293bc298f77d38dc4da3816" name="cross-x86_64-gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="b574b456bedbe2dcfbc6de1892d3e923fcd9724d93231d0972ab0bbca6fb59ae" name="cross-x86_64-gcc10-icecream-backend" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="02d325822a04559b00034243d8d7f539c986a3aca217d1a461f2b0aa709705ef" name="cross-x86_64-gcc10-icecream-backend" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f350f4f178a300e1762d2c1cf56fa50e54c67ee8f6fbfe7dbea680d487c84940" name="cross-x86_64-gcc10-icecream-backend" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.3"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="78aa69b2b7ca52b5908b4b37b6dda913dabcb7421fc1d1eb6458d0d31f1473dc" name="cryptctl" arch="ppc64le">
  <version epoch="0" ver="2.4" rel="4.5.1"/>
  <changelog author="hguo@suse.com" date="1465387200">- First version, only to help with building ISOs.
  Implement fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1467374400">- A preview version with most of the desired functions implemented:
  * Key database
  * Key RPC server
  * Client encryption and decryption routines
  Bump version to 1.1
  fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1468238400">- Implement mandatory features:
  * List and edit key records
  * Unlock file system via key record file
  * Use custom options to mount unlocked file system
  Enhance usability:
  * Make encryption procedure's pre-check more thorough
  * Improve overall command prompts
- Bump version to 1.2 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1470052800">- Implement mandatory features:
  * Encrypt empty directory skips backup steps.
  * Explain key revocation and TLS mechanisms in manual page.
- Bump version to 1.2.1 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Upon request, generate a self-signed TLS certificate for
  experimental purposes.
- Bump version to 1.2.2 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1471521600">- Implement mandatory enhancements:
  * Remove necessity for a backup directory to be involved for
    encryption routine.
  * Optimise certificate generation prompts.
  * Remove unused error messages and fix several of their typos.
  * Remove unnecessary safety checks.
  * Make the encryption routine work with btrfs and LVM.
- Bump version to 1.2.3 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1472817600">- Implement mandatory enhancements:
  * Make workflow across all sub-commands consistent in invocation
    style.
  * Implement auto-unlocking of encrypted disks.
  * Show key record usage and details on demand.
- Bump version to 1.2.4 for fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1474027200">- Implement mandatory enhancements:
  * Do not allow encrypting a remote file system.
  * Implement command for erasing an encrypted file system.
- Bump version to 1.2.5 for fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1479297600">- Upgrade to 1.2.6 for accumulated bug fixes (bsc#1006219):
  * Prevent user from attempting to encrypt a disk with mounted
    partitions, or an existing encrypted+opened disk.
  * Ensure CA path input is an absolute path.
  * Fix two mistakes in handling of timeout input.
  * Fix minor formatting issue in manual page.
  * Suppress consecutive failure messages in the journal of
    ReportAlive and AutoOnlineUnlockFS routines.</changelog>
  <changelog author="hguo@suse.com" date="1493380800">- Upgrade to 1.99pre that introduces a library for decoding, encoding,
  and serialisation operations of KMIP v1.3 for fate#322979.</changelog>
  <changelog author="hguo@suse.com" date="1494504000">- Upgrade to upstream release 2.0 that brings a protocol evolution
  together with several new features:
  * Optionally utilise an external KMIP-v1.3 compatible service to
    store actual encryption key.
  * Optionally verify client identity before serving its key requests.
  * Password is hashed before transmitting over TLS-secured channel.
  * Fix an issue that previously allowed a malicious administrator
    to craft RPC request to overwrite files outside of key database.
  Implemented accordint to fate#322979 and fate#322293.</changelog>
  <changelog author="hguo@suse.com" date="1496318400">- Upgrade to upstream release 2.1 that brings important enhancements
  in effort of implementing fate#322979:
  * Improve KMIP compatibility with key prefix names and proper
    serialisation of authentication header.
  * Fail over KMIP connection using a server list.
  * Destroy key on KMIP after its tracking record is erased from DB.</changelog>
  <changelog author="hguo@suse.com" date="1496836800">- Upgrade to upstream release 2.2 that brings important enhancements
  in effort of implementing fate#322979:
  * System administrator may now optionally turn off TLS certificate
    verification on KMIP server. Note that, certificate verification
    is enforced by default.
  * Improve handling of boolean answers from interactive command line.
  * Improve error handling in KMIP client.</changelog>
  <changelog author="hguo@suse.com" date="1503921600">- Upgrade to upstream release 2.3 that brings a new feature to allow
  system administrators to issue mount/umount commands to client
  computers via key server. (bsc#1056082)</changelog>
  <changelog author="hguo@suse.com" date="1508760000">- Add previously missing systemd service cryptctl-client.service
  into RPM content, continue with bsc#1056082.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1623412800">- Update to version 2.4:
  * (bsc#1186226) - (CVE-2019-18906) client side password hashing is equivalent to clear text password storage
  * Fix authentication on all places.
  * Fix sysconfig variable name.
  * First step to use plain text password instead of hashed password.
  * Move repository into the SUSE github organization
  * decorate readme with more usage instructions
  * in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address
  * Test clear expired commands in TestDB_UpdateSeenFlag
  * tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case
  * avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.</changelog>
</package>
<package pkgid="8fdb24fb07fc5651597b6f44db8e0bca9b38498bd3008cfbcece30a2dda7eca9" name="cryptctl" arch="src">
  <version epoch="0" ver="2.4" rel="4.5.1"/>
  <changelog author="hguo@suse.com" date="1465387200">- First version, only to help with building ISOs.
  Implement fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1467374400">- A preview version with most of the desired functions implemented:
  * Key database
  * Key RPC server
  * Client encryption and decryption routines
  Bump version to 1.1
  fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1468238400">- Implement mandatory features:
  * List and edit key records
  * Unlock file system via key record file
  * Use custom options to mount unlocked file system
  Enhance usability:
  * Make encryption procedure's pre-check more thorough
  * Improve overall command prompts
- Bump version to 1.2 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1470052800">- Implement mandatory features:
  * Encrypt empty directory skips backup steps.
  * Explain key revocation and TLS mechanisms in manual page.
- Bump version to 1.2.1 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Upon request, generate a self-signed TLS certificate for
  experimental purposes.
- Bump version to 1.2.2 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1471521600">- Implement mandatory enhancements:
  * Remove necessity for a backup directory to be involved for
    encryption routine.
  * Optimise certificate generation prompts.
  * Remove unused error messages and fix several of their typos.
  * Remove unnecessary safety checks.
  * Make the encryption routine work with btrfs and LVM.
- Bump version to 1.2.3 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1472817600">- Implement mandatory enhancements:
  * Make workflow across all sub-commands consistent in invocation
    style.
  * Implement auto-unlocking of encrypted disks.
  * Show key record usage and details on demand.
- Bump version to 1.2.4 for fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1474027200">- Implement mandatory enhancements:
  * Do not allow encrypting a remote file system.
  * Implement command for erasing an encrypted file system.
- Bump version to 1.2.5 for fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1479297600">- Upgrade to 1.2.6 for accumulated bug fixes (bsc#1006219):
  * Prevent user from attempting to encrypt a disk with mounted
    partitions, or an existing encrypted+opened disk.
  * Ensure CA path input is an absolute path.
  * Fix two mistakes in handling of timeout input.
  * Fix minor formatting issue in manual page.
  * Suppress consecutive failure messages in the journal of
    ReportAlive and AutoOnlineUnlockFS routines.</changelog>
  <changelog author="hguo@suse.com" date="1493380800">- Upgrade to 1.99pre that introduces a library for decoding, encoding,
  and serialisation operations of KMIP v1.3 for fate#322979.</changelog>
  <changelog author="hguo@suse.com" date="1494504000">- Upgrade to upstream release 2.0 that brings a protocol evolution
  together with several new features:
  * Optionally utilise an external KMIP-v1.3 compatible service to
    store actual encryption key.
  * Optionally verify client identity before serving its key requests.
  * Password is hashed before transmitting over TLS-secured channel.
  * Fix an issue that previously allowed a malicious administrator
    to craft RPC request to overwrite files outside of key database.
  Implemented accordint to fate#322979 and fate#322293.</changelog>
  <changelog author="hguo@suse.com" date="1496318400">- Upgrade to upstream release 2.1 that brings important enhancements
  in effort of implementing fate#322979:
  * Improve KMIP compatibility with key prefix names and proper
    serialisation of authentication header.
  * Fail over KMIP connection using a server list.
  * Destroy key on KMIP after its tracking record is erased from DB.</changelog>
  <changelog author="hguo@suse.com" date="1496836800">- Upgrade to upstream release 2.2 that brings important enhancements
  in effort of implementing fate#322979:
  * System administrator may now optionally turn off TLS certificate
    verification on KMIP server. Note that, certificate verification
    is enforced by default.
  * Improve handling of boolean answers from interactive command line.
  * Improve error handling in KMIP client.</changelog>
  <changelog author="hguo@suse.com" date="1503921600">- Upgrade to upstream release 2.3 that brings a new feature to allow
  system administrators to issue mount/umount commands to client
  computers via key server. (bsc#1056082)</changelog>
  <changelog author="hguo@suse.com" date="1508760000">- Add previously missing systemd service cryptctl-client.service
  into RPM content, continue with bsc#1056082.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1623412800">- Update to version 2.4:
  * (bsc#1186226) - (CVE-2019-18906) client side password hashing is equivalent to clear text password storage
  * Fix authentication on all places.
  * Fix sysconfig variable name.
  * First step to use plain text password instead of hashed password.
  * Move repository into the SUSE github organization
  * decorate readme with more usage instructions
  * in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address
  * Test clear expired commands in TestDB_UpdateSeenFlag
  * tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case
  * avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.</changelog>
</package>
<package pkgid="7b975eafd792ee04db20cef30c9f22521852d0d12f71a3d02e3e90a42efe46dd" name="cryptctl" arch="x86_64">
  <version epoch="0" ver="2.4" rel="4.5.1"/>
  <changelog author="hguo@suse.com" date="1465387200">- First version, only to help with building ISOs.
  Implement fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1467374400">- A preview version with most of the desired functions implemented:
  * Key database
  * Key RPC server
  * Client encryption and decryption routines
  Bump version to 1.1
  fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1468238400">- Implement mandatory features:
  * List and edit key records
  * Unlock file system via key record file
  * Use custom options to mount unlocked file system
  Enhance usability:
  * Make encryption procedure's pre-check more thorough
  * Improve overall command prompts
- Bump version to 1.2 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1470052800">- Implement mandatory features:
  * Encrypt empty directory skips backup steps.
  * Explain key revocation and TLS mechanisms in manual page.
- Bump version to 1.2.1 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1470225600">- Upon request, generate a self-signed TLS certificate for
  experimental purposes.
- Bump version to 1.2.2 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1471521600">- Implement mandatory enhancements:
  * Remove necessity for a backup directory to be involved for
    encryption routine.
  * Optimise certificate generation prompts.
  * Remove unused error messages and fix several of their typos.
  * Remove unnecessary safety checks.
  * Make the encryption routine work with btrfs and LVM.
- Bump version to 1.2.3 fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1472817600">- Implement mandatory enhancements:
  * Make workflow across all sub-commands consistent in invocation
    style.
  * Implement auto-unlocking of encrypted disks.
  * Show key record usage and details on demand.
- Bump version to 1.2.4 for fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1474027200">- Implement mandatory enhancements:
  * Do not allow encrypting a remote file system.
  * Implement command for erasing an encrypted file system.
- Bump version to 1.2.5 for fate#320367.</changelog>
  <changelog author="hguo@suse.com" date="1479297600">- Upgrade to 1.2.6 for accumulated bug fixes (bsc#1006219):
  * Prevent user from attempting to encrypt a disk with mounted
    partitions, or an existing encrypted+opened disk.
  * Ensure CA path input is an absolute path.
  * Fix two mistakes in handling of timeout input.
  * Fix minor formatting issue in manual page.
  * Suppress consecutive failure messages in the journal of
    ReportAlive and AutoOnlineUnlockFS routines.</changelog>
  <changelog author="hguo@suse.com" date="1493380800">- Upgrade to 1.99pre that introduces a library for decoding, encoding,
  and serialisation operations of KMIP v1.3 for fate#322979.</changelog>
  <changelog author="hguo@suse.com" date="1494504000">- Upgrade to upstream release 2.0 that brings a protocol evolution
  together with several new features:
  * Optionally utilise an external KMIP-v1.3 compatible service to
    store actual encryption key.
  * Optionally verify client identity before serving its key requests.
  * Password is hashed before transmitting over TLS-secured channel.
  * Fix an issue that previously allowed a malicious administrator
    to craft RPC request to overwrite files outside of key database.
  Implemented accordint to fate#322979 and fate#322293.</changelog>
  <changelog author="hguo@suse.com" date="1496318400">- Upgrade to upstream release 2.1 that brings important enhancements
  in effort of implementing fate#322979:
  * Improve KMIP compatibility with key prefix names and proper
    serialisation of authentication header.
  * Fail over KMIP connection using a server list.
  * Destroy key on KMIP after its tracking record is erased from DB.</changelog>
  <changelog author="hguo@suse.com" date="1496836800">- Upgrade to upstream release 2.2 that brings important enhancements
  in effort of implementing fate#322979:
  * System administrator may now optionally turn off TLS certificate
    verification on KMIP server. Note that, certificate verification
    is enforced by default.
  * Improve handling of boolean answers from interactive command line.
  * Improve error handling in KMIP client.</changelog>
  <changelog author="hguo@suse.com" date="1503921600">- Upgrade to upstream release 2.3 that brings a new feature to allow
  system administrators to issue mount/umount commands to client
  computers via key server. (bsc#1056082)</changelog>
  <changelog author="hguo@suse.com" date="1508760000">- Add previously missing systemd service cryptctl-client.service
  into RPM content, continue with bsc#1056082.</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="varkoly@suse.com" date="1623412800">- Update to version 2.4:
  * (bsc#1186226) - (CVE-2019-18906) client side password hashing is equivalent to clear text password storage
  * Fix authentication on all places.
  * Fix sysconfig variable name.
  * First step to use plain text password instead of hashed password.
  * Move repository into the SUSE github organization
  * decorate readme with more usage instructions
  * in RPC server, if client comes from localhost, remember its ipv4 localhost address instead of ipv6 address
  * Test clear expired commands in TestDB_UpdateSeenFlag
  * tell a record to clear expired pending commands upon saving a command result; introduce pending commands RPC test case
  * avoid hard coding 127.0.0.1 in host ID of alive message test; let system administrator mount and unmount disks by issuing these two commands on key server.</changelog>
</package>
<package pkgid="2861a9b00479b9bb0ec6978d9fee6696c3ae6c7c0fa405fe0466457caf12318a" name="csync2" arch="aarch64">
  <version epoch="0" ver="2.0+git.1600444747.83b3644" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1427371200">- Add csync2-librsync-1.0.0.patch: Fix build with librsync 1.0.0.</changelog>
  <changelog author="kgronlund@suse.com" date="1461758400">- Update to csync2-2.0-6-g10636a4:
  - Document the -N flag to bind csync2 to a specific ip address.
  - fix diff mode truncation to first 512 byte
  - fix diff mode prefix substitution
- Drop merged patches:
  - Remove csync2-librsync-1.0.0.patch
  - Remove fix-csync2_ssl_cert-filename.patch</changelog>
  <changelog author="jengelh@inai.de" date="1462536000">- Avoid runtime dependency on systemd, the macros can all deal with
  its absence.
- Ensure csync@.service template instances are disabled on package
  removal.</changelog>
  <changelog author="olaf@aepfle.de" date="1499947200">- Requires(post) hostname|openssl</changelog>
  <changelog author="tchvatal@suse.com" date="1500465600">- Remove systemd dep in favor of systemd-rpm-macros
- Format a bit with spec-cleaner
- Add proper dependency over openssl
- Remove all the tex deps as we now reduce from 300 to 160 buildrequires
- Remove xinetd service and use only socket activation to keep
  only one tool for the job
  * Also remove patch csync2-fix-xinetd.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1534248000">- Avoid systemd service removal errors when uninstalling (bsc#1093165)</changelog>
  <changelog author="kgronlund@suse.com" date="1534334400">- comparison of peer names provided via command line should not be case sensitive (bsc#1082576)
- fix for inetd stderr &gt;&amp; stdout
- fix log message when generating backup files, demote log level
- document -l and -N switches</changelog>
  <changelog author="kgronlund@suse.com" date="1558958400">- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1558958401">- Update to 2.0+git.1542296533.b974921:
  * Convert documentation to asciidoc
  * Add error handling for out-of-memory while parsing config file
  * create_key: use all random bits; add some error handling
- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="varkoly@suse.com" date="1617796800">- Update to 2.0+git.1600444747.83b3644:
  * VUL-1: CVE-2019-15522: csync2: daemon fails to enforce TLS
    (bsc#1147137)
  * VUL-1: CVE-2019-15523: csync2: incorrect TLS handshake error handling
    (bsc#1147139
  * use standard %lld instead of non-standard %Ld format specifier
  * try to avoid (temporary) -rw------- root:root files on receiving side
  * fix diff mode truncation to first 512 byte
  * disable xinetd template by default as preparation for systemd socket unit
  * add systemd csync2.socket and csync2@.service templates
  * escape peername in SQL statements
- VUL-1: csync2: bad TLS key generation on installation (bsc#1145032)
  Adapt suggested changes in %post section.
  Do not hide output on standard error during generating the keys.
- Remove patches contained by update:
  * 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * 0002-Patch-sonames.patch
  * 0001-Add-COPYING-as-docfile.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623240000">- (bsc#1187080) Upgrade and removal of csync2 package throws error
  for non-existent service template:
  Removeinstance templates from %service_* macros.</changelog>
</package>
<package pkgid="f02a14dad61c6775a58f55a6b8ef47a2348566802de3367a2d4a9db6b9be4c28" name="csync2" arch="ppc64le">
  <version epoch="0" ver="2.0+git.1600444747.83b3644" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1427371200">- Add csync2-librsync-1.0.0.patch: Fix build with librsync 1.0.0.</changelog>
  <changelog author="kgronlund@suse.com" date="1461758400">- Update to csync2-2.0-6-g10636a4:
  - Document the -N flag to bind csync2 to a specific ip address.
  - fix diff mode truncation to first 512 byte
  - fix diff mode prefix substitution
- Drop merged patches:
  - Remove csync2-librsync-1.0.0.patch
  - Remove fix-csync2_ssl_cert-filename.patch</changelog>
  <changelog author="jengelh@inai.de" date="1462536000">- Avoid runtime dependency on systemd, the macros can all deal with
  its absence.
- Ensure csync@.service template instances are disabled on package
  removal.</changelog>
  <changelog author="olaf@aepfle.de" date="1499947200">- Requires(post) hostname|openssl</changelog>
  <changelog author="tchvatal@suse.com" date="1500465600">- Remove systemd dep in favor of systemd-rpm-macros
- Format a bit with spec-cleaner
- Add proper dependency over openssl
- Remove all the tex deps as we now reduce from 300 to 160 buildrequires
- Remove xinetd service and use only socket activation to keep
  only one tool for the job
  * Also remove patch csync2-fix-xinetd.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1534248000">- Avoid systemd service removal errors when uninstalling (bsc#1093165)</changelog>
  <changelog author="kgronlund@suse.com" date="1534334400">- comparison of peer names provided via command line should not be case sensitive (bsc#1082576)
- fix for inetd stderr &gt;&amp; stdout
- fix log message when generating backup files, demote log level
- document -l and -N switches</changelog>
  <changelog author="kgronlund@suse.com" date="1558958400">- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1558958401">- Update to 2.0+git.1542296533.b974921:
  * Convert documentation to asciidoc
  * Add error handling for out-of-memory while parsing config file
  * create_key: use all random bits; add some error handling
- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="varkoly@suse.com" date="1617796800">- Update to 2.0+git.1600444747.83b3644:
  * VUL-1: CVE-2019-15522: csync2: daemon fails to enforce TLS
    (bsc#1147137)
  * VUL-1: CVE-2019-15523: csync2: incorrect TLS handshake error handling
    (bsc#1147139
  * use standard %lld instead of non-standard %Ld format specifier
  * try to avoid (temporary) -rw------- root:root files on receiving side
  * fix diff mode truncation to first 512 byte
  * disable xinetd template by default as preparation for systemd socket unit
  * add systemd csync2.socket and csync2@.service templates
  * escape peername in SQL statements
- VUL-1: csync2: bad TLS key generation on installation (bsc#1145032)
  Adapt suggested changes in %post section.
  Do not hide output on standard error during generating the keys.
- Remove patches contained by update:
  * 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * 0002-Patch-sonames.patch
  * 0001-Add-COPYING-as-docfile.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623240000">- (bsc#1187080) Upgrade and removal of csync2 package throws error
  for non-existent service template:
  Removeinstance templates from %service_* macros.</changelog>
</package>
<package pkgid="87c7b26dcbd3f24822549e565d3ee67137463027830482fc91ea147f118f69c5" name="csync2" arch="s390x">
  <version epoch="0" ver="2.0+git.1600444747.83b3644" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1427371200">- Add csync2-librsync-1.0.0.patch: Fix build with librsync 1.0.0.</changelog>
  <changelog author="kgronlund@suse.com" date="1461758400">- Update to csync2-2.0-6-g10636a4:
  - Document the -N flag to bind csync2 to a specific ip address.
  - fix diff mode truncation to first 512 byte
  - fix diff mode prefix substitution
- Drop merged patches:
  - Remove csync2-librsync-1.0.0.patch
  - Remove fix-csync2_ssl_cert-filename.patch</changelog>
  <changelog author="jengelh@inai.de" date="1462536000">- Avoid runtime dependency on systemd, the macros can all deal with
  its absence.
- Ensure csync@.service template instances are disabled on package
  removal.</changelog>
  <changelog author="olaf@aepfle.de" date="1499947200">- Requires(post) hostname|openssl</changelog>
  <changelog author="tchvatal@suse.com" date="1500465600">- Remove systemd dep in favor of systemd-rpm-macros
- Format a bit with spec-cleaner
- Add proper dependency over openssl
- Remove all the tex deps as we now reduce from 300 to 160 buildrequires
- Remove xinetd service and use only socket activation to keep
  only one tool for the job
  * Also remove patch csync2-fix-xinetd.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1534248000">- Avoid systemd service removal errors when uninstalling (bsc#1093165)</changelog>
  <changelog author="kgronlund@suse.com" date="1534334400">- comparison of peer names provided via command line should not be case sensitive (bsc#1082576)
- fix for inetd stderr &gt;&amp; stdout
- fix log message when generating backup files, demote log level
- document -l and -N switches</changelog>
  <changelog author="kgronlund@suse.com" date="1558958400">- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1558958401">- Update to 2.0+git.1542296533.b974921:
  * Convert documentation to asciidoc
  * Add error handling for out-of-memory while parsing config file
  * create_key: use all random bits; add some error handling
- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="varkoly@suse.com" date="1617796800">- Update to 2.0+git.1600444747.83b3644:
  * VUL-1: CVE-2019-15522: csync2: daemon fails to enforce TLS
    (bsc#1147137)
  * VUL-1: CVE-2019-15523: csync2: incorrect TLS handshake error handling
    (bsc#1147139
  * use standard %lld instead of non-standard %Ld format specifier
  * try to avoid (temporary) -rw------- root:root files on receiving side
  * fix diff mode truncation to first 512 byte
  * disable xinetd template by default as preparation for systemd socket unit
  * add systemd csync2.socket and csync2@.service templates
  * escape peername in SQL statements
- VUL-1: csync2: bad TLS key generation on installation (bsc#1145032)
  Adapt suggested changes in %post section.
  Do not hide output on standard error during generating the keys.
- Remove patches contained by update:
  * 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * 0002-Patch-sonames.patch
  * 0001-Add-COPYING-as-docfile.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623240000">- (bsc#1187080) Upgrade and removal of csync2 package throws error
  for non-existent service template:
  Removeinstance templates from %service_* macros.</changelog>
</package>
<package pkgid="61c3d4764b6077493bdb6bb5b0e8213477cc38600f2ceeb240705d5811793882" name="csync2" arch="src">
  <version epoch="0" ver="2.0+git.1600444747.83b3644" rel="3.3.1"/>
  <changelog author="tserong@suse.com" date="1316520000">- Add csync2-rm-ssl-cert helper script (bnc#709811)</changelog>
  <changelog author="tserong@suse.com" date="1319630400">- Remove explicit lib dependencies from spec file</changelog>
  <changelog author="coolo@suse.com" date="1329739200">- factory has librsync split into devel package</changelog>
  <changelog author="tserong@suse.com" date="1332158400">- Force debug output off completely when running under xinetd (fixes
  protocol breakage when target directories don't exist; bnc#752563)</changelog>
  <changelog author="tserong@suse.com" date="1338811200">- Drop requirement on libgnutls-extra-devel (unnecessary on openSUSE)</changelog>
  <changelog author="coolo@suse.com" date="1362052800">- update license to new format</changelog>
  <changelog author="tserong@suse.com" date="1368187200">- Try to bind to "local" IP explicitly to avoid "identification failed"
  errors with multiple IPs on same subnet (bnc#757327)
  + Added bind-to-local-hostname.patch</changelog>
  <changelog author="tserong@suse.com" date="1378900800">- Update to upstream version 2.0-rc2.  Changes since 1.34 too numerous
  to list, but include:
  + Database abstraction layer (default build uses sqlite3)
  + IPv6 support
  + Native GnuTLS support
  + tempdir and lock-timeout config options
  + do-local-only config option for actions
- Reworked patches and extra source being carried in openSUSE:
  + Added csync2.socket and csync2@.service for use via systemd
  + Added add-ac_prog_cpp.patch
  + Added fix-csync2_ssl_cert-filename.patch
  + Added fix-sonames.patch
  + Updated csync2-fix-xinetd.patch
  + Updated README.quickstart
  + Removed fix-missing-sentinels.diff (upstream)
  + Removed csync2-1.34-pure-gnutls-r2.patch (obsolete)
  + Removed force-debug-stderr-off-inetd.patch (obsolete)
  + Removed bind-to-local-hostname.patch (obsolete)</changelog>
  <changelog author="tserong@suse.com" date="1380196800">- Ensure COPYING file is included in package
  + Added add-COPYING.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1427371200">- Add csync2-librsync-1.0.0.patch: Fix build with librsync 1.0.0.</changelog>
  <changelog author="kgronlund@suse.com" date="1461758400">- Update to csync2-2.0-6-g10636a4:
  - Document the -N flag to bind csync2 to a specific ip address.
  - fix diff mode truncation to first 512 byte
  - fix diff mode prefix substitution
- Drop merged patches:
  - Remove csync2-librsync-1.0.0.patch
  - Remove fix-csync2_ssl_cert-filename.patch</changelog>
  <changelog author="jengelh@inai.de" date="1462536000">- Avoid runtime dependency on systemd, the macros can all deal with
  its absence.
- Ensure csync@.service template instances are disabled on package
  removal.</changelog>
  <changelog author="olaf@aepfle.de" date="1499947200">- Requires(post) hostname|openssl</changelog>
  <changelog author="tchvatal@suse.com" date="1500465600">- Remove systemd dep in favor of systemd-rpm-macros
- Format a bit with spec-cleaner
- Add proper dependency over openssl
- Remove all the tex deps as we now reduce from 300 to 160 buildrequires
- Remove xinetd service and use only socket activation to keep
  only one tool for the job
  * Also remove patch csync2-fix-xinetd.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1534248000">- Avoid systemd service removal errors when uninstalling (bsc#1093165)</changelog>
  <changelog author="kgronlund@suse.com" date="1534334400">- comparison of peer names provided via command line should not be case sensitive (bsc#1082576)
- fix for inetd stderr &gt;&amp; stdout
- fix log message when generating backup files, demote log level
- document -l and -N switches</changelog>
  <changelog author="kgronlund@suse.com" date="1558958400">- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1558958401">- Update to 2.0+git.1542296533.b974921:
  * Convert documentation to asciidoc
  * Add error handling for out-of-memory while parsing config file
  * create_key: use all random bits; add some error handling
- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="varkoly@suse.com" date="1617796800">- Update to 2.0+git.1600444747.83b3644:
  * VUL-1: CVE-2019-15522: csync2: daemon fails to enforce TLS
    (bsc#1147137)
  * VUL-1: CVE-2019-15523: csync2: incorrect TLS handshake error handling
    (bsc#1147139
  * use standard %lld instead of non-standard %Ld format specifier
  * try to avoid (temporary) -rw------- root:root files on receiving side
  * fix diff mode truncation to first 512 byte
  * disable xinetd template by default as preparation for systemd socket unit
  * add systemd csync2.socket and csync2@.service templates
  * escape peername in SQL statements
- VUL-1: csync2: bad TLS key generation on installation (bsc#1145032)
  Adapt suggested changes in %post section.
  Do not hide output on standard error during generating the keys.
- Remove patches contained by update:
  * 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * 0002-Patch-sonames.patch
  * 0001-Add-COPYING-as-docfile.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623240000">- (bsc#1187080) Upgrade and removal of csync2 package throws error
  for non-existent service template:
  Removeinstance templates from %service_* macros.</changelog>
</package>
<package pkgid="21ab47c06386a29a0e44b6eece73e5d17dd2d32dbd27f359e45aec22ed42249d" name="csync2" arch="x86_64">
  <version epoch="0" ver="2.0+git.1600444747.83b3644" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1427371200">- Add csync2-librsync-1.0.0.patch: Fix build with librsync 1.0.0.</changelog>
  <changelog author="kgronlund@suse.com" date="1461758400">- Update to csync2-2.0-6-g10636a4:
  - Document the -N flag to bind csync2 to a specific ip address.
  - fix diff mode truncation to first 512 byte
  - fix diff mode prefix substitution
- Drop merged patches:
  - Remove csync2-librsync-1.0.0.patch
  - Remove fix-csync2_ssl_cert-filename.patch</changelog>
  <changelog author="jengelh@inai.de" date="1462536000">- Avoid runtime dependency on systemd, the macros can all deal with
  its absence.
- Ensure csync@.service template instances are disabled on package
  removal.</changelog>
  <changelog author="olaf@aepfle.de" date="1499947200">- Requires(post) hostname|openssl</changelog>
  <changelog author="tchvatal@suse.com" date="1500465600">- Remove systemd dep in favor of systemd-rpm-macros
- Format a bit with spec-cleaner
- Add proper dependency over openssl
- Remove all the tex deps as we now reduce from 300 to 160 buildrequires
- Remove xinetd service and use only socket activation to keep
  only one tool for the job
  * Also remove patch csync2-fix-xinetd.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1534248000">- Avoid systemd service removal errors when uninstalling (bsc#1093165)</changelog>
  <changelog author="kgronlund@suse.com" date="1534334400">- comparison of peer names provided via command line should not be case sensitive (bsc#1082576)
- fix for inetd stderr &gt;&amp; stdout
- fix log message when generating backup files, demote log level
- document -l and -N switches</changelog>
  <changelog author="kgronlund@suse.com" date="1558958400">- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1558958401">- Update to 2.0+git.1542296533.b974921:
  * Convert documentation to asciidoc
  * Add error handling for out-of-memory while parsing config file
  * create_key: use all random bits; add some error handling
- Update patches
  * Add 0001-Add-COPYING-as-docfile.patch
  * Add 0002-Patch-sonames.patch
  * Add 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * Remove add-COPYING.patch
  * Remove add-ac_prog_cpp.patch
  * Remove fix-sonames.patch</changelog>
  <changelog author="varkoly@suse.com" date="1617796800">- Update to 2.0+git.1600444747.83b3644:
  * VUL-1: CVE-2019-15522: csync2: daemon fails to enforce TLS
    (bsc#1147137)
  * VUL-1: CVE-2019-15523: csync2: incorrect TLS handshake error handling
    (bsc#1147139
  * use standard %lld instead of non-standard %Ld format specifier
  * try to avoid (temporary) -rw------- root:root files on receiving side
  * fix diff mode truncation to first 512 byte
  * disable xinetd template by default as preparation for systemd socket unit
  * add systemd csync2.socket and csync2@.service templates
  * escape peername in SQL statements
- VUL-1: csync2: bad TLS key generation on installation (bsc#1145032)
  Adapt suggested changes in %post section.
  Do not hide output on standard error during generating the keys.
- Remove patches contained by update:
  * 0003-Set-AC_PROG_CPP-in-configure.ac.patch
  * 0002-Patch-sonames.patch
  * 0001-Add-COPYING-as-docfile.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623240000">- (bsc#1187080) Upgrade and removal of csync2 package throws error
  for non-existent service template:
  Removeinstance templates from %service_* macros.</changelog>
</package>
<package pkgid="f0673516520b628b02ad4752c8fea4d2d34bab09c545ffb9d36fec59cc7563fd" name="ctdb" arch="aarch64">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="41abcf14f3111b976c5b92e9a019fe68832e2059bc6464766305e2faed838dbc" name="ctdb" arch="ppc64le">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="14b32460a2a914a1d217d53f68edd508a579f3563a2f8a826c4bf5b8a1307a49" name="ctdb" arch="s390x">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="f41a946898043b29cf24c4831b5aae5c08d45d3e735cc0d19c3d265488592831" name="ctdb" arch="x86_64">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="1aac3a6db0fbcfbc7f6f466c44037d0583e61a411b2167ca35dfa443db0bb977" name="ctdb" arch="aarch64">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="887d70d3a3b0d3ca074850c472d8f7431e3981a9435deb5eefa77ceb7207b8ad" name="ctdb" arch="ppc64le">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="9540f9f1d17d9d7c66bfe9213396b8576bcf69b65b20e6bdcf0e4a2db64db993" name="ctdb" arch="s390x">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="7f3733e51bd4086372d7a58b42d392e06327a169ee0ad0800104b7adff03d8cf" name="ctdb" arch="x86_64">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="cef9160a4d99fe3d5b639c4d9ca268c409a490fe12b8d8585e4dc0326e016f25" name="ctdb" arch="aarch64">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="55b9673c989173d2130d0adde24f737823fe733d7e4d65a062f5d3aefe0e68e3" name="ctdb" arch="ppc64le">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="bbfe255587d73e23a65f8ac3376179993a515f81753ed0a298d5d4e399f5da8f" name="ctdb" arch="s390x">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="ba434bf773a2f50ad22699822c5814d587121d52169021a956050e5353c19206" name="ctdb" arch="x86_64">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="2067146bffbe716931aeebdb4d374ace43396e5c0b65143c6bf104f8457a5705" name="ctdb-pcp-pmda" arch="aarch64">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="294da03872ad2f671ba1342d159ef457ca4d2d107c33d7b96af38d0c25d7dd3b" name="ctdb-pcp-pmda" arch="ppc64le">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="23380e5fc118d5af230ba7a1a0644a345bed84e13487c43ee471f5b0c4457e85" name="ctdb-pcp-pmda" arch="s390x">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="11c404f5a0fb743c1353a35c814b2ac43b3fb6fcb23de5fa41fdf2e5ba79d06b" name="ctdb-pcp-pmda" arch="x86_64">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="50d47b8523dceaf84a970a13267f883bc5af8ec5dcb85b720dd7cd984b30e067" name="ctdb-pcp-pmda" arch="aarch64">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="574c103e7fe4ca6230dbdd05fbae9deae5d9d430f36205cb418f4a2603bd1bcd" name="ctdb-pcp-pmda" arch="ppc64le">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="9cba99c2c6eb560006906595728d532104bd9c804a4d1f7d55fdcdefa6999938" name="ctdb-pcp-pmda" arch="s390x">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="4de8d1ec34a26c49014a9d63b7856ef032c4d7272f37fb57dc5a2a01f2cd6c0f" name="ctdb-pcp-pmda" arch="x86_64">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="aea4f0021febeac35f0a34f638ed056fa6ecdbc5308b147cbf5bcd120b994733" name="ctdb-pcp-pmda" arch="aarch64">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="bf8a79d6bd580cab9ccb732e2cb2ba0fb28f949902d594b66494558a1a90f1d4" name="ctdb-pcp-pmda" arch="ppc64le">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="683d5006cf765cade942a9d93fbbb1e474960a46a8e004e752c3d8a8250ff0d1" name="ctdb-pcp-pmda" arch="s390x">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="4c16acb99a6838b83afc40fa9bf7a31ae62817c3ff8f31e936d6a2e46dd289ff" name="ctdb-pcp-pmda" arch="x86_64">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="28c53006c6f0fbf7a330bfee9100ac568e93534663d2e248f62860275a4cc732" name="ctdb-tests" arch="aarch64">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="a854922232267c3c2032d0cafe151be6329ba453b318e580926bf26071081799" name="ctdb-tests" arch="ppc64le">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="c29d1311c6014d05e6545ed778e36f97b455037d861f282c97227d1d9cecb8f9" name="ctdb-tests" arch="s390x">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="63a195bdad3843e448015c2eba38495b67aba1b6ae25d69b436055a0061f0c0b" name="ctdb-tests" arch="x86_64">
  <version epoch="0" ver="4.13.10+git.236.0517d0e6bdf" rel="3.7.12"/>
  <changelog author="scabrero@suse.de" date="1589457600">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
</package>
<package pkgid="83d22020e4b5d7b0be28a947aaae623372c5007ceca53050b0648f235667083c" name="ctdb-tests" arch="aarch64">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="234b2c22cdca4ba2fe67d2965fdd1de346d40311bf0e543ed621e2c316cb8aa9" name="ctdb-tests" arch="ppc64le">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="7b542175b1b8486b59d79b15919be14ebf58cf52620c492630a97ee2e4d65e70" name="ctdb-tests" arch="s390x">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="3c95b3b29deff76918e6f09f7fa03bd5037b579bc7895a819dce8581ed7143e0" name="ctdb-tests" arch="x86_64">
  <version epoch="0" ver="4.13.13+git.528.140935f8d6a" rel="3.12.1"/>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
  <changelog author="dmulder@suse.com" date="1629201600">- Fix dependency problem upgrading from libndr0 to libndr1;
  (bsc#1189875);
- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;
  (bsc#1189875);
- Fix wrong kvno exported to keytab after net ads changetrustpw due
  to replication delay; (bsc#1188727);
- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).
- Update to 4.13.10
  * s3: smbd: Ensure POSIX default ACL is mapped into returned
    Windows ACL for directory handles; (bso#14708);
  * Take a copy to make sure we don't reference free'd memory; (bso#14721);
  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);
  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in
    change_file_owner_to_parent() error path; (bso#14736);
  * samba-tool: Give better error information when the
    'domain backup restore' fails with a duplicate SID; (bso#14575);
  * smbd: Correctly initialize close timestamp fields; (bso#14714);
  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);
  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);
  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);
  * smbXsrv_{open,session,tcon}: Protect
    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);
  * samba-tool domain backup offline doesn't work against bind DLZ
    backend; (bso#14027);
  * netcmd: Use next_free_rid() function to calculate a SID for
    restoring a backup; (bso#14669);
- Update to 4.13.9
  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);
  * Add documentation for dsdb_group_audit and dsdb_group_json_audit
    to "log level", synchronise "log level" in smb.conf with the code; (bso#14689);
  * Fix smbd panic when two clients open same file; (bso#14672);
  * Fix memory leak in the RPC server; (bso#14675);
  * s3: smbd: Fix deferred renames; (bso#14679);
  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);
  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);
  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);
  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);
  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid
    conflict; (bso#14663);
  * Fix the build on OmniOS; (bso#14288);
- Update to 4.13.8
  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571
- Update to 4.13.7
  * Release with dependency on ldb version 2.2.1.</changelog>
  <changelog author="scabrero@suse.de" date="1631188800">- Fix 'net rpc' authentication when using the machine account;
  (bsc#1189017); (bso#14796);</changelog>
  <changelog author="nopower@suse.com" date="1636027200">- Update to 4.13.13
  * rodc_rwdc test flaps;(bso#14868).
  * Backport bronze bit fixes, tests, and selftest improvements;
    (bso#14881).
  * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]
    'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba
    with embedded Heimdal;(bso#14642).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * "in" operator on ldb.Message is case sensitive;(bso#14845).
  * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).
  * Allow special chars like "@" in samAccountName when generating
    the salt;(bso#14874).
  * Fix transit path validation;(bso#12998).
  * Prepare to operate with MIT krb5 &gt;= 1.20;(bso#14870).
  * rpcclient NetFileEnum and net rpc file both cause lock order
    violation: brlock.tdb, share_entries.tdb;(bso#14645).
  * Python ldb.msg_diff() memory handling failure;(bso#14836).
  * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).
- Update to 4.13.12
  * Address a signifcant performance regression in database access
    in the AD DC since Samba 4.12;(bso#14806).
  * Fix performance regression in lsa_LookupSids3/LookupNames4
    since Samba 4.9 by using an explicit database handle cache;
    (bso#14807).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Address flapping samba_tool_drs_showrepl test;(bso#14818).
  * Address flapping dsdb_schema_attributes test;(bso#14819).
  * An unuthenticated user can crash the AD DC KDC by omitting the
    server name in a TGS-REQ;(bso#14817).
  * Fix CTDB flag/status update race conditions(bso#14784).
- Update to 4.13.11
  * smbd: panic on force-close share during offload write;
    (bso#14769).
  * Fix returned attributes on fake quota file handle and avoid
    hitting the VFS;(bso#14731).
  * smbd: "deadtime" parameter doesn't work anymore;(bso#14783).
  * net conf list crashes when run as normal user;(bso#14787).
  * Work around special SMB2 READ response behavior of NetApp Ontap
    7.3.7;(bso#14607).
  * Start the SMB encryption as soon as possible;(bso#14793).
  * Winbind should not start if the socket path for the privileged
    pipe is too long;(bso#14792).</changelog>
  <changelog author="nopower@suse.com" date="1636027201">- CVE-2016-2124: don't fallback to non spnego authentication if we
  require kerberos; (bsc#1014440); (bso#12444).</changelog>
  <changelog author="nopower@suse.com" date="1636027202">- CVE-2020-25717: samba: A user on the domain can become root on
  domain members; (bsc#1192284); (bso#14556).
- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID
  values; (bsc#1192505); (bso#14564).
- CVE-2020-25718: An RODC can issue (forge) administrator tickets
  to other servers; (bsc#1192246);(bso#14558).
- CVE-2020-25719: samba: AD DC Username based races when no PAC
  is given;(bsc#1192247);(bso#14561).
- CVE-2020-25722: samba: AD DC UPN vs samAccountName not checked
  (top-level bug for AD DC validation issues);(bsc#1192283);
  (bso#14564).
- CVE-2021-3738: samba: crash in dsdb stack;(bsc#1192215);
  (bso#14468).
- CVE-2021-23192: samba: dcerpc requests don't check all fragments
  against the first auth_state;(bsc#1192214);(bso#14875).</changelog>
</package>
<package pkgid="f31eb0f1b916c4423691a70c20db125e63626a3122f590173392aa184415ddfc" name="ctdb-tests" arch="aarch64">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="4d7ee95781e9ab23bca54fb4debb62ac6579f5d88c07c226f1c0b6cb62bb5c41" name="ctdb-tests" arch="ppc64le">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="b4fc6472143f9b08cb83ebc36b1f1237e7be7fde2cc7d00985536bbbbbd8c61d" name="ctdb-tests" arch="s390x">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="0dfa5f014d4222478f920dd92b2e98a0f823e1dcb60e8a244f5fefa637a22bcb" name="ctdb-tests" arch="x86_64">
  <version epoch="0" ver="4.13.6+git.211.555d60b24ba" rel="3.7.1"/>
  <changelog author="scabrero@suse.de" date="1588593600">- Require libldb2 &gt;= 2.0.10 after security release.</changelog>
  <changelog author="dmulder@suse.com" date="1589457600">- Fix samba_winbind package is installing python3-base without
  python3 package; (bsc#1169521);</changelog>
  <changelog author="scabrero@suse.de" date="1589457601">- Installing: samba - samba-ad-dc.service does not exist and unit
  not found; (bsc#1171437);</changelog>
  <changelog author="scabrero@suse.de" date="1591012800">- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);</changelog>
  <changelog author="nopower@suse.com" date="1593691200">- Update to samba 4.11.11
  + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ
    and VLV combined; (bso#14364); (bsc#1173159]
  + CVE-2020-10745: invalid DNS or NBT queries containing dots use
    several seconds of CPU each; (bso#14378); (bsc#1173160).
  + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP
    server with paged_result or VLV; (bso#14402); (bsc#1173161)
  + CVE-2020-14303: Endless loop from empty UDP packet sent to
    AD DC nbt_server; (bso#14417); (bsc#1173359).
- Update to samba 4.11.10
  + Fix segfault when using SMBC_opendir_ctx() routine for share
    folder that contains incorrect symbols in any file name;
    (bso#14374).
  + vfs_shadow_copy2 doesn't fail case looking in
    snapdirseverywhere mode; (bso#14350)
  + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr;
    (bso#14413).
  + Malicous SMB1 server can crash libsmbclient; (bso#14366)
  + winbindd: Fix a use-after-free when winbind clients exit;
    (bso#14382)
  + ldb: Bump version to 2.0.11, LMDB databases can grow without
    bounds. (bso#14330)
- Update to samba 4.11.9
  + nmblib: Avoid undefined behaviour in handle_name_ptrs();
    (bso#14242).
  + 'samba-tool group' commands do not handle group names with
    special chars correctly; (bso#14296).
  + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo
    is not valid; (bso#14237).
  + Missing check for DMAPI offline status in async DOS
    attributes; (bso#14293).
  + smbd: Ignore set NTACL requests which contain
    S-1-5-88 NFS ACEs; (bso#14307).
  + vfs_recycle: Prevent flooding the log if we're called on
    non-existant paths; (bso#14316)
  + smbd mistakenly updates a file's write-time on close;
    (bso#14320).
  + RPC handles cannot be differentiated in source3 RPC server;
    (bso#14359).
  + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313).
  + nsswitch: Fix use-after-free causing segfault in
    _pam_delete_cred; (bso#14327).
  + Fix fruit:time machine max size on arm; (bso#13622)
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294).
  + ctdb: Fix a memleak; (bso#14348).
  + libsmb: Don't try to find posix stat info in SMBC_getatr().
  + ctdb-tcp: Move free of inbound queue to TCP restart;
    (bso#14295); (bsc#1162680).
  + s3/librpc/crypto: Fix double free with unresolved
    credential cache; (bso#14344); (bsc#1169095)
  + s3:libads: Fix ads_get_upn(); (bso#14336).
  + CTDB recovery corner cases can cause record resurrection
    and node banning; (bso#14294)
  + Starting ctdb node that was powered off hard before
    results in recovery loop; (bso#14295); (bsc#1162680).
  + ctdb-recoverd: Avoid dereferencing NULL rec-&gt;nodemap;
    (bso#14324)
- Update to samba 4.11.8
  + CVE-2020-10700: Use-after-free in Samba AD DC LDAP
    Server with ASQ; (bso#14331); (bsc#1169850);
  + CVE-2020-10704: LDAP Denial of Service (stack overflow)
    in Samba AD DC; (bso#14334); (bsc#1169851);
- Update to samba 4.11.7
  + s3: lib: nmblib. Clean up and harden nmb packet
    processing; (bso#14239).
  + s3: VFS: full_audit. Use system session_info if called
    from a temporary share definition; (bso#14283)
  + dsdb: Correctly handle memory in objectclass_attrs;
    (bso#14258).
  + ldb: version 2.0.9, Samba 4.11 and later give incorrect
    results for SCOPE_ONE searches; (bso#14270)
  + auth: Fix CIDs 1458418 and 1458420 Null pointer
    dereferences; (bso#14247).
  + smbd: Handle EINTR from open(2) properly; (bso#14285)
  + winbind member (source3) fails local SAM auth with empty
    domain name; (bso#14247)
  + winbindd: Handling missing idmap in getgrgid(); (bso#14265).
  + lib:util: Log mkdir error on correct debug levels;
    (bso#14253).
  + wafsamba: Do not use 'rU' as the 'U' is deprecated in
    Python 3.9; (bso#14266).
  + ctdb-tcp: Make error handling for outbound connection
    consistent; (bso#14274).
- Update to samba 4.11.6
  + pygpo: Use correct method flags; (bso#14209).
  + vfs_ceph_snapshots: Fix root relative path handling;
    (bso#14216); (bsc#1141320).
  + Avoiding bad call flags with python 3.8, using METH_NOARGS
    instead of zero; (bso#14209).
  + source4/utils/oLschema2ldif: Include stdint.h before
    cmocka.h; (bso#14218).
  + docs-xml/winbindnssinfo: Clarify interaction with
    idmap_ad etc; (bso#14122).
  + smbd: Fix the build with clang; (bso#14251).
  + upgradedns: Ensure lmdb lock files linked; (bso#14199).
  + s3: VFS: glusterfs: Reset nlinks for symlink entries during
    readdir; (bso#14182).
  + smbc_stat() doesn't return the correct st_mode and also
    the uid/gid is not filled (SMBv1) file; (bso#14101).
  + librpc: Fix string length checking in
    ndr_pull_charset_to_null(); (bso#14219).
  + ctdb-scripts: Strip square brackets when gathering
    connection info; (bso#14227).</changelog>
  <changelog author="dmulder@suse.com" date="1594728000">- Fix net command unable to negotiate SMB2; (bsc#1174120);</changelog>
  <changelog author="scabrero@suse.de" date="1595851200">- Add obsoletes to libsmbldap2 package to fix upgrades from previous
  versions; (bsc#1172810);</changelog>
  <changelog author="scabrero@suse.de" date="1600430400">- Update to samba 4.11.13
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect
    netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579);
    (bso#14497);
  + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support
    "server require schannel:WORKSTATION$ = no" about unsecure configurations;
    (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client
    challenge; (bsc#1176579); (bso#14497);
  + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in
    netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no";
    (bsc#1176579); (bso#14497);
- Update to samba 4.11.12
  + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403);
  + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work
    on RHEL7; (bso#14424);
  + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450);
  + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL;
    (bso#14426);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + lib/util: do not install "test_util_paths"; (bso#14370);
  + lib:util: Fix smbclient -l basename dir; (bso#14345);
  + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428);
  + util: Allow symlinks in directory_create_or_exist; (bso#14166);
  + docs: Fix documentation for require_membership_of of pam_winbind;
    (bso#14358);
  + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal;
    (bso#14425);</changelog>
  <changelog author="ddiss@suse.com" date="1600776000">- Update to samba 4.13.0
  + Require Python 3.6
  + Move wide links functionality into VFS module
  + Deprecate NT4-like 'classic' Samba domain controllers
  + Deprecate SMBv1 only protocol options
  + Remove deprecated "ldap ssl ads" option
  + Unify asynchronous DCE-RPC server; (jsc#SES-645)
  + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655)
  + Drop internal byteorder.h header from util-devel package
  + Remove final code for the AD DC LDAP backend
  + Add AD DC Group Policy Scripts
  + Only use gnutls_aead_cipher_encryptv2() for GnuTLS &gt; 3.6.14; (bso#14399)
  + Fix %U substitutions if it contains a domain name; (bso#14467)
  + Fix krb5.conf creation for 'net ads join'; (bso#14479)
  + Fix build problem if libbsd-dev is not installed; (bso#14482)
  + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437)
  + Fix idmap_ad RFC4511 response handling; (bso#14465)
  + Fix panic in get_lease_type(); (bso#14428)</changelog>
  <changelog author="ddiss@suse.com" date="1600948800">- Register CTDB recovery lock holder with ceph-mgr
- Add liburing-devel dependency</changelog>
  <changelog author="ddiss@suse.com" date="1601899200">- Fix vfs_ceph query_directory regression; (bso#14519)
- Drop liburing-devel for SLE15-SP2; (bsc#1177245)</changelog>
  <changelog author="scabrero@suse.de" date="1601985600">- Update to samba 4.13.1
  + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with
    easily crafted records; (bsc#1177613); (bso#14472);
  + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994);
    (bso#14436);
  + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify;
    (bsc#1173902); (bso#14434);
- Adjust systemd tmpfiles.d configuration, use /run/samba instead of
  /var/run/samba; (bsc#1177355);</changelog>
  <changelog author="nopower@suse.com" date="1604577600">- Adjust smbcacls '--propagate-inheritance' feature to align with
  upstream; (bsc#1178469).</changelog>
  <changelog author="scabrero@suse.de" date="1605528000">- Update to 4.13.2
  + s3: modules: vfs_glusterfs: Fix leak of char **lines onto
    mem_ctx on return; (bso#14486);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);
  + smb.conf.5: Add clarification how configuration changes reflected
    by Samba; (bso#14538);
  + daemons: Report status to systemd even when running in foreground;
    (bso#14552);
  + DNS Resolver: Support both dnspython before and after 2.0.0;
    (bso#14553);
  + s3-vfs_glusterfs: Refuse connection when write-behind xlator is
    present; (bso#14486);
  + provision: Add support for BIND 9.16.x; (bso#14487);
  + ctdb-common: Avoid aliasing errors during code optimization;
    (bso#14537);
  + libndr: Avoid assigning duplicate versions to symbols; (bso#14541);
  + docs: Fix default value of spoolss:architecture; (bso#14522);
  + winbind: Fix a memleak; (bso#14388);
  + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531);
  + docs-xml/manpages: Add warning about write-behind translator for
    vfs_glusterfs; (bso#14486);
  + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h.
  + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530);
  + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547);
  + examples:auth: Do not install example plugin; (bso#14550);
  + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513);
  + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special;
    (bso#14471);</changelog>
  <changelog author="scabrero@suse.de" date="1608120000">- Update to 4.13.3
  + libcli: smb2: Never print length if smb2_signing_key_valid() fails for
    crypto blob; (bso#14210);
  + s3: modules: gluster. Fix the error I made in preventing talloc leaks
    from a function; (bso#14486);
  + s3: smbd: Don't overwrite contents of fsp-&gt;aio_requests[0] with NULL
    via TALLOC_FREE(); (bso#14515);
  + s3: spoolss: Make parameters in call to user_ok_token() match all other
    uses; (bso#14568);
  + s3: smbd: Quiet log messages from usershares for an unknown share;
    (bso#14590);
  + samba process does not honor max log size; (bso#14248);
  + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE;
    (bso#14587);
  + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124);
  + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486);
  + smbclient: Fix recursive mget; (bso#14517);
  + clitar: Use do_list()'s recursion in clitar.c; (bso#14581);
  + manpages/vfs_glusterfs: Mention silent skipping of write-behind
    translator; (bso#14486);
  + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573);
  + interface: Fix if_index is not parsed correctly; (bso#14514);</changelog>
  <changelog author="scabrero@suse.de" date="1609156800">- Uninstalling samba-client: Failed to disable unit, cifs.service
  does not exists; (bsc#1180388);</changelog>
  <changelog author="scabrero@suse.de" date="1611662400">- Update to 4.13.4
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap
    7.3.7; (bso#14607);
  * Temporary DFS share setup doesn't set case parameters in the same
    way as a regular share definition does; (bso#14612);
  * lib: Avoid declaring zero-length VLAs in various messaging functions;
    (bso#14605);
  * Do not create an empty DB when accessing a sam.ldb; (bso#14579);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Temporary DFS share setup doesn't set case parameters in the same way
    as a regular share definition does; (bso#14612);
  * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606);
  * vfs_fruit may close wrong backend fd; (bso#14596);
  * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7;
    (bso#14607);
  * The cache directory for the user gencache should be created recursively;
    (bso#14601);
  * Be more flexible with repository names in CentOS 8 test environments;
    (bso#14594);</changelog>
  <changelog author="scabrero@suse.de" date="1614600000">- Spec file fixes around systemd and requires; (bsc#1182830);
- Align systemd service unit files with upstream provided ones.</changelog>
  <changelog author="scabrero@suse.de" date="1617019200">- Fix offline domain backup not possible using lmdb version &gt;= 0.9.26;
  (bso#14676);
- Require libldb &gt;= 2.2.1; (bsc#1183572); (bsc#1183574);
- Update to 4.13.6
  * CVE-2020-27840: samba: Unauthenticated remote heap corruption
    via bad DNs; (bso#14595); (bsc#1183572).
  * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold;
    (bso#14655); (bsc#1183574).
- Update to 4.13.5
  * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite
    start-up failure; (bso#14634);
  * s3: libsmb: Add missing cli_tdis() in error path if encryption setup
    failed on temp proxy connection; (bso#13992);
  * smbd: In conn_force_tdis_done() when forcing a connection closed force
    a full reload of services; (bso#14604);
  * dbcheck: Check Deleted Objects and reduce noise in reports about
    expired tombstones (bso#14593);
  * s3: Fix fcntl waf configure check; (bso#14503);
  * s3/auth: Implement "winbind:ignore domains"; (bso#14602);
  * smbd: Use fsp-&gt;conn-&gt;session_info for the initial delete-on-close
    token; (bso#14617);
  * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path;
    (bso#14648);
  * classicupgrade: Treat old never expires value right; (bso#14624);
  * g_lock: Fix uninitalized variable reads; (bso#14636);
  * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898);
  * lib:util: Avoid free'ing our own pointer; (bso#14625);
  * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);</changelog>
  <changelog author="nopower@suse.com" date="1618401600">-  CVE-2021-20254 Buffer overrun in sids_to_unixids();
  (bnc#14571); (bsc#1184677).</changelog>
</package>
<package pkgid="ba738422bd430f3c09af451a472d63c9eeccddca4166ba34451aab92eb43e65e" name="curl" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="48eb01183876062d1fa5e7231a7039a05d811ac9eeb16e1292b79d95d0087cab" name="curl" arch="ppc64le">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="e44f0e34e27b6a4719270f13f5530c5ba9407286305b196df96650d2e605d10f" name="curl" arch="s390x">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="aa43ade4a5cc39af285354ca89c328ba4d1a053c5dbe08ca96d4f52141306068" name="curl" arch="src">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="843e1e8ff93f685250a1af87462584e6afbf66419cd11234faa858f63849dd88" name="curl" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="e0935cfcb6247847ecbb5f70c5d58e14397a9d16f70e7df9df76eca28e034364" name="curl" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="4.22.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
</package>
<package pkgid="c8b36aa034d07182e55812cbc969a777fd87f1c63a30c195c9dc86dc7832e1a6" name="curl" arch="ppc64le">
  <version epoch="0" ver="7.66.0" rel="4.22.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
</package>
<package pkgid="ffb8268075ae91eb9e380bb85fe1af81a80bf898f919cbdf898f10cd7f2c4afc" name="curl" arch="s390x">
  <version epoch="0" ver="7.66.0" rel="4.22.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
</package>
<package pkgid="b0ad52ccf697728b598b9289fd078c8d86a09992cd3a03818b3b1b5ef6fe4a42" name="curl" arch="src">
  <version epoch="0" ver="7.66.0" rel="4.22.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
</package>
<package pkgid="da5d4a4900abb9f33d9bb22d9d8234886d038ad82bf778c90f06f707779cd3f5" name="curl" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="4.22.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
</package>
<package pkgid="d649d05d7c23702b4b6680170446eab19e3548042d2a20c28fde8170a8c745d4" name="curl" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="4.27.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
</package>
<package pkgid="014798a1913b834fdd5b63b271d10321d626ef6b0818b228fa0c39f169fc275a" name="curl" arch="ppc64le">
  <version epoch="0" ver="7.66.0" rel="4.27.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
</package>
<package pkgid="fd3667937ce9dd8867ac24cfa45dc21efc2e9256c17e0e97511ce029e4ded4e5" name="curl" arch="s390x">
  <version epoch="0" ver="7.66.0" rel="4.27.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
</package>
<package pkgid="6d3ec1ab1d2ffe382167a32e25d0431aac1375b0726f2b94f15dec54b0bcd2ea" name="curl" arch="src">
  <version epoch="0" ver="7.66.0" rel="4.27.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
</package>
<package pkgid="4b325b0dee3e13332ef3031b7fead11da2a73a92c43ee3be3fe23eaedb4c3455" name="curl" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="4.27.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Security fix: Disable the metalink feature:
  * Insufficiently Protected Credentials [bsc#1188218, CVE-2021-22923]
  * Wrong content via metalink not discarded [bsc#1188217, CVE-2021-22922]</changelog>
  <changelog author="pmonreal@suse.com" date="1626091201">- Security fix: [bsc#1188219, CVE-2021-22924]
  * Bad connection reuse due to flawed path name checks
  * Add curl-CVE-2021-22924.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626177600">- Security fix: [bsc#1188220, CVE-2021-22925]
  * TELNET stack contents disclosure again
  * Add curl-CVE-2021-22925.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534400">- Security fix: [bsc#1190373, CVE-2021-22946]
  * Protocol downgrade required TLS bypassed
  * Add curl-CVE-2021-22946.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1631534401">- Security fix: [bsc#1190374, CVE-2021-22947]
  * STARTTLS protocol injection via MITM
  * Add curl-CVE-2021-22947.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1632312000">- MIME: Properly check Content-Type even if it has parameters
  * Add curl-check-content-type.patch [bsc#1190153]</changelog>
</package>
<package pkgid="5a689bdcdeba1e1e6b3c92da7f715aa4457cc6f6545bfacc1985460c3dbdebf8" name="curl-mini" arch="aarch64">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="ab56994d1e97b136de66b780a9af4c45a4ec9a48ab18637e0477fb9d535aac7d" name="curl-mini" arch="ppc64le">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="7751003ed068c738777ccb85703899e8b226afc0986d73b38e1808ed14147257" name="curl-mini" arch="s390x">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="4a5ca7b43d0806690e897aeb5c5773bec041b12a9603da8a772670803c0c6500" name="curl-mini" arch="src">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="f83abdf0c11d4a29894f21013f7eb9169a8ef3bc4f69161f3a7a325ce7a1fcc1" name="curl-mini" arch="x86_64">
  <version epoch="0" ver="7.66.0" rel="4.17.1"/>
  <changelog author="pmonrealgonzalez@suse.com" date="1554811200">- Install curl.fish completions file from curl rather than from the fish package</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558008000">- Security fix [bsc#1135170, CVE-2019-5436]
  * A heap buffer overflow exists in tftp_receive_packet that
    receives data from a TFTP server
  * Added curl-CVE-2019-5436.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1558526400">- Update to 7.65.0 [bsc#1135176, CVE-2019-5435][bsc#1135170, CVE-2019-5436]
  * Changes:
  - CURLOPT_DNS_USE_GLOBAL_CACHE: removed
  - CURLOPT_MAXAGE_CONN: set the maximum allowed age for conn reuse
  - pipelining: removed
  * Bugfixes:
  - CVE-2019-5435: Integer overflows in curl_url_set
  - CVE-2019-5436: tftp: use the current blksize for recvfrom()
  - --config: clarify that initial : and = might need quoting
  - CURLMOPT_TIMERFUNCTION.3: warn about the recursive risk
  - CURLOPT_ADDRESS_SCOPE: fix range check and more
  - CURLOPT_CHUNK_BGN_FUNCTION.3: document the struct and time value
  - CURLOPT_READFUNCTION.3: see also CURLOPT_UPLOAD_BUFFERSIZE
  - CURL_MAX_INPUT_LENGTH: largest acceptable string input size
  - Curl_disconnect: treat all CONNECT_ONLY connections as "dead"
  - OS400/ccsidcurl: replace use of Curl_vsetopt
  - OpenSSL: Report -fips in version if OpenSSL is built with FIPS
  - WRITEFUNCTION: add missing set_in_callback around callback
  - altsvc: Fix building with cookies disabled
  - auth: Rename the various authentication clean up functions
  - base64: build conditionally if there are users
  - cmake: avoid linking executable for some tests with cmake 3.6+
  - cmake: clear CMAKE_REQUIRED_LIBRARIES after each use
  - cmake: set SSL_BACKENDS
  - configure: avoid unportable '==' test(1) operator
  - configure: error out if OpenSSL wasn't detected when asked for
  - configure: fix default location for fish completions
  - cookie: Guard against possible NULL ptr deref
  - curl: make code work with protocol-disabled libcurl
  - curl: report error for "--no-" on non-boolean options
  - curlver.h: use parenthesis in CURL_VERSION_BITS macro
  - docs/INSTALL: fix broken link
  - doh: acknowledge CURL_DISABLE_DOH
  - doh: disable DOH for the cases it doesn't work
  - examples: remove unused variables
  - ftplistparser: fix LGTM alert "Empty block without comment"
  - hostip: acknowledge CURL_DISABLE_SHUFFLE_DNS
  - http: Ignore HTTP/2 prior knowledge setting for HTTP proxies
  - http: acknowledge CURL_DISABLE_HTTP_AUTH
  - http: mark bundle as not for multiuse on &lt; HTTP/2 response
  - http_digest: Don't expose functions when HTTP and Crypto Auth are disabled
  - http_negotiate: do not treat failure of gss_init_sec_context() as fatal
  - http_ntlm: Corrected the name of the include guard
  - http_ntlm_wb: Handle auth for only a single request
  - http_ntlm_wb: Return the correct error on receiving an empty auth message
  - lib509: add missing include for strdup
  - lib557: initialize variables
  - mbedtls: enable use of EC keys
  - mime: acknowledge CURL_DISABLE_MIME
  - multi: improved HTTP_1_1_REQUIRED handling
  - netrc: acknowledge CURL_DISABLE_NETRC
  - nss: allow fifos and character devices for certificates
  - nss: provide more specific error messages on failed init
  - ntlm: Fix misaligned function comments for Curl_auth_ntlm_cleanup
  - ntlm: Support the NT response in the type-3 when OpenSSL doesn't include MD4
  - openssl: mark connection for close on TLS close_notify
  - openvms: Remove pre-processor for SecureTransport
  - parse_proxy: use the URL parser API
  - parsedate: disabled on CURL_DISABLE_PARSEDATE
  - pingpong: disable more when no pingpong protocols are enabled
  - polarssl_threadlock: remove conditionally unused code
  - progress: acknowledge CURL_DISABLE_PROGRESS_METER
  - proxy: acknowledge DISABLE_PROXY more
  - resolve: apply Happy Eyeballs philosophy to parallel c-ares queries
  - revert "multi: support verbose conncache closure handle"
  - sasl: Don't send authcid as authzid for the PLAIN mechanism as per RFC 4616
  - sasl: only enable if there's a protocol enabled using it
  - singleipconnect: show port in the verbose "Trying ..." message
  - socks5: user name and passwords must be shorter than 256
  - socks: fix error message
  - socksd: new SOCKS 4+5 server for tests
  - spnego_gssapi: fix return code on gss_init_sec_context() failure
  - ssh-libssh: remove unused variable
  - ssh: define USE_SSH if SSH is enabled (any backend)
  - ssh: move variable declaration to where it's used
  - test1002: correct the name
  - test2100: Fix typos in test description
  - tests: Run global cleanup at end of tests
  - tests: make Impacket (SMB server) Python 3 compatible
  - tool_cb_wrt: fix bad-function-cast warning
  - tool_formparse: remove redundant assignment
  - tool_help: Warn if curl and libcurl versions do not match
  - tool_help: include for strcasecmp
  - url: always clone the CUROPT_CURLU handle
  - url: convert the zone id from a IPv6 URL to correct scope id
  - urlapi: add CURLUPART_ZONEID to set and get
  - urlapi: increase supported scheme length to 40 bytes
  - urlapi: require a non-zero host name length when parsing URL
  - urlapi: stricter CURLUPART_PORT parsing
  - urlapi: strip off zone id from numerical IPv6 addresses
  - urlapi: urlencode characters above 0x7f correctly
  - vauth/cleartext: update the PLAIN login to match RFC 4616
  - vauth/oauth2: Fix OAUTHBEARER token generation
  - vauth: Fix incorrect function description for Curl_auth_user_contains_domain
  - vtls: fix potential ssl_buffer stack overflow
  - wildcard: disable from build when FTP isn't present
  - xattr: skip unittest on unsupported platforms</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559736000">- Update to 7.65.1
  * Bugfixes:
  - CURLOPT_LOW_SPEED_* repaired
  - NTLM: reset proxy "multipass" state when CONNECT request is done
  - PolarSSL: deprecate support step 1. Removed from configure
  - cmake: check for if_nametoindex()
  - cmake: support CMAKE_OSX_ARCHITECTURES when detecting SIZEOF variables
  - conncache: Remove the DEBUGASSERT on length check
  - conncache: make "bundles" per host name when doing proxy tunnels
  - curl_share_setopt.3: improve wording
  - dump-header.d: spell out that no headers == empty file
  - example/http2-download: fix format specifier
  - examples: cleanups and compiler warning fixes
  - http2: Stop drain from being permanently set
  - http: don't parse body-related headers in bodyless responses
  - md4: build correctly with openssl without MD4
  - md4: include the mbedtls config.h to get the MD4 info
  - multi: track users of a socket better
  - nss: allow to specify TLS 1.3 ciphers if supported by NSS
  - parse_proxy: make sure portptr is initialized
  - parse_proxy: use the IPv6 zone id if given
  - sectransp: handle errSSLPeerAuthCompleted from SSLRead()
  - singlesocket: use separate variable for inner loop
  - ssl: Update outdated "openssl-only" comments for supported backends
  - tests: add HAProxy keywords
  - tests: make test 1420 and 1406 work with rtsp-disabled libcurl
  - tls13-docs: mention it is only for OpenSSL &gt;= 1.1.1
  - tool_setopt: for builds with disabled-proxy, skip all proxy setopts()
  - url: fix bad feature-disable #ifdef
  - url: use correct port in ConnectionExists()</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563364800">- Update to 7.65.2
  * Bugfixes:
  - CIPHERS.md: Explain Schannel error SEC_E_ALGORITHM_MISMATCH
  - CMake: Fix finding Brotli on case-sensitive file systems
  - CURLOPT_RANGE.3: Caution against using it for HTTP PUT
  - CURLOPT_SEEKDATA.3: fix variable name
  - bindlocal: detect and avoid IP version mismatches in bind()
  - build: fix Codacy warnings
  - c-ares: honor port numbers in CURLOPT_DNS_SERVERS
  - config-os400: add getpeername and getsockname defines
  - configure: --disable-progress-meter
  - configure: fix --disable-code-coverage
  - configure: more --disable switches to toggle off individual features
  - configure: remove CURL_DISABLE_TLS_SRP
  - conn_maxage: move the check to prune_dead_connections()
  - curl: skip CURLOPT_PROXY_CAPATH for disabled-proxy builds
  - docs: Explain behavior change in --tlsv1. options since 7.54
  - docs: Fix links to OpenSSL docs
  - docs: fix string suggesting HTTP/2 is not the default
  - headers: Remove no longer exported functions
  - http2: call done_sending on end of upload
  - http2: don't call stream-close on already closed streams
  - http2: remove CURL_DISABLE_TYPECHECK define
  - http: allow overriding timecond with custom header
  - http: clarify header buffer size calculation
  - krb5: fix compiler warning
  - lib: Use UTF-8 encoding in comments
  - libcurl: Restrict redirect schemes to HTTP, HTTPS, FTP and FTPS
  - multi: enable multiplexing by default (again)
  - multi: fix the transfer hashes in the socket hash entries
  - multi: make sure 'data' can present in several sockhash entries
  - netrc: Return the correct error code when out of memory
  - nss: don't set unused parameter
  - nss: inspect returnvalue of token check
  - nss: only cache valid CRL entries
  - openssl: define HAVE_SSL_GET_SHUTDOWN based on version number
  - openssl: disable engine if OPENSSL_NO_UI_CONSOLE is defined
  - openssl: fix pubkey/signature algorithm detection in certinfo
  - os400: make vsetopt() non-static as Curl_vsetopt() for os400 support
  - quote.d: asterisk prefix works for SFTP as well
  - runtests: keep logfiles around by default
  - runtests: report single test time + total duration
  - test1165: verify that CURL_DISABLE_ symbols are in sync
  - test1521: adapt to SLISTPOINT
  - test1523: test CURLOPT_LOW_SPEED_LIMIT
  - test153: fix content-length to avoid occasional hang
  - test188/189: fix Content-Length
  - tests: have runtests figure out disabled features
  - tests: support non-localhost HOSTIP for dict/smb servers
  - tests: update fixed IP for hostip/clientip split
  - tool_cb_prg: Fix integer overflow in progress bar
  - typecheck: CURLOPT_CONNECT_TO takes an slist too
  - typecheck: add 3 missing strings and a callback data pointer
  - unit1654: cleanup on memory failure
  - unpause: trigger a timeout for event-based transfers
  - url: Fix CURLOPT_MAXAGE_CONN time comparison
- Rebased patch curl-use_OPENSSL_config.patch
- Disable new added failing test1165</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1563537600">- Update to 7.65.3
  * progress: make the progress meter appear again</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684800">- Security fix: [bsc#1149495,CVE-2019-5481]
  * FTP-KRB: double-free during kerberos FTP data transfer
  * Added curl-CVE-2019-5481.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1567684801">- Security fix: [bsc#1149496,CVE-2019-5482]
  * TFTP small blocksize heap buffer overflow
  * Added curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1568203200">- Update to 7.66.0 [bsc#1149496, CVE-2019-5482][bsc#1149495, CVE-2019-5481]
  [bsc#1149604, bsc#1149572, jsc#SLE-9295]
  * Changes:
  - CURLINFO_RETRY_AFTER: parse the Retry-After header value
  - HTTP3: initial (experimental still not working) support
  - curl: --sasl-authzid added to support CURLOPT_SASL_AUTHZID from the tool
  - curl: support parallel transfers with -Z
  - curl_multi_poll: a sister to curl_multi_wait() that waits more
  - sasl: Implement SASL authorisation identity via CURLOPT_SASL_AUTHZID
  * Bugfixes:
  - CVE-2019-5481: FTP-KRB double-free
  - CVE-2019-5482: TFTP small blocksize heap buffer overflow
  - CMake: remove needless newlines at end of gss variables
  - CMake: use platform dependent name for dlopen() library
  - CURLINFO docs: mention that in redirects times are added
  - CURLOPT_ALTSVC.3: use a "" file name to not load from a file
  - CURLOPT_ALTSVC_CTRL.3: remove CURLALTSVC_ALTUSED
  - CURLOPT_HEADERFUNCTION.3: clarify
  - CURLOPT_HTTP_VERSION: seting this to 3 forces HTTP/3 use directly
  - CURLOPT_READFUNCTION.3: provide inline example
  - CURLOPT_SSL_VERIFYHOST: treat the value 1 as 2
  - Curl_addr2string: take an addrlen argument too
  - Curl_fillreadbuffer: avoid double-free trailer buf on error
  - HTTP: use chunked Transfer-Encoding for HTTP_POST if size unknown
  - alt-svc: add protocol version selection masking
  - alt-svc: fix removal of expired cache entry
  - alt-svc: make it use h3-22 with ngtcp2 as well
  - alt-svc: more liberal ALPN name parsing
  - alt-svc: send Alt-Used: in redirected requests
  - alt-svc: with quiche, use the quiche h3 alpn string
  - asyn-thread: create a socketpair to wait on
  - cleanup: move functions out of url.c and make them static
  - cleanup: remove the 'numsocks' argument used in many places
  - configure: avoid undefined check_for_ca_bundle
  - curl.h: add CURL_HTTP_VERSION_3 to the version enum
  - curl: cap the maximum allowed values for retry time arguments
  - curl: handle a libcurl build without netrc support
  - curl: make use of CURLINFO_RETRY_AFTER when retrying
  - curl: use CURLINFO_PROTOCOL to check for HTTP(s)
  - curl_global_init_mem.3: mention it was added in 7.12.0
  - curl_version: bump string buffer size to 250
  - curl_version_info.3: mentioned ALTSVC and HTTP3
  - curl_version_info: offer quic (and h3) library info
  - curl_version_info: provide nghttp2 details
  - defines: avoid underscore-prefixed defines
  - docs/ALTSVC: remove what works and the experimental explanation
  - docs/EXPERIMENTAL: explain what it means and what's experimental now
  - docs/MANUAL.md: converted to markdown from plain text
  - docs/examples/curlx: fix errors
  - docs: s/curl_debug/curl_dbg_debug in comments and docs
  - easy: resize receive buffer on easy handle reset
  - examples: Avoid reserved names in hiperfifo examples
  - examples: add http3.c, altsvc.c and http3-present.c
  - http09: disable HTTP/0.9 by default in both tool and library
  - http2: when marked for closure and wanted to close == OK
  - http2_recv: trigger another read when the last data is returned
  - http: fix use of credentials from URL when using HTTP proxy
  - http_negotiate: improve handling of gss_init_sec_context() failures
  - md4: Use our own MD4 when no crypto libraries are available
  - multi: call detach_connection before Curl_disconnect
  - nss: use TLSv1.3 as default if supported
  - openssl: build warning free with boringssl
  - openssl: use SSL_CTX_set__proto_version() when available
  - plan9: add support for running on Plan 9
  - progress: reset download/uploaded counter between transfers
  - readwrite_data: repair setting the TIMER_STARTTRANSFER stamp
  - scp: fix directory name length used in memcpy
  - smb: init *msg to NULL in smb_send_and_recv()
  - smtp: check for and bail out on too short EHLO response
  - source: remove names from source comments
  - spnego_sspi: add typecast to fix build warning
  - src/makefile: fix uncompressed hugehelp.c generation
  - ssh-libssh: do not specify O_APPEND when not in append mode
  - ssh: move code into vssh for SSH backends
  - sspi: fix memory leaks
  - tests: Replace outdated test case numbering documentation
  - tftp: return error when packet is too small for options
  - timediff: make it 64 bit (if possible) even with 32 bit time_t
  - travis: reduce number of torture tests in 'coverage'
  - url: make use of new HTTP version if alt-svc has one
  - urlapi: verify the IPv6 numerical address
  - urldata: avoid 'generic', use dedicated pointers
  - vauth: Use CURLE_AUTH_ERROR for auth function errors
  * Removed patches:
  - curl-CVE-2018-0500.patch
  - curl-CVE-2018-14618.patch
  - curl-CVE-2018-16839.patch
  - curl-CVE-2018-16840.patch
  - curl-CVE-2018-16842.patch
  - curl-CVE-2018-16890.patch
  - curl-CVE-2019-3822.patch
  - curl-CVE-2019-3823.patch
  - curl-CVE-2019-5436.patch
  - curl-CVE-2019-5481.patch
  - curl-CVE-2019-5482.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1573732800">- Fix segfault in zypper ref: [bsc#1156481]
  * remove_handle: clear expire timers after multi_done()
  * Add patch curl-expire-clear.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395200">- Security fix: [bsc#1173026, CVE-2020-8169]
  * Partial password leak over DNS on HTTP redirect
- Add curl-CVE-2020-8169.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1592395201">- Security fix: [bsc#1173027, CVE-2020-8177]
  * curl can be tricked my a malicious server to overwrite a local
    file when using '-J' ('--remote-header-name') and '-i' ('--head')
    in the same command line.
- Add curl-CVE-2020-8177.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1597320000">- Security fix: [bsc#1175109, CVE-2020-8231]
  * An application that performs multiple requests with libcurl's
    multi API and sets the 'CURLOPT_CONNECT_ONLY' option, might in
    rare circumstances experience that when subsequently using the
    setup connect-only transfer, libcurl will pick and use the wrong
    connection and instead pick another one the application has
    created since then.
- Add curl-CVE-2020-8231.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342400">- Security fix: [bsc#1179398, CVE-2020-8284]
  * Trusting FTP PASV responses: When curl performs a passive FTP
    transfer, it first tries the 'EPSV' command and if that is not
    supported, it falls back to using 'PASV'. A malicious server
    can use the 'PASV' response to trick curl into connecting
    back to a given IP address and port, and this way potentially
    make curl extract information about services that are otherwise
    private and not disclosed.
  * The IP address part of the response is now ignored by default,
    by making 'CURLOPT_FTP_SKIP_PASV_IP' default to '1L'. The same
    goes for the command line tool, which then might need
    '--no-ftp-skip-pasv-ip' set to prevent curl from ignoring the
    address in the server response.
- Add curl-CVE-2020-8284.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342401">- Security fix: [bsc#1179399, CVE-2020-8285]
  * FTP wildcard stack overflow: The wc_statemach() internal
    function has been rewritten to use an ordinary loop instead of
    the recursive approach.
- Add curl-CVE-2020-8285.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1607342402">- Security fix: [bsc#1179593, CVE-2020-8286]
  * Inferior OCSP verification: libcurl offers "OCSP stapling" via
    the 'CURLOPT_SSL_VERIFYSTATUS' option that, when set, verifies
    the OCSP response that a server responds with as part of the TLS
    handshake. It then aborts the TLS negotiation if something is
    wrong with the response. The same feature can be enabled with
    '--cert-status' using the curl tool.
  * As part of the OCSP response verification, a client should verify
    that the response is indeed set out for the correct certificate.
    This step was not performed by libcurl when built or told to use
    OpenSSL as TLS backend.
- Add curl-CVE-2020-8286.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616587200">- Security fix: [bsc#1183933, CVE-2021-22876]
  * The automatic referer leaks credentials
- Add curl-CVE-2021-22876.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1616760000">- Security fix: [bsc#1183934, CVE-2021-22890]
  * When using a HTTPS proxy and TLS 1.3, libcurl can confuse
    session tickets arriving from the HTTPS proxy but work as
    if they arrived from the remote server and then wrongly
    "short-cut" the host handshake.
- Add curl-CVE-2021-22890.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1620907200">- Allow partial chain verification [jsc#SLE-17956]
  * Have intermediate certificates in the trust store be treated
    as trust-anchors, in the same way as self-signed root CA
    certificates are. This allows users to verify servers using
    the intermediate cert only, instead of needing the whole chain.
  * Set FLAG_TRUSTED_FIRST unconditionally.
  * Do not check partial chains with CRL check.
- Add curl-X509_V_FLAG_PARTIAL_CHAIN.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1621252800">- Security fix: [bsc#1186114, CVE-2021-22898]
  * TELNET stack contents disclosure
- Add curl-CVE-2021-22898.patch</changelog>
</package>
<package pkgid="93c82326d3531264e1313afad1e397a8d2c02357770816f6f4c2537b8be99b26" name="dbus-1" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="78c174166beafe5e2415467ac672367902b9c4b42e96f44d83a02eee6a4a7fc8" name="dbus-1" arch="ppc64le">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="7ff191d24812560c3bcf23e0821f6154c39469c7760c5d006e2f05c73d8d761e" name="dbus-1" arch="s390x">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="594e1e11b44121fc0b7630c5016f4d430625e8f2142edce0e06264d1bd713909" name="dbus-1" arch="src">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="bea87556fba52d2a1d9c7c04ebaefde111414665929dc47bec8f24425749958f" name="dbus-1" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="0dead4f7a6339aadc9831d6435bf49e8c9cc941fa0c6f39a9981d324bbcb4bce" name="dbus-1" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="2fb1583ada9796d27445ce2769e22fbeefbe5e870c5c5323e4907bb1a4deed95" name="dbus-1" arch="ppc64le">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="55a7a8d350ef2ee085cccf513b515bedcccd2110a1143ce2577b4c5cf162d79a" name="dbus-1" arch="s390x">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="9fdc2fd582a230d5c197567f00b43a62baa019f8c827935076fb94302b011505" name="dbus-1" arch="src">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="db9f2630ce51946fb7451773e90f9536373c2012481c2aa5154349ace7f8804b" name="dbus-1" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="e87b810b31fc4e4f9e9afa19f01cceaaeaa443994b110cc09a333c04acaea879" name="dbus-1-devel" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="6c8a8fc145fe28a51d2a4b6a6634331fcb2fbb740aea45dbcc6728426cbee2d8" name="dbus-1-devel" arch="ppc64le">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="3eddd71566162d5a7858e8f64ee621f86640062726a036a7f6b27f8d8c47748a" name="dbus-1-devel" arch="s390x">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="9b4fe498115d14cad5096e3e1dcc6d9a075285ee70b6edb54df8c11319107081" name="dbus-1-devel" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="79ac4d47cfe45ebc04e859519939dff2335fad1ccd95a51c52ae37660094baa7" name="dbus-1-devel" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="e0791d7c9030e9e48d6be8f4ffc40656b54c0682005101309f9e1a5174992065" name="dbus-1-devel" arch="ppc64le">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="e2ecdcb8e0457d402a0f82ca8c212cc53f51cb878b07e7e2402cb71f45af2f82" name="dbus-1-devel" arch="s390x">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="92491d5ce4642a8506b3833b49ab7879977a092a77e7623d34ae81e2a598f9fe" name="dbus-1-devel" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="b7593c5f5f3ac80912da339b79ce23efb8534e369b420d64b0428b4a8f060a4a" name="dbus-1-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="a4bbf6c68cbb76918db4dc202e71c62ecfdc05e2c5bdb6c3c05a5bc9850feb00" name="dbus-1-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="b78c810a7da5660ac6505aa0c7cd46eed65e5c80ac3ce4739bc00b3897ecbd73" name="dbus-1-devel-doc" arch="noarch">
  <version epoch="0" ver="1.12.2" rel="8.11.2"/>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="e707fe490efecaa17c3957e9ccecf3af5b8a8efcb0cee1ed6c9fee6effc14fb5" name="dbus-1-devel-doc" arch="noarch">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="sflees@suse.de" date="1511438400">- Fix dbus-daemon-launch-helper to use proper ref to libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="69bc15bfddb1d8604af8ad0f9d2b9dc9c443b373f677f512c63c79e1e8068766" name="dbus-1-x11" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="8.11.1"/>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="9fa1d89ef3fb0782767a47fdfcfe3d984a0a3023e3f49e0a6dd538ec54e1bd76" name="dbus-1-x11" arch="ppc64le">
  <version epoch="0" ver="1.12.2" rel="8.11.1"/>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="b613345b9ffa1218bffa781ec1bb35fde4d8afd470bcb2093213f08379a02e35" name="dbus-1-x11" arch="s390x">
  <version epoch="0" ver="1.12.2" rel="8.11.1"/>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="40056d3bff66d601a861e87670944836bdd7ccb2b43b5562f418bc133d3ed36f" name="dbus-1-x11" arch="src">
  <version epoch="0" ver="1.12.2" rel="8.11.1"/>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="f5eca5b66922dfc0c5bc3994f1ae763cb46132ee37c28ee5205c94423c8bfe73" name="dbus-1-x11" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="8.11.1"/>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
  <changelog author="sflees@suse.de" date="1626091200">- Fix CVE-2020-12049 truncated messages lead to resource exhaustion
  (CVE-2020-12049, bsc#1172505)
  * fix-upstream-CVE-2020-12049.patch
- Rebased fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1626350400">- Add missing patch for CVE-2020-12049
  * fix-upstream-CVE-2020-12049_2.patch</changelog>
</package>
<package pkgid="debae1ae4e9349d0ee577f2ca436b09c4f43bdb4b9e085b989b7c37377bf6798" name="dbus-1-x11" arch="aarch64">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1485345600">- Don't restart dbus on upgrade - Includes temporary work around
  for last version boo#1020301
- Add 0001-Add-RefuseManualStartStop.patch don't allow users to Manually
  start or stop dbus.</changelog>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="cb6f47104fa6d13181267382344ce9a475cf1dafe28a2e72c13902b6de7c1d42" name="dbus-1-x11" arch="ppc64le">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1485345600">- Don't restart dbus on upgrade - Includes temporary work around
  for last version boo#1020301
- Add 0001-Add-RefuseManualStartStop.patch don't allow users to Manually
  start or stop dbus.</changelog>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="dfbe7d575d38bd5b4b69e05cd2f33cb9c4d2081f81b7dd436e08f61cc48c4cf6" name="dbus-1-x11" arch="s390x">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1485345600">- Don't restart dbus on upgrade - Includes temporary work around
  for last version boo#1020301
- Add 0001-Add-RefuseManualStartStop.patch don't allow users to Manually
  start or stop dbus.</changelog>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="d182c68de6df19ae1fb7a8527836033dd57a3d8a15581b79946355dfdca2783b" name="dbus-1-x11" arch="src">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1485345600">- Don't restart dbus on upgrade - Includes temporary work around
  for last version boo#1020301
- Add 0001-Add-RefuseManualStartStop.patch don't allow users to Manually
  start or stop dbus.</changelog>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="c11920a63e9d28ab81485b43f3985cde07a79a45fe0de8db87ac0b34578993fd" name="dbus-1-x11" arch="x86_64">
  <version epoch="0" ver="1.12.2" rel="8.6.1"/>
  <changelog author="sflees@suse.de" date="1485345600">- Don't restart dbus on upgrade - Includes temporary work around
  for last version boo#1020301
- Add 0001-Add-RefuseManualStartStop.patch don't allow users to Manually
  start or stop dbus.</changelog>
  <changelog author="sflees@suse.de" date="1486036800">- A note for scripts bsc#974092 (remove sysvinit script) is already
  fixed here.</changelog>
  <changelog author="sflees@suse.de" date="1488369600">- Update to 1.10.16
  Fixes:
  * Prevent symlink attacks in the nonce-tcp transport on Unix that could
  allow an attacker to overwrite a file named "nonce", in a directory
  that the user running dbus-daemon can write, with a random value
  known only to the user running dbus-daemon. This is unlikely to be
  exploitable in practice, particularly since the nonce-tcp transport
  is really only useful on Windows.
  (fd.o #99828, Simon McVittie) (bsc#1025950)
  * Avoid symlink attacks in the "embedded tests", which are not enabled
  by default and should never be enabled in production builds of dbus.
  (fd.o #99828, Simon McVittie) (bsc#1025951)
  * Work around an undesired effect of the fix for CVE-2014-3637
  (fd.o #80559), in which processes that frequently send fds, such as
  logind during a flood of new PAM sessions, can get disconnected for
  continuously having at least one fd "in flight" for too long;
  dbus-daemon interprets that as a potential denial of service attack.
  The workaround is to disable that check for uid 0 process such as
  logind, with a message in the system log. The bug remains open while
  we look for a more general solution.
  (fd.o #95263, LP#1591411; Simon McVittie)
  * Don't run the test test-dbus-launch-x11.sh if X11 autolaunching
  was disabled at compile time. That test is not expected to work
  in that configuration. (fd.o #98665, Simon McVittie)
  Enhancements:
  * Do the Travis-CI build in Docker containers for Ubuntu LTS, Debian
  stable and Debian testing in addition to the older Ubuntu that is
  the default (fd.o #98889, Simon McVittie)</changelog>
  <changelog author="fstrba@suse.com" date="1491566400">- Update to 1.10.18
  * Fixes
    + Re-order dbus-daemon startup so that on SELinux systems, the
    thread that reads AVC notifications retains the ability to
    write to the audit log (fdo#92832, Debian #857660; Laurent
    Bigonville)
    + Fix a harmless read overflow and some memory leaks in a unit
    test (fdo#100568, Philip Withnall)</changelog>
  <changelog author="sflees@suse.de" date="1497355200">- swap to /usr/bin bsc#1029968
- Add the following fixes from SLE12
  * bsc#980928 increase listen() backlog of AF_UNIX sockets to
    SOMAXCONN fix-upstream-increase-backlog.patch
- The following bugs were already fixed but are missing changelog
  entries
  * bsc#867256 (No longer applicable)
  * bsc#916785 (No longer applicable)
  * bsc#1012564 (Not applicable)
  * fdo#90004 (Fixed Upstream)
- Rename the following patches as a tidy up
  * dbus-log-deny.patch to feature-suse-log-deny.patch
  * dbus-do-autolaunch.patch feature-suse-do-autolaunch.patch
  * 0001-Add-RefuseManualStartStop.patch to
    feature-suse-refuse-manual-start-stop.patch
  * 0001-Drop-Install-sections-from-user-services.patch to
    fix-upstream-drop-install-sections-from-user-services.patch</changelog>
  <changelog author="sflees@suse.de" date="1498824000">- Update to 1.10.20
  * Fixes:
    + Fix a reference leak when blocking on a pending call on a
    connection that has been disconnected (fdo#101481, Shin-ichi
    MORITA)
    + Don't put timestamps in the Doxygen-generated documentation,
    for closer-to-reproducible builds (fdo#100692, Simon
    McVittie)
    + Avoid an assertion failure when connecting to a
    semicolon-separated series of addresses, one of which fails
    (fdo#101257, Simon McVittie)
  * Documentation:
    + Update git URIs in HACKING document to sync up with
    cgit.freedesktop.org (fdo#100715, Simon McVittie)</changelog>
  <changelog author="sflees@suse.de" date="1499428800">- No need to set --libdir anymore now that prefix is /usr/bin,
  * fixes boo#1047532
- No need to set --bindir, bindir in dbus-1-x11 was incorrect
- Other fixes required to properly change prefix
- Don't pass --with-initscripts we don't use them anymore.</changelog>
  <changelog author="sflees@suse.de" date="1503921600">- boo#1027200 don't generate machine-id in %post systemd will do it
  on first boot.
- swap usage of /bin/false to /usr/bin/false
- Use libexecdir=%{_libdir}/dbus-1 rather then /lib/dbus-1</changelog>
  <changelog author="sflees@suse.de" date="1505131200">- boo#1027201 dbus-daemon not found
- boo#978477 systemd reseting under heavy load
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1510833600">- Update to 1.12.2
  Deprecations:
  ? Eavesdropping is officially deprecated in favour of BecomeMonitor.
  See the release notes for spec version 0.31 (in dbus 1.11.14).
  ? [Unix] Flag files in /var/run/console/${username} are deprecated.
  See the release notes for 1.11.18.
  New APIs:
  ? &lt;allow&gt; and &lt;deny&gt; rules in dbus-daemon configuration can now
  include send_broadcast="true", send_broadcast="false",
  max_unix_fds="N", min_unix_fds="N" (for some integer N).
  See the release notes for 1.11.18.
  ? dbus_try_get_local_machine_id() is like
  dbus_get_local_machine_id(), but returns a DBusError.
  ? New APIs around DBusMessageIter to simplify cleanup.
  See the release notes for 1.11.16.
  ? The message bus daemon now implements the standard Introspectable,
  Peer and Properties interfaces. See the release notes for
  dbus 1.11.14 and spec version 0.31.
  ? DTDs for introspection XML and bus configuration are installed.
  ? [Unix] A new unix:dir=? address family resembles unix:tmpdir=? but
  never uses Linux abstract sockets, which is advantageous for
  containers. On non-Linux it is equivalent to unix:tmpdir=?.
  See the release notes for dbus 1.11.14 and spec version 0.31.
  ? [Unix] New option "dbus-launch --exit-with-x11".
  ? [Unix] Session managers can create transient .service files in
  $XDG_RUNTIME_DIR/dbus-1/services. See the release notes for 1.11.12.
  ? [Unix] A sysusers.d snippet can create the messagebus user on-demand.
  Miscellaneous behaviour changes:
  ? [Unix] The session bus now logs to syslog if it was started by
  dbus-launch.
  ? [Unix] Internal warnings are logged to syslog if configured.
  ? [Unix] Exceeding an anti-DoS limit is logged to syslog if configured,
  or to stderr.
- Enabled "make check test suite"
- Patches removed, fixed upstream
  * fix-upstream-drop-install-sections-from-user-services.patch
  * fix-upstream-increase-backlog.patch
  * fix-upstream-timeout-reset-1.patch
  * fix-upstream-timeout-reset-2.patch</changelog>
  <changelog author="sflees@suse.de" date="1511352000">- use %{_libexecdir}/dbus-1 as libexecdir</changelog>
  <changelog author="jengelh@inai.de" date="1512907200">- Do not hide errors during useradd.</changelog>
  <changelog author="sflees@suse.de" date="1512993600">- Swap a missed libdir to libexecdir</changelog>
  <changelog author="dimstar@opensuse.org" date="1520510400">- Don't spit out a warning if /usr/bin/dbus-daemon does not exist
  when we run the pre-script.</changelog>
  <changelog author="eich@suse.com" date="1542715200">- Avoid ugly error message from %pre(install) script when installing
  for the first time.</changelog>
  <changelog author="jengelh@inai.de" date="1545220800">- Avoid bashisms in scriptlets.</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="alarrosa@suse.com" date="1547553600">- Make libdbus-1-3 own the %{_datadir}/dbus-1/system.d directory</changelog>
  <changelog author="sflees@suse.de" date="1560427200">- Fix CVE-2019-12749 Authentication bypass (CVE-2019-12749 bsc#1137832)
  * added fix-CVE-2019-12749.patch</changelog>
  <changelog author="sflees@suse.de" date="1624622400">- Fix CVE-2020-35512 - shared UID's caused issues (CVE-2020-35512 bsc#1187105)
  * fix-upstream-userdb-constpointer.patch
  * fix-upstream-CVE-2020-35512.patch</changelog>
</package>
<package pkgid="970ef3bea8739f2eb2f24cfaad36a1ffadbd37df05d25c08ddd3f99bfc3cd0bd" name="ddclient" arch="noarch">
  <version epoch="0" ver="3.8.3" rel="3.7.1"/>
  <changelog author="chris@computersalat.de" date="1400760000">- update systemd stuff
  * add {?has_systemd} to fix build for Systems using init scripts
- spec cleanup
  * add missing BuildRoot</changelog>
  <changelog author="stefan.fent@suse.com" date="1403092800">- fix pidfile path in /etc/ddclient.conf and set ownership to ddclient
- create user and group ddclient (bnc#881520)
- create /run/ddclient/ with user and group ddclient if not yet
  available in %pre</changelog>
  <changelog author="pth@suse.de" date="1404129600">- Use perl_requires instead of harcoding a value.</changelog>
  <changelog author="chris@computersalat.de" date="1452254400">- fix for boo#903588
- revert patch change
- recover deleted changes (rev34)
- systemd fix
  * conf file must be accessible only by its owner</changelog>
  <changelog author="josef.moellers@suse.com" date="1486123200">- Upgrade to ddclient-3.8.3.
  * added Alpine Linux init scritp - patch send by @Tal on github.
  * adding support for nsupdate - patch send by @droe on github
  * allow log username-password combinations - patch send by @dirdi on github
  * adding support for cloudflare - patch send by @roberthawdon on github
  * adding support for duckdns - patch send by @gkranis</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run in ddclient-tmpfiles.conf
  [ddclient-tmpfiles.conf, bsc#1185069]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619092800">- In the (sample) /etc/ddclient.conf, also replace /var/run with /run.
  [ddclient-replace-varrun-with-run.patch, bsc#1185069]</changelog>
  <changelog author="josef.moellers@suse.com" date="1620820800">- Use %{_tmpfilesdir} instead of abusing %{_libexecdir}.
  Use an extended regular expression in sed to change (/var)?/run.</changelog>
  <changelog author="josef.moellers@suse.com" date="1621339200">- Systemd expects the PID file to exist as soon as the main process
  exists. However, it takes quite a while until the pid file is
  created by the daemon process, so we delay the main process
  for 1 second before exit()ing.
  This gets rid of an annoying warning message in "systemctl
  status".
  [ddclient, ddclient-delay-main-process-for-systemd.patch]</changelog>
</package>
<package pkgid="999baf2d5f1034fd41f04d363397def4623830fa3c4d3a7091a0ca398a4cbf76" name="ddclient" arch="src">
  <version epoch="0" ver="3.8.3" rel="3.7.1"/>
  <changelog author="ro@suse.de" date="1319025600">- remove leftover debug line in init script</changelog>
  <changelog author="chris@computersalat.de" date="1326110400">- update to 3.8.1
  * Fixing #28: FreeDNS.afraid.org changed api slightly
  * Added dtdns-support
  * Added support for longer password
  * Added cisco-asa patch
  * Added support for LoopiaDNS
- rebase patches</changelog>
  <changelog author="binli@opensuse.org" date="1348574400">- Update ddclient-3.8.1-config.patch to check the configuraton file
  from /etc instead of /etc/ddclient (bnc#781699).</changelog>
  <changelog author="chris@computersalat.de" date="1351080000">- rework config patch
  * ddclient.conf: add example for selfhost (http://selfhost.de)</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1368619200">- fix init script: start ddclient with "/usr/bin/perl ddclient",
  otherwise startproc will falsely report that starting failed.</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1368705600">- more init-script fixes:
  - startproc now needs the pidfile parameter (or it woulld look
    for "perl.pid". Sorry, should have run more tests.
  - while I'm at it, get the pidfile from the config file in case
    the user would have changed it</changelog>
  <changelog author="p.drouand@gmail.com" date="1382875200">- Improve systemd support for openSUSE &gt;= 12.3</changelog>
  <changelog author="seife+obs@b1-systems.com" date="1386158400">- fix the breakage from last submission:
  * service file was put into tmpfiles.d
  * tmpfiles config was put into systemd service dir
  * rcddclient link was broken (pointed to "service" file)
- fix rpmlint warnings, also introduced by last submission:
  * service files and tmpdir config are neither config files nor
    should be executable
- package is noarch, mark it as such
- documentation should not have executable bit set</changelog>
  <changelog author="benoit.monin@gmx.fr" date="1388491200">- update to 3.8.2
  * adding support by ChangeIP
  * sha-1 patch  to allow Digest::SHA
  * allow reuse of use
  * preventing deep sleep - see bug #46
  * Fallback to iproute if ifconfig doesn't work
- drop ddclient-3.8.1-update_nic.patch: upstream changed the "use"
  logic
- move all sample-* to examples under the documentation directory
- update source url on sourceforge</changelog>
  <changelog author="jsegitz@novell.com" date="1400587200">- ensure proper handling of .service files with %service_add_pre</changelog>
  <changelog author="chris@computersalat.de" date="1400760000">- update systemd stuff
  * add {?has_systemd} to fix build for Systems using init scripts
- spec cleanup
  * add missing BuildRoot</changelog>
  <changelog author="stefan.fent@suse.com" date="1403092800">- fix pidfile path in /etc/ddclient.conf and set ownership to ddclient
- create user and group ddclient (bnc#881520)
- create /run/ddclient/ with user and group ddclient if not yet
  available in %pre</changelog>
  <changelog author="pth@suse.de" date="1404129600">- Use perl_requires instead of harcoding a value.</changelog>
  <changelog author="chris@computersalat.de" date="1452254400">- fix for boo#903588
- revert patch change
- recover deleted changes (rev34)
- systemd fix
  * conf file must be accessible only by its owner</changelog>
  <changelog author="josef.moellers@suse.com" date="1486123200">- Upgrade to ddclient-3.8.3.
  * added Alpine Linux init scritp - patch send by @Tal on github.
  * adding support for nsupdate - patch send by @droe on github
  * allow log username-password combinations - patch send by @dirdi on github
  * adding support for cloudflare - patch send by @roberthawdon on github
  * adding support for duckdns - patch send by @gkranis</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="josef.moellers@suse.com" date="1619006400">- /var/run is deprecated, replaced by /run in ddclient-tmpfiles.conf
  [ddclient-tmpfiles.conf, bsc#1185069]</changelog>
  <changelog author="josef.moellers@suse.com" date="1619092800">- In the (sample) /etc/ddclient.conf, also replace /var/run with /run.
  [ddclient-replace-varrun-with-run.patch, bsc#1185069]</changelog>
  <changelog author="josef.moellers@suse.com" date="1620820800">- Use %{_tmpfilesdir} instead of abusing %{_libexecdir}.
  Use an extended regular expression in sed to change (/var)?/run.</changelog>
  <changelog author="josef.moellers@suse.com" date="1621339200">- Systemd expects the PID file to exist as soon as the main process
  exists. However, it takes quite a while until the pid file is
  created by the daemon process, so we delay the main process
  for 1 second before exit()ing.
  This gets rid of an annoying warning message in "systemctl
  status".
  [ddclient, ddclient-delay-main-process-for-systemd.patch]</changelog>
</package>
<package pkgid="7567b41545cb7ac4c3c732cf7653c0b598de6a01f25834b8b3a6f5ec032fa9bc" name="deja-dup" arch="aarch64">
  <version epoch="0" ver="40.6" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1498737600">- Fix obvious typo } instead of )</changelog>
  <changelog author="zaitor@opensuse.org" date="1504785600">- Update to version 35.6:
  + Fix a potential memory leak in the monitor daemon and few other
    bugs.
- Changes from version 35.5:
  + Improve on-the-fly dependency installation and fixes a few
    other interaction bugs.
- Changes from version 35.4:
  + Add support for GNOME Online Accounts and cleans up the
    interface a bit.
- Changes from version 35.3:
  + Fix some bugs around unicode filenames and network access.
- Changes from version 35.2:
  + Fix a crash we cause in nautilus with our extension.
- Changes from version 35.1:
  + Fix a header-color bug introduced in the previous release and
    also try to fix a long-standing bug around backup/restore
    buttons being disabled too often.
- Changes from version 35.0:
  + Modernize the code base in a few ways that make the experience
    better in GNOME 3.
- Add meson BuildRequires and switch cmake macros cmake, make and
  cmake_install to meson, meson_build and meson_install following
  upstream switch to Meson build system.
- Drop intltool BuildRequires: No longer needed.
- Add libgpg-error-devel, pkgconfig(appstream-builder) and
  pkgconfig(goa-1.0) BuildRequires: New dependencies.
- Drop deja-dup-vala-0.36.patch: Fixed upstream.
- Drop deja-dup-help2man_stderr.patch: No longer needed after the
  port to meson.
- Drop handling of localized man pages in install section, no
  longer needed.
- Drop suse_update_desktop files macros, no longer needed.
- Drop obsolete post(un) handling of following macros:
  glib2_gsettings_schema_post(un), desktop_database_post(un) and
  icon_theme_cache_post(un).</changelog>
  <changelog author="zaitor@opensuse.org" date="1505304000">- Update to version 36.0:
  + data: Don't depend on bash.
  + BackendRemote:
  - Guard against returning a null GFile if we can't find mount.
  - Handle the user specifying a non-utf8 folder.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1505476800">- Add deja-dup-fix-setting-drive-volume.patch: BackendDrive: Fix
  setting a drive volume (lp#1717230).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1506772800">- Update to version 36.1:
  + Fix backing up to external drives.
  + Updated translations.
- Drop deja-dup-fix-setting-drive-volume.patch: Fixed upstream.</changelog>
  <changelog author="badshah400@gmail.com" date="1508500800">- Update to version 36.2:
  + Fix crash when trying to restore missing files.
  + Fix the UI from freezing for a second when mounting the
    backend location.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1509883200">- Update to version 36.3:
  + Fix the restore dialog sometimes being blank.
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516190400">- Update to version 37.1:
  + Add new Google Drive backend and make it the new default
    backend.
  + Updated translations.
- Update Url to https://wiki.gnome.org/Apps/DejaDup: current Deja
  Dup's GNOME web page.
- Point fdupes to the data directory instead of the build root,
  which is a practice that must be avoided.
- Drop %glib2_gsettings_schema_requires macro: it's no longer
  needed since RPM File Triggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523620800">- Update to version 38.0:
  + Drop ulimit for monitor process, it was causing crashes.
  + Fix autoscrolling in progress window.
  + Exclude snap cache directories by default.
  + Updated translations.
- Add gio-2.0, gio-unix-2.0 and goa-backend-1.0 pkgconfig modules
  and glib2-tools package BuildRequires to avoid implicit
  dependencies.
- Replace pkgconfig(appstream-builder), dbus-1-x11, update-desktop\
  - files and perl-gettext BuildRequires with appstream-glib, dbus-\
  1, desktop-file-utils and gettext-runtime respectively, what
  meson really looks for.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 38.2:
  + Fix not being able to find the backup files when restoring on
    a fresh install.
- Changes from version 38.1:
  + Use a primary menu instead of an AppMenu, per current GNOME
    recommendations.
  + Drop support for the legacy desktop status icon.
  + Updated translations.
- Drop meson version fix via sed in spec, no longer needed.
- Stop exporting optflags and rpath before configure, no longer
  needed.
- Renable meson test, tests are now ok.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1547726400">- Update to version 38.3:
  + Allow restoring from paths with symlinks in more situations
    (including a fix for a backup error when ~/.cache is a
    symlink).
  + Treat operation dialogs more like real dialogs (modal to
    preference window, with correct styling on default buttons).
  + Try harder to stop running duplicity commands when we are
    terminated.
  + Don't hide an error message when also running our bimonthly
    backup verification.
  + If there isn't enough space in the backup location, tell the
    user how much is needed.
  + Exclude flatpak cache directories by default.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549800000">- Add deja-dup-fix-build-vala043.patch: Fix build with new vala
  0.43.x.
- Disable meson_test, currently fails.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551182400">- Update to version 38.4:
  + Update app icon.
  + Don't run monitor when automatic backups are disabled.
  + Drop libpeas dependency.
  + Fix compilation with valac 0.43.
  + Be more forgiving if packagekit is unresponsive.
  + Updated translations.
- Drop deja-dup-fix-build-vala043.patch: Fixed upstream.
- Drop pkgconfig(libpeas-1.0) BuildRequires: No longer needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562328000">- Update to version 40.1:
  + Fix versioning to be correct.
- Changes from version 40.0:
  + Fix tests when run under glib 2.60
  + Updated translations.
- Changes from version 39.1:
  + Fix a bug that could have caused backups to be encrypted with
    two different passwords in some cases. This would result in
    difficulty backing up or restoring by not accepting the
    password you expected it to.
  + Fix a bug that caused duplicate save or exclude folders to
    appear in the preferences.
  + Delete a canary file that duplicity's pydrive puts in your
    Drive.
  + If you don't ask for your password to be saved, we now clear
    out any older saved password.
  + Finally delete the ancient Ubuntu One backend code.
- Changes from version 39.0:
  + Switch away from GNOME Online Accounts to our own cloud keys:
  - It was brought to our attention that we shouldn't be using
    GNOME's keys, as they are intended for GNOME only.
  - Google accounts will have to be re-authenticated with our
    keys.
  - Nextcloud accounts will now appear as webdav network server
    accounts.
  - Adds new pydrive_pkgs option to list the package names needed
    for the pydrive duplicity backend (for now, the system
    package that provides the pydrive python2 package should
    suffice).
  - Adds new google_client_id option if you want to override our
    default account key and use your own. You likely won't want
    to do this.
  - Adds new dependencies on libjson-glib and libsoup.
  - Drops libgoa-backend dependency. The libgoa dependency will
    stay during a transition period from the old keys to the new
    keys.
  + Unmount a remote backup location when we are done with it, if
    we originally mounted it.
- Add pkgconfig(json-glib-1.0) and pkgconfig(libsoup-2.4)
  BuildRequires: New dependencies.
- Drop pkgconfig(goa-backend-1.0) BuildRequires: No longer needed,
  nor used.
- Reenable meson_tests, upstream fixed the issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Add deja-dup-duplicity-Mark-GPGError-extern.patch: Mark GPGError
  as extern and prevent GPG symbols to be public API. Also fixes
  building with new vala.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176000">- Update to 40.6:
  + Fixes a bug that prevented backing up to Google Drive accounts
    with unlimited quotas
  + Fix a bug that prevented backing up to Google Drive in some
    rare situations
  + Fix a bug that prevented the first login to Google Drive
  + Fix a bug that prevented resuming a full backup
  + Fix 2038 date problems by using 64-bit dates internally
  + Fix building against valac 0.45.2 and later
  + Add optional dependency on libgdk-x11-3.0 (only used in flatpak
    builds)
  + Make libgoa-1.0 an optional dependency (still recommended for a
    few years though)
  + Support autostarting via the new Background portal
  + Updated translations.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176001">- Add meson version to spec file
- Drop deja-dup-duplicity-Mark-GPGError-extern.patch: Fixed
  upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="mgorse@suse.com" date="1623758400">- Up duplicity dependency to Requires: deja-dup cannot run without
  it (boo#1187256).</changelog>
</package>
<package pkgid="643a27878a4f6eef7a320ef1b5b0a8eb28b999bb7d96a840b5d53f6df4b26224" name="deja-dup" arch="ppc64le">
  <version epoch="0" ver="40.6" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1498737600">- Fix obvious typo } instead of )</changelog>
  <changelog author="zaitor@opensuse.org" date="1504785600">- Update to version 35.6:
  + Fix a potential memory leak in the monitor daemon and few other
    bugs.
- Changes from version 35.5:
  + Improve on-the-fly dependency installation and fixes a few
    other interaction bugs.
- Changes from version 35.4:
  + Add support for GNOME Online Accounts and cleans up the
    interface a bit.
- Changes from version 35.3:
  + Fix some bugs around unicode filenames and network access.
- Changes from version 35.2:
  + Fix a crash we cause in nautilus with our extension.
- Changes from version 35.1:
  + Fix a header-color bug introduced in the previous release and
    also try to fix a long-standing bug around backup/restore
    buttons being disabled too often.
- Changes from version 35.0:
  + Modernize the code base in a few ways that make the experience
    better in GNOME 3.
- Add meson BuildRequires and switch cmake macros cmake, make and
  cmake_install to meson, meson_build and meson_install following
  upstream switch to Meson build system.
- Drop intltool BuildRequires: No longer needed.
- Add libgpg-error-devel, pkgconfig(appstream-builder) and
  pkgconfig(goa-1.0) BuildRequires: New dependencies.
- Drop deja-dup-vala-0.36.patch: Fixed upstream.
- Drop deja-dup-help2man_stderr.patch: No longer needed after the
  port to meson.
- Drop handling of localized man pages in install section, no
  longer needed.
- Drop suse_update_desktop files macros, no longer needed.
- Drop obsolete post(un) handling of following macros:
  glib2_gsettings_schema_post(un), desktop_database_post(un) and
  icon_theme_cache_post(un).</changelog>
  <changelog author="zaitor@opensuse.org" date="1505304000">- Update to version 36.0:
  + data: Don't depend on bash.
  + BackendRemote:
  - Guard against returning a null GFile if we can't find mount.
  - Handle the user specifying a non-utf8 folder.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1505476800">- Add deja-dup-fix-setting-drive-volume.patch: BackendDrive: Fix
  setting a drive volume (lp#1717230).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1506772800">- Update to version 36.1:
  + Fix backing up to external drives.
  + Updated translations.
- Drop deja-dup-fix-setting-drive-volume.patch: Fixed upstream.</changelog>
  <changelog author="badshah400@gmail.com" date="1508500800">- Update to version 36.2:
  + Fix crash when trying to restore missing files.
  + Fix the UI from freezing for a second when mounting the
    backend location.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1509883200">- Update to version 36.3:
  + Fix the restore dialog sometimes being blank.
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516190400">- Update to version 37.1:
  + Add new Google Drive backend and make it the new default
    backend.
  + Updated translations.
- Update Url to https://wiki.gnome.org/Apps/DejaDup: current Deja
  Dup's GNOME web page.
- Point fdupes to the data directory instead of the build root,
  which is a practice that must be avoided.
- Drop %glib2_gsettings_schema_requires macro: it's no longer
  needed since RPM File Triggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523620800">- Update to version 38.0:
  + Drop ulimit for monitor process, it was causing crashes.
  + Fix autoscrolling in progress window.
  + Exclude snap cache directories by default.
  + Updated translations.
- Add gio-2.0, gio-unix-2.0 and goa-backend-1.0 pkgconfig modules
  and glib2-tools package BuildRequires to avoid implicit
  dependencies.
- Replace pkgconfig(appstream-builder), dbus-1-x11, update-desktop\
  - files and perl-gettext BuildRequires with appstream-glib, dbus-\
  1, desktop-file-utils and gettext-runtime respectively, what
  meson really looks for.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 38.2:
  + Fix not being able to find the backup files when restoring on
    a fresh install.
- Changes from version 38.1:
  + Use a primary menu instead of an AppMenu, per current GNOME
    recommendations.
  + Drop support for the legacy desktop status icon.
  + Updated translations.
- Drop meson version fix via sed in spec, no longer needed.
- Stop exporting optflags and rpath before configure, no longer
  needed.
- Renable meson test, tests are now ok.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1547726400">- Update to version 38.3:
  + Allow restoring from paths with symlinks in more situations
    (including a fix for a backup error when ~/.cache is a
    symlink).
  + Treat operation dialogs more like real dialogs (modal to
    preference window, with correct styling on default buttons).
  + Try harder to stop running duplicity commands when we are
    terminated.
  + Don't hide an error message when also running our bimonthly
    backup verification.
  + If there isn't enough space in the backup location, tell the
    user how much is needed.
  + Exclude flatpak cache directories by default.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549800000">- Add deja-dup-fix-build-vala043.patch: Fix build with new vala
  0.43.x.
- Disable meson_test, currently fails.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551182400">- Update to version 38.4:
  + Update app icon.
  + Don't run monitor when automatic backups are disabled.
  + Drop libpeas dependency.
  + Fix compilation with valac 0.43.
  + Be more forgiving if packagekit is unresponsive.
  + Updated translations.
- Drop deja-dup-fix-build-vala043.patch: Fixed upstream.
- Drop pkgconfig(libpeas-1.0) BuildRequires: No longer needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562328000">- Update to version 40.1:
  + Fix versioning to be correct.
- Changes from version 40.0:
  + Fix tests when run under glib 2.60
  + Updated translations.
- Changes from version 39.1:
  + Fix a bug that could have caused backups to be encrypted with
    two different passwords in some cases. This would result in
    difficulty backing up or restoring by not accepting the
    password you expected it to.
  + Fix a bug that caused duplicate save or exclude folders to
    appear in the preferences.
  + Delete a canary file that duplicity's pydrive puts in your
    Drive.
  + If you don't ask for your password to be saved, we now clear
    out any older saved password.
  + Finally delete the ancient Ubuntu One backend code.
- Changes from version 39.0:
  + Switch away from GNOME Online Accounts to our own cloud keys:
  - It was brought to our attention that we shouldn't be using
    GNOME's keys, as they are intended for GNOME only.
  - Google accounts will have to be re-authenticated with our
    keys.
  - Nextcloud accounts will now appear as webdav network server
    accounts.
  - Adds new pydrive_pkgs option to list the package names needed
    for the pydrive duplicity backend (for now, the system
    package that provides the pydrive python2 package should
    suffice).
  - Adds new google_client_id option if you want to override our
    default account key and use your own. You likely won't want
    to do this.
  - Adds new dependencies on libjson-glib and libsoup.
  - Drops libgoa-backend dependency. The libgoa dependency will
    stay during a transition period from the old keys to the new
    keys.
  + Unmount a remote backup location when we are done with it, if
    we originally mounted it.
- Add pkgconfig(json-glib-1.0) and pkgconfig(libsoup-2.4)
  BuildRequires: New dependencies.
- Drop pkgconfig(goa-backend-1.0) BuildRequires: No longer needed,
  nor used.
- Reenable meson_tests, upstream fixed the issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Add deja-dup-duplicity-Mark-GPGError-extern.patch: Mark GPGError
  as extern and prevent GPG symbols to be public API. Also fixes
  building with new vala.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176000">- Update to 40.6:
  + Fixes a bug that prevented backing up to Google Drive accounts
    with unlimited quotas
  + Fix a bug that prevented backing up to Google Drive in some
    rare situations
  + Fix a bug that prevented the first login to Google Drive
  + Fix a bug that prevented resuming a full backup
  + Fix 2038 date problems by using 64-bit dates internally
  + Fix building against valac 0.45.2 and later
  + Add optional dependency on libgdk-x11-3.0 (only used in flatpak
    builds)
  + Make libgoa-1.0 an optional dependency (still recommended for a
    few years though)
  + Support autostarting via the new Background portal
  + Updated translations.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176001">- Add meson version to spec file
- Drop deja-dup-duplicity-Mark-GPGError-extern.patch: Fixed
  upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="mgorse@suse.com" date="1623758400">- Up duplicity dependency to Requires: deja-dup cannot run without
  it (boo#1187256).</changelog>
</package>
<package pkgid="6f571202600931665d1804f3c245476deed57f5284f2d7a519db6b214d91cbb2" name="deja-dup" arch="s390x">
  <version epoch="0" ver="40.6" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1498737600">- Fix obvious typo } instead of )</changelog>
  <changelog author="zaitor@opensuse.org" date="1504785600">- Update to version 35.6:
  + Fix a potential memory leak in the monitor daemon and few other
    bugs.
- Changes from version 35.5:
  + Improve on-the-fly dependency installation and fixes a few
    other interaction bugs.
- Changes from version 35.4:
  + Add support for GNOME Online Accounts and cleans up the
    interface a bit.
- Changes from version 35.3:
  + Fix some bugs around unicode filenames and network access.
- Changes from version 35.2:
  + Fix a crash we cause in nautilus with our extension.
- Changes from version 35.1:
  + Fix a header-color bug introduced in the previous release and
    also try to fix a long-standing bug around backup/restore
    buttons being disabled too often.
- Changes from version 35.0:
  + Modernize the code base in a few ways that make the experience
    better in GNOME 3.
- Add meson BuildRequires and switch cmake macros cmake, make and
  cmake_install to meson, meson_build and meson_install following
  upstream switch to Meson build system.
- Drop intltool BuildRequires: No longer needed.
- Add libgpg-error-devel, pkgconfig(appstream-builder) and
  pkgconfig(goa-1.0) BuildRequires: New dependencies.
- Drop deja-dup-vala-0.36.patch: Fixed upstream.
- Drop deja-dup-help2man_stderr.patch: No longer needed after the
  port to meson.
- Drop handling of localized man pages in install section, no
  longer needed.
- Drop suse_update_desktop files macros, no longer needed.
- Drop obsolete post(un) handling of following macros:
  glib2_gsettings_schema_post(un), desktop_database_post(un) and
  icon_theme_cache_post(un).</changelog>
  <changelog author="zaitor@opensuse.org" date="1505304000">- Update to version 36.0:
  + data: Don't depend on bash.
  + BackendRemote:
  - Guard against returning a null GFile if we can't find mount.
  - Handle the user specifying a non-utf8 folder.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1505476800">- Add deja-dup-fix-setting-drive-volume.patch: BackendDrive: Fix
  setting a drive volume (lp#1717230).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1506772800">- Update to version 36.1:
  + Fix backing up to external drives.
  + Updated translations.
- Drop deja-dup-fix-setting-drive-volume.patch: Fixed upstream.</changelog>
  <changelog author="badshah400@gmail.com" date="1508500800">- Update to version 36.2:
  + Fix crash when trying to restore missing files.
  + Fix the UI from freezing for a second when mounting the
    backend location.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1509883200">- Update to version 36.3:
  + Fix the restore dialog sometimes being blank.
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516190400">- Update to version 37.1:
  + Add new Google Drive backend and make it the new default
    backend.
  + Updated translations.
- Update Url to https://wiki.gnome.org/Apps/DejaDup: current Deja
  Dup's GNOME web page.
- Point fdupes to the data directory instead of the build root,
  which is a practice that must be avoided.
- Drop %glib2_gsettings_schema_requires macro: it's no longer
  needed since RPM File Triggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523620800">- Update to version 38.0:
  + Drop ulimit for monitor process, it was causing crashes.
  + Fix autoscrolling in progress window.
  + Exclude snap cache directories by default.
  + Updated translations.
- Add gio-2.0, gio-unix-2.0 and goa-backend-1.0 pkgconfig modules
  and glib2-tools package BuildRequires to avoid implicit
  dependencies.
- Replace pkgconfig(appstream-builder), dbus-1-x11, update-desktop\
  - files and perl-gettext BuildRequires with appstream-glib, dbus-\
  1, desktop-file-utils and gettext-runtime respectively, what
  meson really looks for.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 38.2:
  + Fix not being able to find the backup files when restoring on
    a fresh install.
- Changes from version 38.1:
  + Use a primary menu instead of an AppMenu, per current GNOME
    recommendations.
  + Drop support for the legacy desktop status icon.
  + Updated translations.
- Drop meson version fix via sed in spec, no longer needed.
- Stop exporting optflags and rpath before configure, no longer
  needed.
- Renable meson test, tests are now ok.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1547726400">- Update to version 38.3:
  + Allow restoring from paths with symlinks in more situations
    (including a fix for a backup error when ~/.cache is a
    symlink).
  + Treat operation dialogs more like real dialogs (modal to
    preference window, with correct styling on default buttons).
  + Try harder to stop running duplicity commands when we are
    terminated.
  + Don't hide an error message when also running our bimonthly
    backup verification.
  + If there isn't enough space in the backup location, tell the
    user how much is needed.
  + Exclude flatpak cache directories by default.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549800000">- Add deja-dup-fix-build-vala043.patch: Fix build with new vala
  0.43.x.
- Disable meson_test, currently fails.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551182400">- Update to version 38.4:
  + Update app icon.
  + Don't run monitor when automatic backups are disabled.
  + Drop libpeas dependency.
  + Fix compilation with valac 0.43.
  + Be more forgiving if packagekit is unresponsive.
  + Updated translations.
- Drop deja-dup-fix-build-vala043.patch: Fixed upstream.
- Drop pkgconfig(libpeas-1.0) BuildRequires: No longer needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562328000">- Update to version 40.1:
  + Fix versioning to be correct.
- Changes from version 40.0:
  + Fix tests when run under glib 2.60
  + Updated translations.
- Changes from version 39.1:
  + Fix a bug that could have caused backups to be encrypted with
    two different passwords in some cases. This would result in
    difficulty backing up or restoring by not accepting the
    password you expected it to.
  + Fix a bug that caused duplicate save or exclude folders to
    appear in the preferences.
  + Delete a canary file that duplicity's pydrive puts in your
    Drive.
  + If you don't ask for your password to be saved, we now clear
    out any older saved password.
  + Finally delete the ancient Ubuntu One backend code.
- Changes from version 39.0:
  + Switch away from GNOME Online Accounts to our own cloud keys:
  - It was brought to our attention that we shouldn't be using
    GNOME's keys, as they are intended for GNOME only.
  - Google accounts will have to be re-authenticated with our
    keys.
  - Nextcloud accounts will now appear as webdav network server
    accounts.
  - Adds new pydrive_pkgs option to list the package names needed
    for the pydrive duplicity backend (for now, the system
    package that provides the pydrive python2 package should
    suffice).
  - Adds new google_client_id option if you want to override our
    default account key and use your own. You likely won't want
    to do this.
  - Adds new dependencies on libjson-glib and libsoup.
  - Drops libgoa-backend dependency. The libgoa dependency will
    stay during a transition period from the old keys to the new
    keys.
  + Unmount a remote backup location when we are done with it, if
    we originally mounted it.
- Add pkgconfig(json-glib-1.0) and pkgconfig(libsoup-2.4)
  BuildRequires: New dependencies.
- Drop pkgconfig(goa-backend-1.0) BuildRequires: No longer needed,
  nor used.
- Reenable meson_tests, upstream fixed the issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Add deja-dup-duplicity-Mark-GPGError-extern.patch: Mark GPGError
  as extern and prevent GPG symbols to be public API. Also fixes
  building with new vala.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176000">- Update to 40.6:
  + Fixes a bug that prevented backing up to Google Drive accounts
    with unlimited quotas
  + Fix a bug that prevented backing up to Google Drive in some
    rare situations
  + Fix a bug that prevented the first login to Google Drive
  + Fix a bug that prevented resuming a full backup
  + Fix 2038 date problems by using 64-bit dates internally
  + Fix building against valac 0.45.2 and later
  + Add optional dependency on libgdk-x11-3.0 (only used in flatpak
    builds)
  + Make libgoa-1.0 an optional dependency (still recommended for a
    few years though)
  + Support autostarting via the new Background portal
  + Updated translations.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176001">- Add meson version to spec file
- Drop deja-dup-duplicity-Mark-GPGError-extern.patch: Fixed
  upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="mgorse@suse.com" date="1623758400">- Up duplicity dependency to Requires: deja-dup cannot run without
  it (boo#1187256).</changelog>
</package>
<package pkgid="f8c8c2d73d17663438a4870a3c0c14ebcb9c495c7395a0773c3692e9d9d6a780" name="deja-dup" arch="src">
  <version epoch="0" ver="40.6" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1498737600">- Fix obvious typo } instead of )</changelog>
  <changelog author="zaitor@opensuse.org" date="1504785600">- Update to version 35.6:
  + Fix a potential memory leak in the monitor daemon and few other
    bugs.
- Changes from version 35.5:
  + Improve on-the-fly dependency installation and fixes a few
    other interaction bugs.
- Changes from version 35.4:
  + Add support for GNOME Online Accounts and cleans up the
    interface a bit.
- Changes from version 35.3:
  + Fix some bugs around unicode filenames and network access.
- Changes from version 35.2:
  + Fix a crash we cause in nautilus with our extension.
- Changes from version 35.1:
  + Fix a header-color bug introduced in the previous release and
    also try to fix a long-standing bug around backup/restore
    buttons being disabled too often.
- Changes from version 35.0:
  + Modernize the code base in a few ways that make the experience
    better in GNOME 3.
- Add meson BuildRequires and switch cmake macros cmake, make and
  cmake_install to meson, meson_build and meson_install following
  upstream switch to Meson build system.
- Drop intltool BuildRequires: No longer needed.
- Add libgpg-error-devel, pkgconfig(appstream-builder) and
  pkgconfig(goa-1.0) BuildRequires: New dependencies.
- Drop deja-dup-vala-0.36.patch: Fixed upstream.
- Drop deja-dup-help2man_stderr.patch: No longer needed after the
  port to meson.
- Drop handling of localized man pages in install section, no
  longer needed.
- Drop suse_update_desktop files macros, no longer needed.
- Drop obsolete post(un) handling of following macros:
  glib2_gsettings_schema_post(un), desktop_database_post(un) and
  icon_theme_cache_post(un).</changelog>
  <changelog author="zaitor@opensuse.org" date="1505304000">- Update to version 36.0:
  + data: Don't depend on bash.
  + BackendRemote:
  - Guard against returning a null GFile if we can't find mount.
  - Handle the user specifying a non-utf8 folder.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1505476800">- Add deja-dup-fix-setting-drive-volume.patch: BackendDrive: Fix
  setting a drive volume (lp#1717230).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1506772800">- Update to version 36.1:
  + Fix backing up to external drives.
  + Updated translations.
- Drop deja-dup-fix-setting-drive-volume.patch: Fixed upstream.</changelog>
  <changelog author="badshah400@gmail.com" date="1508500800">- Update to version 36.2:
  + Fix crash when trying to restore missing files.
  + Fix the UI from freezing for a second when mounting the
    backend location.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1509883200">- Update to version 36.3:
  + Fix the restore dialog sometimes being blank.
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516190400">- Update to version 37.1:
  + Add new Google Drive backend and make it the new default
    backend.
  + Updated translations.
- Update Url to https://wiki.gnome.org/Apps/DejaDup: current Deja
  Dup's GNOME web page.
- Point fdupes to the data directory instead of the build root,
  which is a practice that must be avoided.
- Drop %glib2_gsettings_schema_requires macro: it's no longer
  needed since RPM File Triggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523620800">- Update to version 38.0:
  + Drop ulimit for monitor process, it was causing crashes.
  + Fix autoscrolling in progress window.
  + Exclude snap cache directories by default.
  + Updated translations.
- Add gio-2.0, gio-unix-2.0 and goa-backend-1.0 pkgconfig modules
  and glib2-tools package BuildRequires to avoid implicit
  dependencies.
- Replace pkgconfig(appstream-builder), dbus-1-x11, update-desktop\
  - files and perl-gettext BuildRequires with appstream-glib, dbus-\
  1, desktop-file-utils and gettext-runtime respectively, what
  meson really looks for.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 38.2:
  + Fix not being able to find the backup files when restoring on
    a fresh install.
- Changes from version 38.1:
  + Use a primary menu instead of an AppMenu, per current GNOME
    recommendations.
  + Drop support for the legacy desktop status icon.
  + Updated translations.
- Drop meson version fix via sed in spec, no longer needed.
- Stop exporting optflags and rpath before configure, no longer
  needed.
- Renable meson test, tests are now ok.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1547726400">- Update to version 38.3:
  + Allow restoring from paths with symlinks in more situations
    (including a fix for a backup error when ~/.cache is a
    symlink).
  + Treat operation dialogs more like real dialogs (modal to
    preference window, with correct styling on default buttons).
  + Try harder to stop running duplicity commands when we are
    terminated.
  + Don't hide an error message when also running our bimonthly
    backup verification.
  + If there isn't enough space in the backup location, tell the
    user how much is needed.
  + Exclude flatpak cache directories by default.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549800000">- Add deja-dup-fix-build-vala043.patch: Fix build with new vala
  0.43.x.
- Disable meson_test, currently fails.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551182400">- Update to version 38.4:
  + Update app icon.
  + Don't run monitor when automatic backups are disabled.
  + Drop libpeas dependency.
  + Fix compilation with valac 0.43.
  + Be more forgiving if packagekit is unresponsive.
  + Updated translations.
- Drop deja-dup-fix-build-vala043.patch: Fixed upstream.
- Drop pkgconfig(libpeas-1.0) BuildRequires: No longer needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562328000">- Update to version 40.1:
  + Fix versioning to be correct.
- Changes from version 40.0:
  + Fix tests when run under glib 2.60
  + Updated translations.
- Changes from version 39.1:
  + Fix a bug that could have caused backups to be encrypted with
    two different passwords in some cases. This would result in
    difficulty backing up or restoring by not accepting the
    password you expected it to.
  + Fix a bug that caused duplicate save or exclude folders to
    appear in the preferences.
  + Delete a canary file that duplicity's pydrive puts in your
    Drive.
  + If you don't ask for your password to be saved, we now clear
    out any older saved password.
  + Finally delete the ancient Ubuntu One backend code.
- Changes from version 39.0:
  + Switch away from GNOME Online Accounts to our own cloud keys:
  - It was brought to our attention that we shouldn't be using
    GNOME's keys, as they are intended for GNOME only.
  - Google accounts will have to be re-authenticated with our
    keys.
  - Nextcloud accounts will now appear as webdav network server
    accounts.
  - Adds new pydrive_pkgs option to list the package names needed
    for the pydrive duplicity backend (for now, the system
    package that provides the pydrive python2 package should
    suffice).
  - Adds new google_client_id option if you want to override our
    default account key and use your own. You likely won't want
    to do this.
  - Adds new dependencies on libjson-glib and libsoup.
  - Drops libgoa-backend dependency. The libgoa dependency will
    stay during a transition period from the old keys to the new
    keys.
  + Unmount a remote backup location when we are done with it, if
    we originally mounted it.
- Add pkgconfig(json-glib-1.0) and pkgconfig(libsoup-2.4)
  BuildRequires: New dependencies.
- Drop pkgconfig(goa-backend-1.0) BuildRequires: No longer needed,
  nor used.
- Reenable meson_tests, upstream fixed the issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Add deja-dup-duplicity-Mark-GPGError-extern.patch: Mark GPGError
  as extern and prevent GPG symbols to be public API. Also fixes
  building with new vala.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176000">- Update to 40.6:
  + Fixes a bug that prevented backing up to Google Drive accounts
    with unlimited quotas
  + Fix a bug that prevented backing up to Google Drive in some
    rare situations
  + Fix a bug that prevented the first login to Google Drive
  + Fix a bug that prevented resuming a full backup
  + Fix 2038 date problems by using 64-bit dates internally
  + Fix building against valac 0.45.2 and later
  + Add optional dependency on libgdk-x11-3.0 (only used in flatpak
    builds)
  + Make libgoa-1.0 an optional dependency (still recommended for a
    few years though)
  + Support autostarting via the new Background portal
  + Updated translations.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176001">- Add meson version to spec file
- Drop deja-dup-duplicity-Mark-GPGError-extern.patch: Fixed
  upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="mgorse@suse.com" date="1623758400">- Up duplicity dependency to Requires: deja-dup cannot run without
  it (boo#1187256).</changelog>
</package>
<package pkgid="981014745866a213d6a610b59f03d8a3f960e0de5df65c0b1827cef5f0205eac" name="deja-dup" arch="x86_64">
  <version epoch="0" ver="40.6" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1498737600">- Fix obvious typo } instead of )</changelog>
  <changelog author="zaitor@opensuse.org" date="1504785600">- Update to version 35.6:
  + Fix a potential memory leak in the monitor daemon and few other
    bugs.
- Changes from version 35.5:
  + Improve on-the-fly dependency installation and fixes a few
    other interaction bugs.
- Changes from version 35.4:
  + Add support for GNOME Online Accounts and cleans up the
    interface a bit.
- Changes from version 35.3:
  + Fix some bugs around unicode filenames and network access.
- Changes from version 35.2:
  + Fix a crash we cause in nautilus with our extension.
- Changes from version 35.1:
  + Fix a header-color bug introduced in the previous release and
    also try to fix a long-standing bug around backup/restore
    buttons being disabled too often.
- Changes from version 35.0:
  + Modernize the code base in a few ways that make the experience
    better in GNOME 3.
- Add meson BuildRequires and switch cmake macros cmake, make and
  cmake_install to meson, meson_build and meson_install following
  upstream switch to Meson build system.
- Drop intltool BuildRequires: No longer needed.
- Add libgpg-error-devel, pkgconfig(appstream-builder) and
  pkgconfig(goa-1.0) BuildRequires: New dependencies.
- Drop deja-dup-vala-0.36.patch: Fixed upstream.
- Drop deja-dup-help2man_stderr.patch: No longer needed after the
  port to meson.
- Drop handling of localized man pages in install section, no
  longer needed.
- Drop suse_update_desktop files macros, no longer needed.
- Drop obsolete post(un) handling of following macros:
  glib2_gsettings_schema_post(un), desktop_database_post(un) and
  icon_theme_cache_post(un).</changelog>
  <changelog author="zaitor@opensuse.org" date="1505304000">- Update to version 36.0:
  + data: Don't depend on bash.
  + BackendRemote:
  - Guard against returning a null GFile if we can't find mount.
  - Handle the user specifying a non-utf8 folder.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1505476800">- Add deja-dup-fix-setting-drive-volume.patch: BackendDrive: Fix
  setting a drive volume (lp#1717230).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1506772800">- Update to version 36.1:
  + Fix backing up to external drives.
  + Updated translations.
- Drop deja-dup-fix-setting-drive-volume.patch: Fixed upstream.</changelog>
  <changelog author="badshah400@gmail.com" date="1508500800">- Update to version 36.2:
  + Fix crash when trying to restore missing files.
  + Fix the UI from freezing for a second when mounting the
    backend location.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1509883200">- Update to version 36.3:
  + Fix the restore dialog sometimes being blank.
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516190400">- Update to version 37.1:
  + Add new Google Drive backend and make it the new default
    backend.
  + Updated translations.
- Update Url to https://wiki.gnome.org/Apps/DejaDup: current Deja
  Dup's GNOME web page.
- Point fdupes to the data directory instead of the build root,
  which is a practice that must be avoided.
- Drop %glib2_gsettings_schema_requires macro: it's no longer
  needed since RPM File Triggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523620800">- Update to version 38.0:
  + Drop ulimit for monitor process, it was causing crashes.
  + Fix autoscrolling in progress window.
  + Exclude snap cache directories by default.
  + Updated translations.
- Add gio-2.0, gio-unix-2.0 and goa-backend-1.0 pkgconfig modules
  and glib2-tools package BuildRequires to avoid implicit
  dependencies.
- Replace pkgconfig(appstream-builder), dbus-1-x11, update-desktop\
  - files and perl-gettext BuildRequires with appstream-glib, dbus-\
  1, desktop-file-utils and gettext-runtime respectively, what
  meson really looks for.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 38.2:
  + Fix not being able to find the backup files when restoring on
    a fresh install.
- Changes from version 38.1:
  + Use a primary menu instead of an AppMenu, per current GNOME
    recommendations.
  + Drop support for the legacy desktop status icon.
  + Updated translations.
- Drop meson version fix via sed in spec, no longer needed.
- Stop exporting optflags and rpath before configure, no longer
  needed.
- Renable meson test, tests are now ok.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1547726400">- Update to version 38.3:
  + Allow restoring from paths with symlinks in more situations
    (including a fix for a backup error when ~/.cache is a
    symlink).
  + Treat operation dialogs more like real dialogs (modal to
    preference window, with correct styling on default buttons).
  + Try harder to stop running duplicity commands when we are
    terminated.
  + Don't hide an error message when also running our bimonthly
    backup verification.
  + If there isn't enough space in the backup location, tell the
    user how much is needed.
  + Exclude flatpak cache directories by default.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549800000">- Add deja-dup-fix-build-vala043.patch: Fix build with new vala
  0.43.x.
- Disable meson_test, currently fails.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551182400">- Update to version 38.4:
  + Update app icon.
  + Don't run monitor when automatic backups are disabled.
  + Drop libpeas dependency.
  + Fix compilation with valac 0.43.
  + Be more forgiving if packagekit is unresponsive.
  + Updated translations.
- Drop deja-dup-fix-build-vala043.patch: Fixed upstream.
- Drop pkgconfig(libpeas-1.0) BuildRequires: No longer needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562328000">- Update to version 40.1:
  + Fix versioning to be correct.
- Changes from version 40.0:
  + Fix tests when run under glib 2.60
  + Updated translations.
- Changes from version 39.1:
  + Fix a bug that could have caused backups to be encrypted with
    two different passwords in some cases. This would result in
    difficulty backing up or restoring by not accepting the
    password you expected it to.
  + Fix a bug that caused duplicate save or exclude folders to
    appear in the preferences.
  + Delete a canary file that duplicity's pydrive puts in your
    Drive.
  + If you don't ask for your password to be saved, we now clear
    out any older saved password.
  + Finally delete the ancient Ubuntu One backend code.
- Changes from version 39.0:
  + Switch away from GNOME Online Accounts to our own cloud keys:
  - It was brought to our attention that we shouldn't be using
    GNOME's keys, as they are intended for GNOME only.
  - Google accounts will have to be re-authenticated with our
    keys.
  - Nextcloud accounts will now appear as webdav network server
    accounts.
  - Adds new pydrive_pkgs option to list the package names needed
    for the pydrive duplicity backend (for now, the system
    package that provides the pydrive python2 package should
    suffice).
  - Adds new google_client_id option if you want to override our
    default account key and use your own. You likely won't want
    to do this.
  - Adds new dependencies on libjson-glib and libsoup.
  - Drops libgoa-backend dependency. The libgoa dependency will
    stay during a transition period from the old keys to the new
    keys.
  + Unmount a remote backup location when we are done with it, if
    we originally mounted it.
- Add pkgconfig(json-glib-1.0) and pkgconfig(libsoup-2.4)
  BuildRequires: New dependencies.
- Drop pkgconfig(goa-backend-1.0) BuildRequires: No longer needed,
  nor used.
- Reenable meson_tests, upstream fixed the issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Add deja-dup-duplicity-Mark-GPGError-extern.patch: Mark GPGError
  as extern and prevent GPG symbols to be public API. Also fixes
  building with new vala.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176000">- Update to 40.6:
  + Fixes a bug that prevented backing up to Google Drive accounts
    with unlimited quotas
  + Fix a bug that prevented backing up to Google Drive in some
    rare situations
  + Fix a bug that prevented the first login to Google Drive
  + Fix a bug that prevented resuming a full backup
  + Fix 2038 date problems by using 64-bit dates internally
  + Fix building against valac 0.45.2 and later
  + Add optional dependency on libgdk-x11-3.0 (only used in flatpak
    builds)
  + Make libgoa-1.0 an optional dependency (still recommended for a
    few years though)
  + Support autostarting via the new Background portal
  + Updated translations.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176001">- Add meson version to spec file
- Drop deja-dup-duplicity-Mark-GPGError-extern.patch: Fixed
  upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="mgorse@suse.com" date="1623758400">- Up duplicity dependency to Requires: deja-dup cannot run without
  it (boo#1187256).</changelog>
</package>
<package pkgid="a407f26934cbcd16f4c1fc8288486dbf77c9b32b5465ca502ee12cfb5e5792b3" name="deja-dup-lang" arch="noarch">
  <version epoch="0" ver="40.6" rel="3.3.1"/>
  <changelog author="tchvatal@suse.com" date="1498737600">- Fix obvious typo } instead of )</changelog>
  <changelog author="zaitor@opensuse.org" date="1504785600">- Update to version 35.6:
  + Fix a potential memory leak in the monitor daemon and few other
    bugs.
- Changes from version 35.5:
  + Improve on-the-fly dependency installation and fixes a few
    other interaction bugs.
- Changes from version 35.4:
  + Add support for GNOME Online Accounts and cleans up the
    interface a bit.
- Changes from version 35.3:
  + Fix some bugs around unicode filenames and network access.
- Changes from version 35.2:
  + Fix a crash we cause in nautilus with our extension.
- Changes from version 35.1:
  + Fix a header-color bug introduced in the previous release and
    also try to fix a long-standing bug around backup/restore
    buttons being disabled too often.
- Changes from version 35.0:
  + Modernize the code base in a few ways that make the experience
    better in GNOME 3.
- Add meson BuildRequires and switch cmake macros cmake, make and
  cmake_install to meson, meson_build and meson_install following
  upstream switch to Meson build system.
- Drop intltool BuildRequires: No longer needed.
- Add libgpg-error-devel, pkgconfig(appstream-builder) and
  pkgconfig(goa-1.0) BuildRequires: New dependencies.
- Drop deja-dup-vala-0.36.patch: Fixed upstream.
- Drop deja-dup-help2man_stderr.patch: No longer needed after the
  port to meson.
- Drop handling of localized man pages in install section, no
  longer needed.
- Drop suse_update_desktop files macros, no longer needed.
- Drop obsolete post(un) handling of following macros:
  glib2_gsettings_schema_post(un), desktop_database_post(un) and
  icon_theme_cache_post(un).</changelog>
  <changelog author="zaitor@opensuse.org" date="1505304000">- Update to version 36.0:
  + data: Don't depend on bash.
  + BackendRemote:
  - Guard against returning a null GFile if we can't find mount.
  - Handle the user specifying a non-utf8 folder.
  + Updated translations.</changelog>
  <changelog author="zaitor@opensuse.org" date="1505476800">- Add deja-dup-fix-setting-drive-volume.patch: BackendDrive: Fix
  setting a drive volume (lp#1717230).</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1506772800">- Update to version 36.1:
  + Fix backing up to external drives.
  + Updated translations.
- Drop deja-dup-fix-setting-drive-volume.patch: Fixed upstream.</changelog>
  <changelog author="badshah400@gmail.com" date="1508500800">- Update to version 36.2:
  + Fix crash when trying to restore missing files.
  + Fix the UI from freezing for a second when mounting the
    backend location.
  + Updated translations.</changelog>
  <changelog author="badshah400@gmail.com" date="1509883200">- Update to version 36.3:
  + Fix the restore dialog sometimes being blank.
  + Updated translations.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1516190400">- Update to version 37.1:
  + Add new Google Drive backend and make it the new default
    backend.
  + Updated translations.
- Update Url to https://wiki.gnome.org/Apps/DejaDup: current Deja
  Dup's GNOME web page.
- Point fdupes to the data directory instead of the build root,
  which is a practice that must be avoided.
- Drop %glib2_gsettings_schema_requires macro: it's no longer
  needed since RPM File Triggers.</changelog>
  <changelog author="dimstar@opensuse.org" date="1519819200">- Modernize spec-file by calling spec-cleaner</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1523620800">- Update to version 38.0:
  + Drop ulimit for monitor process, it was causing crashes.
  + Fix autoscrolling in progress window.
  + Exclude snap cache directories by default.
  + Updated translations.
- Add gio-2.0, gio-unix-2.0 and goa-backend-1.0 pkgconfig modules
  and glib2-tools package BuildRequires to avoid implicit
  dependencies.
- Replace pkgconfig(appstream-builder), dbus-1-x11, update-desktop\
  - files and perl-gettext BuildRequires with appstream-glib, dbus-\
  1, desktop-file-utils and gettext-runtime respectively, what
  meson really looks for.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 38.2:
  + Fix not being able to find the backup files when restoring on
    a fresh install.
- Changes from version 38.1:
  + Use a primary menu instead of an AppMenu, per current GNOME
    recommendations.
  + Drop support for the legacy desktop status icon.
  + Updated translations.
- Drop meson version fix via sed in spec, no longer needed.
- Stop exporting optflags and rpath before configure, no longer
  needed.
- Renable meson test, tests are now ok.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1547726400">- Update to version 38.3:
  + Allow restoring from paths with symlinks in more situations
    (including a fix for a backup error when ~/.cache is a
    symlink).
  + Treat operation dialogs more like real dialogs (modal to
    preference window, with correct styling on default buttons).
  + Try harder to stop running duplicity commands when we are
    terminated.
  + Don't hide an error message when also running our bimonthly
    backup verification.
  + If there isn't enough space in the backup location, tell the
    user how much is needed.
  + Exclude flatpak cache directories by default.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549800000">- Add deja-dup-fix-build-vala043.patch: Fix build with new vala
  0.43.x.
- Disable meson_test, currently fails.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551182400">- Update to version 38.4:
  + Update app icon.
  + Don't run monitor when automatic backups are disabled.
  + Drop libpeas dependency.
  + Fix compilation with valac 0.43.
  + Be more forgiving if packagekit is unresponsive.
  + Updated translations.
- Drop deja-dup-fix-build-vala043.patch: Fixed upstream.
- Drop pkgconfig(libpeas-1.0) BuildRequires: No longer needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562328000">- Update to version 40.1:
  + Fix versioning to be correct.
- Changes from version 40.0:
  + Fix tests when run under glib 2.60
  + Updated translations.
- Changes from version 39.1:
  + Fix a bug that could have caused backups to be encrypted with
    two different passwords in some cases. This would result in
    difficulty backing up or restoring by not accepting the
    password you expected it to.
  + Fix a bug that caused duplicate save or exclude folders to
    appear in the preferences.
  + Delete a canary file that duplicity's pydrive puts in your
    Drive.
  + If you don't ask for your password to be saved, we now clear
    out any older saved password.
  + Finally delete the ancient Ubuntu One backend code.
- Changes from version 39.0:
  + Switch away from GNOME Online Accounts to our own cloud keys:
  - It was brought to our attention that we shouldn't be using
    GNOME's keys, as they are intended for GNOME only.
  - Google accounts will have to be re-authenticated with our
    keys.
  - Nextcloud accounts will now appear as webdav network server
    accounts.
  - Adds new pydrive_pkgs option to list the package names needed
    for the pydrive duplicity backend (for now, the system
    package that provides the pydrive python2 package should
    suffice).
  - Adds new google_client_id option if you want to override our
    default account key and use your own. You likely won't want
    to do this.
  - Adds new dependencies on libjson-glib and libsoup.
  - Drops libgoa-backend dependency. The libgoa dependency will
    stay during a transition period from the old keys to the new
    keys.
  + Unmount a remote backup location when we are done with it, if
    we originally mounted it.
- Add pkgconfig(json-glib-1.0) and pkgconfig(libsoup-2.4)
  BuildRequires: New dependencies.
- Drop pkgconfig(goa-backend-1.0) BuildRequires: No longer needed,
  nor used.
- Reenable meson_tests, upstream fixed the issues.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567425600">- Add deja-dup-duplicity-Mark-GPGError-extern.patch: Mark GPGError
  as extern and prevent GPG symbols to be public API. Also fixes
  building with new vala.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176000">- Update to 40.6:
  + Fixes a bug that prevented backing up to Google Drive accounts
    with unlimited quotas
  + Fix a bug that prevented backing up to Google Drive in some
    rare situations
  + Fix a bug that prevented the first login to Google Drive
  + Fix a bug that prevented resuming a full backup
  + Fix 2038 date problems by using 64-bit dates internally
  + Fix building against valac 0.45.2 and later
  + Add optional dependency on libgdk-x11-3.0 (only used in flatpak
    builds)
  + Make libgoa-1.0 an optional dependency (still recommended for a
    few years though)
  + Support autostarting via the new Background portal
  + Updated translations.</changelog>
  <changelog author="info@paolostivanin.com" date="1579176001">- Add meson version to spec file
- Drop deja-dup-duplicity-Mark-GPGError-extern.patch: Fixed
  upstream.</changelog>
  <changelog author="dimstar@opensuse.org" date="1579953600">- No longer recommend -lang: supplements are in use</changelog>
  <changelog author="mgorse@suse.com" date="1623758400">- Up duplicity dependency to Requires: deja-dup cannot run without
  it (boo#1187256).</changelog>
</package>
<package pkgid="132dd21c7611df3b786ab637eb5d3740f4f3976385ff29304685126d51ed3d94" name="device-mapper" arch="aarch64">
  <version epoch="0" ver="1.02.163" rel="8.33.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport upstream patches for passing lvm2 testsuite (bsc#1158628)
  + bug-1158628_01-tests-replaces-grep-q-usage.patch
  + bug-1158628_02-tests-fix-ra-checking.patch
  + bug-1158628_03-tests-simplify-some-var-settings.patch
  + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_05-activation-add-synchronization-point.patch
  + bug-1158628_06-pvmove-add-missing-synchronization.patch
  + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
  + bug-1158628_08-lv_manip-add-synchronizations.patch
  + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
  + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
  + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
  + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
  + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
  + bug-1158628_14-tests-add-extra-settle.patch
  + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
  - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1575979201">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
</package>
<package pkgid="cbb2f6a909a8ad73b416145910978ad25e1fe59cf22f1ed2c0fccf3c016cbc6a" name="device-mapper" arch="ppc64le">
  <version epoch="0" ver="1.02.163" rel="8.33.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport upstream patches for passing lvm2 testsuite (bsc#1158628)
  + bug-1158628_01-tests-replaces-grep-q-usage.patch
  + bug-1158628_02-tests-fix-ra-checking.patch
  + bug-1158628_03-tests-simplify-some-var-settings.patch
  + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_05-activation-add-synchronization-point.patch
  + bug-1158628_06-pvmove-add-missing-synchronization.patch
  + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
  + bug-1158628_08-lv_manip-add-synchronizations.patch
  + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
  + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
  + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
  + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
  + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
  + bug-1158628_14-tests-add-extra-settle.patch
  + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
  - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1575979201">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
</package>
<package pkgid="f930559faa4a304f73022cf3afc7b45a9c11f01e7ce323dd4907d673b3b71086" name="device-mapper" arch="s390x">
  <version epoch="0" ver="1.02.163" rel="8.33.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport upstream patches for passing lvm2 testsuite (bsc#1158628)
  + bug-1158628_01-tests-replaces-grep-q-usage.patch
  + bug-1158628_02-tests-fix-ra-checking.patch
  + bug-1158628_03-tests-simplify-some-var-settings.patch
  + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_05-activation-add-synchronization-point.patch
  + bug-1158628_06-pvmove-add-missing-synchronization.patch
  + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
  + bug-1158628_08-lv_manip-add-synchronizations.patch
  + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
  + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
  + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
  + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
  + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
  + bug-1158628_14-tests-add-extra-settle.patch
  + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
  - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1575979201">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
</package>
<package pkgid="bdbb39af0e79ee51c0ca058c279e937dd8903366b2cefe4b64732e21cc1d10ab" name="device-mapper" arch="x86_64">
  <version epoch="0" ver="1.02.163" rel="8.33.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport upstream patches for passing lvm2 testsuite (bsc#1158628)
  + bug-1158628_01-tests-replaces-grep-q-usage.patch
  + bug-1158628_02-tests-fix-ra-checking.patch
  + bug-1158628_03-tests-simplify-some-var-settings.patch
  + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_05-activation-add-synchronization-point.patch
  + bug-1158628_06-pvmove-add-missing-synchronization.patch
  + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
  + bug-1158628_08-lv_manip-add-synchronizations.patch
  + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
  + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
  + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
  + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
  + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
  + bug-1158628_14-tests-add-extra-settle.patch
  + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
  - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1575979201">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
</package>
<package pkgid="771236656caea0272135fdcd9a05086e3d392af342da63a66ba2ee41789585fb" name="device-mapper" arch="aarch64">
  <version epoch="0" ver="1.02.163" rel="8.36.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
</package>
<package pkgid="90dbb8881828d32e3a288b71bcb1cd6c595bf74028fbf531f677353af26a6770" name="device-mapper" arch="ppc64le">
  <version epoch="0" ver="1.02.163" rel="8.36.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
</package>
<package pkgid="1f2fdab74c718641fdb5c24d72aeb9fddedfe72aee9a50238297b3bdcd993368" name="device-mapper" arch="s390x">
  <version epoch="0" ver="1.02.163" rel="8.36.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
</package>
<package pkgid="3658f4f8d87e2c9092279269f6563e5675502c242de81f94e7e06765275cef5c" name="device-mapper" arch="x86_64">
  <version epoch="0" ver="1.02.163" rel="8.36.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
</package>
<package pkgid="77c5ecde3ac02a54285c5711887ea1ae3eaac9e995c6c10803a143f391ddc012" name="device-mapper-devel" arch="aarch64">
  <version epoch="0" ver="1.02.163" rel="8.33.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport upstream patches for passing lvm2 testsuite (bsc#1158628)
  + bug-1158628_01-tests-replaces-grep-q-usage.patch
  + bug-1158628_02-tests-fix-ra-checking.patch
  + bug-1158628_03-tests-simplify-some-var-settings.patch
  + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_05-activation-add-synchronization-point.patch
  + bug-1158628_06-pvmove-add-missing-synchronization.patch
  + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
  + bug-1158628_08-lv_manip-add-synchronizations.patch
  + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
  + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
  + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
  + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
  + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
  + bug-1158628_14-tests-add-extra-settle.patch
  + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
  - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1575979201">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
</package>
<package pkgid="57490318225eb5c17c40fcbed8241c6857a3bb8a8b36d006eb3536f8e72d77df" name="device-mapper-devel" arch="ppc64le">
  <version epoch="0" ver="1.02.163" rel="8.33.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport upstream patches for passing lvm2 testsuite (bsc#1158628)
  + bug-1158628_01-tests-replaces-grep-q-usage.patch
  + bug-1158628_02-tests-fix-ra-checking.patch
  + bug-1158628_03-tests-simplify-some-var-settings.patch
  + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_05-activation-add-synchronization-point.patch
  + bug-1158628_06-pvmove-add-missing-synchronization.patch
  + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
  + bug-1158628_08-lv_manip-add-synchronizations.patch
  + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
  + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
  + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
  + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
  + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
  + bug-1158628_14-tests-add-extra-settle.patch
  + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
  - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1575979201">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
</package>
<package pkgid="e87d17d8dfb7ebf28d365acc775e8f8a0ef01c0802e2097e63e975406e370e24" name="device-mapper-devel" arch="s390x">
  <version epoch="0" ver="1.02.163" rel="8.33.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport upstream patches for passing lvm2 testsuite (bsc#1158628)
  + bug-1158628_01-tests-replaces-grep-q-usage.patch
  + bug-1158628_02-tests-fix-ra-checking.patch
  + bug-1158628_03-tests-simplify-some-var-settings.patch
  + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_05-activation-add-synchronization-point.patch
  + bug-1158628_06-pvmove-add-missing-synchronization.patch
  + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
  + bug-1158628_08-lv_manip-add-synchronizations.patch
  + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
  + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
  + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
  + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
  + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
  + bug-1158628_14-tests-add-extra-settle.patch
  + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
  - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1575979201">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
</package>
<package pkgid="ed15924e65bac71855be0a79ecc648a728440201d7cc990b6e216f40abfc84ac" name="device-mapper-devel" arch="x86_64">
  <version epoch="0" ver="1.02.163" rel="8.33.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport upstream patches for passing lvm2 testsuite (bsc#1158628)
  + bug-1158628_01-tests-replaces-grep-q-usage.patch
  + bug-1158628_02-tests-fix-ra-checking.patch
  + bug-1158628_03-tests-simplify-some-var-settings.patch
  + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_05-activation-add-synchronization-point.patch
  + bug-1158628_06-pvmove-add-missing-synchronization.patch
  + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
  + bug-1158628_08-lv_manip-add-synchronizations.patch
  + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
  + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
  + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
  + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
  + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
  + bug-1158628_14-tests-add-extra-settle.patch
  + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
  - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1575979201">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
</package>
<package pkgid="74e31b77bec6c24511a8f9167463b84a1f3f2ce263fd63f31cc86e079ffb494c" name="device-mapper-devel" arch="aarch64">
  <version epoch="0" ver="1.02.163" rel="8.36.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
</package>
<package pkgid="b8cbb90d8027bc58e67cc5cbd03e719a5003756abe1e70266be6f8bafc9e6692" name="device-mapper-devel" arch="ppc64le">
  <version epoch="0" ver="1.02.163" rel="8.36.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
</package>
<package pkgid="ff9bc3be84e0afe70d9084c1e51b3c4a6c4b402fe383ac5834e1c4f616dc2351" name="device-mapper-devel" arch="s390x">
  <version epoch="0" ver="1.02.163" rel="8.36.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
</package>
<package pkgid="b2203261d64d590d5afc5f267ce174f7ff580c30d2279113222a45fc8e76bce9" name="device-mapper-devel" arch="x86_64">
  <version epoch="0" ver="1.02.163" rel="8.36.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
</package>
<package pkgid="2038349f467b8a91ef3d488f96c7bfc60036d3bafb53d3d6f55df16c8644aceb" name="device-mapper-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.02.163" rel="8.33.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport upstream patches for passing lvm2 testsuite (bsc#1158628)
  + bug-1158628_01-tests-replaces-grep-q-usage.patch
  + bug-1158628_02-tests-fix-ra-checking.patch
  + bug-1158628_03-tests-simplify-some-var-settings.patch
  + bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_05-activation-add-synchronization-point.patch
  + bug-1158628_06-pvmove-add-missing-synchronization.patch
  + bug-1158628_07-activation-extend-handling-of-pending_delete.patch
  + bug-1158628_08-lv_manip-add-synchronizations.patch
  + bug-1158628_09-lvconvert-improve-validation-thin-and-cache-pool-con.patch
  + bug-1158628_10-thin-activate-layer-pool-aas-read-only-LV.patch
  + bug-1158628_11-tests-mdadm-stop-in-test-cleanup.patch
  + bug-1158628_12-test-increase-size-of-raid10-LV-allowing-tests-to-su.patch
  + bug-1158628_13-lvconvert-fix-return-value-when-zeroing-fails.patch
  + bug-1158628_14-tests-add-extra-settle.patch
  + bug-1158628_15-test-Fix-handling-leftovers-from-previous-tests.patch
  - bug-1043040_test-fix-read-ahead-issues-in-test-scripts.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1575979201">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
</package>
<package pkgid="e71353b610ddfbc9cda53bb485e7b6d99c16b16c4ad0d80c417f5cb948c0f0a9" name="device-mapper-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.02.163" rel="8.36.1"/>
  <changelog author="heming.zhao@suse.com" date="1575979200">- backport patches for lvm2 to avoid software abnormal work (bsc#1158861)
  + bug-1158861_01-config-remove-filter-typo.patch
  + bug-1158861_02-config-Fix-default-option-which-makes-no-sense.patch
  + bug-1158861_03-vgchange-don-t-fail-monitor-command-if-vg-is-exporte.patch
  + bug-1158861_04-fix-duplicate-pv-size-check.patch
  + bug-1158861_05-hints-fix-copy-of-filter.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch
  + bug-1158861_07-vgck-let-updatemetadata-repair-mismatched-metadata.patch
  + bug-1158861_08-hints-fix-mem-leaking-buffers.patch
  + bug-1158861_09-pvcreate-pvremove-fix-reacquiring-global-lock-after.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1577102400">- LVM Metadata Error: Error writing device at 4096 length 512 (bsc#1150021)
  + bug-1150021_01-scanning-open-devs-rw-when-rescanning-for-write.patch
  + bug-1150021_02-bcache-add-bcache_abort.patch
  + bug-1150021_03-label-Use-bcache_abort_fd-to-ensure-blocks-are-no-lo.patch
  + bug-1150021_04-bcache-add-unit-test.patch
  + bug-1150021_05-bcache-bcache_invalidate_fd-only-remove-prefixes-on.patch
  + bug-1150021_06-fix-dev_unset_last_byte-after-write-error.patch
- Update patch, according to bug-1150021_01-scanning-xxx.patch
  + bug-1158861_06-fix-segfault-for-invalid-characters-in-vg-name.patch</changelog>
  <changelog author="ghe@suse.com" date="1578571200">- Update lvm.conf file (bsc#1159238)
  - enable issue_discards by default</changelog>
  <changelog author="heming.zhao@suse.com" date="1582804800">- vgreduce --removemissing with cache devices will remove lvs (bsc#1157736)
  + bug-1157736-add-suggestion-message-for-mirror-LVs.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1584014400">- fix patch name typo
  - bug-1158628-04-pvmove-correcting-read_ahead-setting.patch
  + bug-1158628_04-pvmove-correcting-read_ahead-setting.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1589371200">- Add missing patch, which mistakenly removed in lvm2 update
  + bug-998893_make_pvscan_service_after_multipathd.patch
- Change lvm2.spec for fixing build error
  + lvm2.spec</changelog>
  <changelog author="heming.zhao@suse.com" date="1590580800">- removing LVM cache with cache volume does not remove the cache volume (bsc#1171907)
  + bug-1171907-lvremove-remove-attached-cachevol-with-removed-LV.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1591963200">- problem with LVM cache (data loss) (bsc#1172566)
  + bug-1172566_cachevol-use-cachepool-code-for-metadata-size.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1598011200">- LVM failing to activate hot spare on surprise removal (bsc#1175110)
  + bug-1175110_dmeventd-avoid-bail-out-preventing-repair-in-raid-pl.patch
- change lvm2.spec source URL
  - lvm2.spec</changelog>
  <changelog author="ghe@suse.com" date="1602504000">- Update lvm2.spec file (bsc#1174336)
  - enable lvmlockd remote refresh using libdlmcontrol
  - update libdlm dependency relationship</changelog>
  <changelog author="heming.zhao@suse.com" date="1605960000">- lvcreate not wiping the lvm signature without prompting with --yes parameter (bsc#1177734)
  + bug-1177734_raid-no-wiping-when-zeroing-raid-metadata-device.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1606305600">- Update lvm2.spec file (bsc#1177533)
  - in %postun, disable restart blk-availability.service &amp; lvm2-monitor.service</changelog>
  <changelog author="heming.zhao@suse.com" date="1609848000">- lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev
- comment out lvm.conf item preferred_names by default (bsc#1179738)
  - comment out preferred_names</changelog>
  <changelog author="heming.zhao@suse.com" date="1611403200">- back port lvmlockd adopt orphan locks feature into sles15sp2 (bsc#1181319)
  + bug-1181319_01-Revert-lvmlockd-use-commonly-used-define-NOTIFYDBUS_.patch
  + bug-1181319_02-lvmlockctl-ensure-result-value-is-always-defined.patch
  + bug-1181319_03-lvmlockctl-use-inline-initilizers.patch
  + bug-1181319_04-lvmlockd-replace-lock-adopt-info-source.patch
  + bug-1181319_05-cov-check-sscanf-result.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1612180800">- revert commit which caused a regression:
  lvm2 should use 'external_device_info_source="udev"' by default (bsc#1179691)
  - change lvm.conf item external_device_info_source from none to udev</changelog>
  <changelog author="ghe@suse.com" date="1618833600">- Add metadata-based autoactivation property for VG and LV (bsc#1178680)
  + bug-1178680_add-metadata-based-autoactivation-property-for-VG-an.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619006400">- LVM cannot be disabled on boot (bsc#1184687)
  + bug-1184687_Add-nolvm-for-kernel-cmdline.patch
- Update patch for avoiding apply warning message
  + bug-1012973_simplify-special-case-for-md-in-69-dm-lvm-metadata.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1619179200">- Honor lvm.conf event_activation=0 on "pvscan --cache -aay" (bsc#1185190)
  + bug-1185190_01-pvscan-support-disabled-event_activation.patch
  + bug-1185190_02-config-improve-description-for-event_activation.patch</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link test as position independent executable (bsc#1184124).
  + bug-1184124-link-tests-as-PIE.patch</changelog>
  <changelog author="heming.zhao@suse.com" date="1632830400">- vgextend crash when extending VG with missing PV (bsc#1191019)
  + bug-1191019_vgextend-check-missing-device-during-block-size-chec.patch</changelog>
</package>
<package pkgid="6467bd668e113d79986313bacf183cd0b705d9b67aa77c0b751d6cb1ac040a6d" name="dhcp" arch="aarch64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="05b1dfe7abbe9192ab96aaf54383ae5e523ac9ab236773310965e1c6d656f8e1" name="dhcp" arch="ppc64le">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="6e0c3c674959c8a3a9813ba13083ae253190f52387598d8caa5fe7b63ea0cf06" name="dhcp" arch="s390x">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="db2b695ee476f89a054d423c280529f80ef5ceb2689638333e8c231f9d137a7a" name="dhcp" arch="src">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="49d66ca18e67a98f0be6745806d50a13509e54adb5e5cd8adb4fab2910945b6d" name="dhcp" arch="x86_64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="af14deea1ea15f209a58f9c2f1671e5fcca704958503317d22897a25945f604a" name="dhcp-client" arch="aarch64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="f0bb2789f162412b2a64ec308adc498adf664cdd53e48e82bbfb43902234d4d9" name="dhcp-client" arch="ppc64le">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="8ed33487ff4f7ec5ccfd63bdd658e81eac730381b0fcc4c8b102a6faed159459" name="dhcp-client" arch="s390x">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="6817af8bbda2c44e6a33cdb46e5277d7d783d339d79620d834dc7c8f12d3885f" name="dhcp-client" arch="x86_64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="808dff9a6968e20234f19ef86a7c06d90b790da942af355dad7b225b6c5c4398" name="dhcp-devel" arch="aarch64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="a61b0c62f67d56cf6ffe86a450c136604467077932bab0e24bf5bdd762ef0c7d" name="dhcp-devel" arch="ppc64le">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="09d974fc4ee5afa15d5cfcb1ba59e8df008e71a929df5f974e3a0665bd66bb50" name="dhcp-devel" arch="s390x">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="4b7ca4a2030399cc07919749baf9e82e9f5c5f522609ed436e517ddd9cae9f5c" name="dhcp-devel" arch="x86_64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="3d9bb03c5169ca7134a8838e6a3996c84a9664f36adc3a303e55f3de0e572de8" name="dhcp-doc" arch="aarch64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="7d5d8b9de9ae2dc524ac8c92e7c87181e8e199ef24cc7fcc88ad6fb97afc8684" name="dhcp-doc" arch="ppc64le">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="4833f4c1324c15c2924add1aa10b813a55fd0fefea7f8363f1899a8a1176cbcf" name="dhcp-doc" arch="s390x">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="3e86df96e61767fd62ccc8604c47409cb3d7d46be0cb795398ec072ef596f7a2" name="dhcp-doc" arch="x86_64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="ddecdfe3a04ed038941a02983de915e8eed839e6f6e7d9a391250ed8ec48b9e4" name="dhcp-relay" arch="aarch64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="063c026d67194e731718bdb1a10dad7426e5831e71e9e30bf582473f9e54a4e7" name="dhcp-relay" arch="ppc64le">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="d39ade0565389fd5e28517c91403c3e5e9c6b6d5ea9e2d781c188abb7e17a4ee" name="dhcp-relay" arch="s390x">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="5526260ef1f5ba352fa3403cc99a467a1cbeddb8c009ffee2a73a8d574c2c540" name="dhcp-relay" arch="x86_64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="f483447dbb41edcbe5ba0a7b684ddf39f56079147d7f0d88701ee5aacf620fae" name="dhcp-server" arch="aarch64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="0ef23b4cb08147743749c889f6a8b38f8a4c081749c8025a3323762221c94216" name="dhcp-server" arch="ppc64le">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="dffdee5af24bbba4d790bb785e746fb87ff0b418cf6424552dff39fec14c3f26" name="dhcp-server" arch="s390x">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="a8b8d5efa523188bcefc3efea964e8bb4aac64dc6cfeedaa39499a37724996ce" name="dhcp-server" arch="x86_64">
  <version epoch="0" ver="4.3.6.P1" rel="6.11.1"/>
  <changelog author="ndas@suse.de" date="1453809600">- Update to dhcp-4.3.3-P1 correcting bounds checking when
  receiving a packet (bsc#961305,CVE-2015-8605,ISC-Bugs#41267).
- adjusted interval check.
  [*0019-dhcp-4.2.4-P1-interval.patch]
- Fixed improper lease duration checking. Also added fixes for integer
  overflows in the date and time handling code(bsc#936923, bsc#880984).
  [+0020-dhcp-4.x.x-fixed-improper-lease-duration-checking.patch]
- fixed service files to start dhcpd after slapd (bsc#956159)
- dhclient-script: complain in the log about conflicts, added
  a see log messages to the dhclient log message (bsc#960506)
  [* 0018-client-fail-on-script-pre-init-error-bsc-912098.patch]</changelog>
  <changelog author="mchandras@suse.de" date="1463659200">- Use /usr/sbin/arping instead of /sbin/arping in the dhcp scripts.
  /sbin/arping is a symlink to /usr/sbin/arping in order to ease the
  transition for the /usr merge. Newest releases of iputils may only
  install utilities in /usr/* so this dependency will no longer be valid.
  Moreover, we replace the '/sbin/arping' dependency with 'iputils'.</changelog>
  <changelog author="ralf.habacker@freenet.de" date="1470312000">- Add config file for registering dhcp server in slp (bsc#992072)</changelog>
  <changelog author="kukuk@suse.de" date="1486728000">- Require insserv only if needed
- Fix requires of client subpackage</changelog>
  <changelog author="ndas@suse.de" date="1489406400">- Relax permission of dhclient-script for libguestfs(bsc#987170)</changelog>
  <changelog author="zaitor@opensuse.org" date="1499083200">- Set all requested dhcp options on a single line, so they are
  actually requested (boo#1046969, boo#1047004).</changelog>
  <changelog author="ndas@suse.de" date="1499342400">- fixed a typo in nis-servers option name breaking the config file introduced
  in previous change to workaround issues in NetworkManager parser.
- Update to dhcp-4.3.5
  - Corrected a bug which could cause the server to sporadically crash while
    loading lease files with the lease-id-format is set to "hex".  Our thanks
    to Jay Ford, University of Iowa for reporting the issue.
    [ISC-Bugs #43185]
  - Eliminated a noisy, but otherwise harmless debug log statment that may
    appear during server startup when building with --enable-binary-leases
    and configuring multiple pools in a shared network.  Thanks to Fernando
    Soto from BlueCat Networks for reporting the issue and supplying a patch.
    [ISC-Bugs #43262]
  - Fixed util/bindvar.sh error handling.
    [ISC-Bugs #41973]
  - Correct error message in relay to use remote id length instead
    of circuit id length.
    [ISC-Bugs #42556]
  - Add logic to test directory Makefiles to avoid copying Attfile(s)
    when building within the source tree.  This eliminates a noisy but
    otherwise harmless error message when running "make check".
    [ISC-Bugs #41883]
  - Leases are now scrubbed of certain prior use information when pool
    re-balancing reassigns them from one FO peer to the other.  This
    corrects an issue where leases that were offered but not used
    by the client retained the client hostname from the original
    client. Thanks to Pavel Polacek, Jan Evangelista Purkyne University
    for reporting the issue.
    [ISC-Bugs #42008]
  - In the LDAP code and schema add some missing '6' characters to use
    the v6 instead of the v4 versions.  Thanks to Denis Taranushin for
    reporting this issue and supplying its patch.
    [ISC-Bugs #42666]
  - Correct how the pick-first-value expression is written to a lease
    file.  Previously it was written as a concat expression due to
    a cut and paste error.
    [ISC-Bugs #42253]
  - Modify the DDNS code to clean up the PTR record even if there
    are issues while cleaning up the A or AAAA records.
    [ISC-Bugs #23954]
  - Added global configuration parameter, abandon-lease-time, which determines
    the amount of time a lease remains abandoned.  The default is 84600 seconds.
    Additionaly, the server now conducts a ping check (if ping checks are
    enabled) prior to offering an abandoned lease to client.  Our thanks to
    David Zych at University of Illinois for reporting the issue and working
    with us to produce a viable solution.
    [ISC-Bugs #41815]
  - Correct handling of interface names during interface discovery. This
    addresses an issue where interface names of 15 characters in length
    could lead to crashes or interface recognition errors during startup
    of dhcpd, dhclient, and dhcrelay.
    [ISC-Bugs #42226]
  - Updates to contrib/dhcp-lease-list.pl to make it more friendly.
    The updates are: looking for the lease file in more places and skipping
    the "processing complete" output when creating machine readable
    output.  Thanks to Cameron Paine (cbp at null dot net) for the
    patch.
    [ISC-Bugs #42113]
  - When reusing a lease for dhcp-cache-threshold return the hostname
    to the original lease.  Also if the host pointer, UID or hardware address
    change don't allow reuse of the lease.
    Thanks to Michael Vincent for reporting this and helping us
    verify the problem and fix.
    [ISC-Bugs #42849]
  - Change dmalloc to use a size_t as the length argument to bring it
    in line with the call it will make to malloc().
    [ISC-Bugs #40843]
  - If the failover socket can't be bound, close it.  Otherwise if the
    user configures an incorrect address in the failover stanza the
    server will continue to open new sockets every 90 seconds until
    it runs out.
    [ISC-Bugs #42452]
  - Add DHCPv4-mode, dhcrelay command line options, "-iu" and "-id", that
    allow interfaces to be upstream or downstream respectively.  Upstream
    interfaces will accept and forward only BOOTP replies, while downstream
    interfaces will accept and forward only BOOTP requests.
    [ISC-Bugs #41547]
  - Clean up some memory references in the vendor-class construct.
    [ISC-Bugs #42984]
    [*0006-dhcp-4.3.2-dhclient-send-hostname-or-fqdn.patch,
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch,
  * 0013-dhcp-4.2.x-dhcpv6-decline-on-DAD-failure.872609.patch,
  * 0016-infiniband-support.patch,
  * 0017-server-no-success-report-before-send.919959.patch]</changelog>
  <changelog author="bwiedemann@suse.com" date="1499947200">- use .gz year instead of current one to make build reproducible</changelog>
  <changelog author="dimstar@opensuse.org" date="1500033600">- Replace net-tools Requires in dhcp-client with hostname on
  suse_version &gt;= 1330 (CODE15): net-tools does no longer provide
  any tool referenced by dhclient-script, but we require hostname
  (which is also a dependency to net-tools, thus hiding the issue).</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="mchandras@suse.de" date="1513166400">- Drop old sysvinit support from the spec file. All the supported
  openSUSE distributions are systemd based so there isn't much point
  in keeping sysvinit support and files around.</changelog>
  <changelog author="obs@botter.cc" date="1515153600">- add PIDFile= setting to dhcrelay.service, without this systemd
  stops the service immediately after starting</changelog>
  <changelog author="ndas@suse.de" date="1516104000">- Plugs a socket descriptor leak in OMAPI(bsc#1076119, CVE-2017-3144)
  [ +0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch]</changelog>
  <changelog author="ndas@suse.de" date="1516363200">- Optimized if and when DNS client context and ports
  are initted (bsc#1073935)
  [+0022-Optimized-if-and-when-DNS-client-context-and-ports.patch]</changelog>
  <changelog author="max@suse.com" date="1520510400">- Update to dhcp-4.3.6-P1:
  * CVE-2018-5733, bsc#1083303: reference count overflow in dhcpd.
  * CVE-2018-5732, bsc#1083302: buffer overflow bug in dhclient.
  * Plugged a socket descriptor leak in OMAPI
  * The server now allows the client identifier (option 61) to own
    leases in more than one subnet concurrently [ISC-Bugs #41358].
  * When replying to a DHCPINFORM, the server will now include
    options specified at the pool scope, provided the ciaddr field
    of the DHCPINFORM is populated.
    [ISC-Bugs #43219] [ISC-Bugs #45051].
  * When memory allocation fails in a repeated way the process
    writes "Run out of memory." on the standard error and exists
    with status 1  [ISC-Bugs #32744].
  * The new lmdb (Lightning Memory DataBase) bind9 configure
    option is now disabled by default to avoid the presence of
    this library to be detected which can lead to a link failure.
    [ISC-Bugs #45069]
  * The linux interface discovery code has been modified to use
    getifaddrs() as is done for BSD and OS-X.
    [ISC-Bugs #28761] and others.
  * Fixed a bug in OMAPI that causes omshell to crash when a
    name-value pair with a zero length value is shipped in an
    object [ISC-Bugs #29108].
  * On 64-bit platforms, dhclient now generates the correct value
    for the script environment variable, "expiry", the lease
    expiry value exceeds 0x7FFFFFFF [ISC-Bugs #43326].
  * Common timer logic was modified to cap the maximum timeout
    values at 0x7FFFFFFF - 1 [ISC-Bugs #28038].
  * DHCP6 FQDN option unpacking code now correctly handles values
    that contain spaces, special, or non-printable characters.
    [ISC-Bugs #43592]
  * When running in -6 mode, dhclient can enforce the require
    option statement and will discard offered leases that do not
    contain all the required options specified in the client
    configuration [ISC-Bugs #41473].
  * Altered DHCPv4 lease time calculation to avoid roll over
    errors on 64-bit OS systems when using -1 or large values
    for default-lease-time [ISC-Bugs #41976],
  * Added --dad-wait-time parameter to dhclient [ISC-Bugs #36169].
  * The server nows checks both the address and length of a
    prefix delegation when attempting to match it to a prefix
    pool [ISC-Bugs #35378].
  * Modified DDNS support initialization such that DNS related
    ports will only be opened by the server (dhcpd) at startup
    if ddns-update-style is not "none"; by dhclient only if and
    when the it first attempts an update; and never by dhcrelay.
    [ISC-Bugs #45290] [ISC-Bugs #33377]
  * Added error logging to two memory allocation failure checks.
    [ISC-Bugs #41185]
  * Corrected a dhclient -6 issue that caused the client to crash
    with an "Impossible condition" error after de-preferencing its
    only IA binding [ISC-Bugs #44373].
  * By defining CALL_SCRIPT_ON_ONETRY_FAIL in includes/site.h,
    dhclient will now call the script with reason set to FAIL when
    run with -1 (one try) and there are no server responses.
    [ISC-bugs #18183]
  * The server now detects failover peers that are not referenced
    in at least one pool when run with the command line option for
    test mode, -T [ISC-Bugs #29892].
  * Linux script updated [ISC-bugs #19430] [ISC-bugs #18111].
  * Changed severity of the log message indicating UDP checksum
    errors in the received packets from 'info' to 'debug'.
    [ISC-bugs #41757]
  * Corrected a bug which could cause the server to sporadically
    crash while loading lease files with the lease-id-format is
    set to "hex" [ISC-Bugs #43185].
- Obsoleted patches:
  * 0011-Fixed-linux-interface-discovery-using-getifaddrs.patch
  * 0019-dhcp-4.2.4-P1-interval.patch
  * 0021-master-Plugs-a-socket-descriptor-leak-in-OMAPI.patch
  * 0022-Optimized-if-and-when-DNS-client-context-and-ports.patch</changelog>
  <changelog author="max@suse.com" date="1562587200">- bsc#1136572: Use IPv6 when called as dhclient6, dhcpd6, and
  dhcrelay6 (0021-dhcp-ip-family-symlinks.patch).</changelog>
  <changelog author="max@suse.com" date="1564660800">- bsc#1134078, CVE-2019-6470, dhcp-CVE-2019-6470.patch:
  DHCPv6 server crashes regularly.
- Add compile option --enable-secs-byteorder to avoid duplicate
  lease warnings [bsc#1089524].</changelog>
  <changelog author="max@suse.com" date="1619092800">- bsc#1185157:
  Use /run instead of /var/run for PIDFile in dhcrelay.service.</changelog>
  <changelog author="max@suse.com" date="1622030400">- CVE-2021-25217, bsc#1186382, dhcp-CVE-2021-25217.patch: A buffer
  overrun in lease file parsing code can be used to exploit a
  common vulnerability shared by dhcpd and dhclient.</changelog>
  <changelog author="max@suse.com" date="1622116800">- Oops, when upgrading to 4.3.6-P1 in 2018 only isc_version was
  bumped, but not the RPM package version.</changelog>
</package>
<package pkgid="c8fa5d142405456bf5a4fa2591c01cb4e7253e1e76fa1bc2658fd50df47010cb" name="djvulibre" arch="aarch64">
  <version epoch="0" ver="3.5.27" rel="11.11.1"/>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625140800">- security update
- added patches
  fix CVE-2021-3630 [bsc#1187869], out-of-bounds write in DJVU:DjVuTXT:decode() in DjVuText.cpp
  + djvulibre-CVE-2021-3630.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627646400">- security update
  extend CVE-2021-3630 fix [bsc#1187869#c14]
- modified patches
  % djvulibre-CVE-2021-3630.patch</changelog>
</package>
<package pkgid="b640dfa01a2bfd52f739955b635409e89f1a26d3bace6292cac79b67234b06c2" name="djvulibre" arch="ppc64le">
  <version epoch="0" ver="3.5.27" rel="11.11.1"/>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625140800">- security update
- added patches
  fix CVE-2021-3630 [bsc#1187869], out-of-bounds write in DJVU:DjVuTXT:decode() in DjVuText.cpp
  + djvulibre-CVE-2021-3630.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627646400">- security update
  extend CVE-2021-3630 fix [bsc#1187869#c14]
- modified patches
  % djvulibre-CVE-2021-3630.patch</changelog>
</package>
<package pkgid="f9198be309fe2a00fa302743267c83ea1c9ec61bc274eee3b28a87d27d531653" name="djvulibre" arch="s390x">
  <version epoch="0" ver="3.5.27" rel="11.11.1"/>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625140800">- security update
- added patches
  fix CVE-2021-3630 [bsc#1187869], out-of-bounds write in DJVU:DjVuTXT:decode() in DjVuText.cpp
  + djvulibre-CVE-2021-3630.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627646400">- security update
  extend CVE-2021-3630 fix [bsc#1187869#c14]
- modified patches
  % djvulibre-CVE-2021-3630.patch</changelog>
</package>
<package pkgid="90b90e38a2f43bf836488d6cb95651d5064d55cf34dba3c3e412abb91fe5e223" name="djvulibre" arch="src">
  <version epoch="0" ver="3.5.27" rel="11.11.1"/>
  <changelog author="pgajdos@suse.cz" date="1299499200">- updated to version 3.5.24:
  * Set ddjvuapi_version to 20.
  * Added ddjvuapi support for changing the white point.
  * Added option "-u" in djvused.
  * Added option "-o djvufile" in djvuxmlparser.
  * Added support for &lt;CHARACTER&gt; tag in djvuxmlparser.
  * Added print-xmp, set-xmp, remove-smp in djvused.</changelog>
  <changelog author="idoenmez@novell.com" date="1304337600">- Add djvulibre-3.5.23-gcc46.patch to fix compilation with gcc 4.6</changelog>
  <changelog author="pgajdos@novell.com" date="1307620800">- Fix MMX code when using gcc-4.6 [bnc#696824]
  * adjusted gcc46.patch</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="pgajdos@suse.com" date="1331640000">- fix build for factory (define $QTDIR)</changelog>
  <changelog author="dimstar@opensuse.org" date="1331812800">- Add djvulibre-gcc47.patch: Fix build with gcc 4.7.</changelog>
  <changelog author="pgajdos@suse.com" date="1331899200">- updated to 3.5.25:
  * Removed the deprecated djview3 code.
  * Removed the deprecated cothreads code.
  * Removed the unmaintained japanese man pages.
  * Added ddjvu option to skip corrupted pages.
  * Miniexp API is now reentrant.
  * Bug fixes all around.</changelog>
  <changelog author="dimstar@opensuse.org" date="1332676800">- Add pkg-config BuildRequires.</changelog>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625140800">- security update
- added patches
  fix CVE-2021-3630 [bsc#1187869], out-of-bounds write in DJVU:DjVuTXT:decode() in DjVuText.cpp
  + djvulibre-CVE-2021-3630.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627646400">- security update
  extend CVE-2021-3630 fix [bsc#1187869#c14]
- modified patches
  % djvulibre-CVE-2021-3630.patch</changelog>
</package>
<package pkgid="f0407ecc8d7965175fc1d9e04c51da3b0b985e3c24ca036b41debb9aff23bb7e" name="djvulibre" arch="x86_64">
  <version epoch="0" ver="3.5.27" rel="11.11.1"/>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625140800">- security update
- added patches
  fix CVE-2021-3630 [bsc#1187869], out-of-bounds write in DJVU:DjVuTXT:decode() in DjVuText.cpp
  + djvulibre-CVE-2021-3630.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627646400">- security update
  extend CVE-2021-3630 fix [bsc#1187869#c14]
- modified patches
  % djvulibre-CVE-2021-3630.patch</changelog>
</package>
<package pkgid="e882616e9c71030734d5298b0436cb9b95e738b0c6532441b50a35079180cf0b" name="djvulibre" arch="aarch64">
  <version epoch="0" ver="3.5.27" rel="11.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1332676800">- Add pkg-config BuildRequires.</changelog>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
</package>
<package pkgid="2863f1f8f70afaaa2d2dc2bb32c4448b10bf633a02e7b55d2db8219d8e3cde07" name="djvulibre" arch="ppc64le">
  <version epoch="0" ver="3.5.27" rel="11.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1332676800">- Add pkg-config BuildRequires.</changelog>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
</package>
<package pkgid="6b7fc49e0894237faf0a131d5aa94e74c8a1de72dd879a16959ee871ad6a68a5" name="djvulibre" arch="s390x">
  <version epoch="0" ver="3.5.27" rel="11.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1332676800">- Add pkg-config BuildRequires.</changelog>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
</package>
<package pkgid="a1f962c079761fe744e05a4bbf38cabbfb9aa14c048deca83b4b3e2d9084325a" name="djvulibre" arch="src">
  <version epoch="0" ver="3.5.27" rel="11.3.1"/>
  <changelog author="lmichnovic@suse.cz" date="1219665600">- update to version 3.5.21
  * Speed improvement on multicore platforms
  * Ddjvu now can produce pdf output.
- renamed lib to libdjvulibre21 according to Shared Library
  Packaging Policy</changelog>
  <changelog author="mseben@suse.cz" date="1244462400">- updated to version 3.5.22
  * backported djview4 version of nsdejavu.so
  * various bug fixes
- splitted to doc package</changelog>
  <changelog author="pgajdos@suse.cz" date="1289908800">- updated to version 3.5.23:
  * Added ddjvu_document_create_by_filename_utf8
  * Generate icons with rsvg rather than imagemagick.
  * djvused: correctly outputs escape characters.
  * djvumake: added options to generate foreground colors.
  * Various bug fixes.</changelog>
  <changelog author="pgajdos@suse.cz" date="1299499200">- updated to version 3.5.24:
  * Set ddjvuapi_version to 20.
  * Added ddjvuapi support for changing the white point.
  * Added option "-u" in djvused.
  * Added option "-o djvufile" in djvuxmlparser.
  * Added support for &lt;CHARACTER&gt; tag in djvuxmlparser.
  * Added print-xmp, set-xmp, remove-smp in djvused.</changelog>
  <changelog author="idoenmez@novell.com" date="1304337600">- Add djvulibre-3.5.23-gcc46.patch to fix compilation with gcc 4.6</changelog>
  <changelog author="pgajdos@novell.com" date="1307620800">- Fix MMX code when using gcc-4.6 [bnc#696824]
  * adjusted gcc46.patch</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="pgajdos@suse.com" date="1331640000">- fix build for factory (define $QTDIR)</changelog>
  <changelog author="dimstar@opensuse.org" date="1331812800">- Add djvulibre-gcc47.patch: Fix build with gcc 4.7.</changelog>
  <changelog author="pgajdos@suse.com" date="1331899200">- updated to 3.5.25:
  * Removed the deprecated djview3 code.
  * Removed the deprecated cothreads code.
  * Removed the unmaintained japanese man pages.
  * Added ddjvu option to skip corrupted pages.
  * Miniexp API is now reentrant.
  * Bug fixes all around.</changelog>
  <changelog author="dimstar@opensuse.org" date="1332676800">- Add pkg-config BuildRequires.</changelog>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
</package>
<package pkgid="dc0e673d7575e1d682fce9b2ed3790fe83f839bb9e8c39345a1d3a1417aab596" name="djvulibre" arch="x86_64">
  <version epoch="0" ver="3.5.27" rel="11.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1332676800">- Add pkg-config BuildRequires.</changelog>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
</package>
<package pkgid="d860ba612ea1548371a696f16ba229f4c35ca457507a1649d38d68b678aad46a" name="djvulibre" arch="aarch64">
  <version epoch="0" ver="3.5.27" rel="11.6.1"/>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
</package>
<package pkgid="c23eea4c774857fd5f43c6a2a73c63867d080e290db549a0dcb5df3ffe5086d5" name="djvulibre" arch="ppc64le">
  <version epoch="0" ver="3.5.27" rel="11.6.1"/>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
</package>
<package pkgid="c95157aa1468304d122b8f0b1739e2a7a79abd1be9a6c7368459b65cb770869a" name="djvulibre" arch="s390x">
  <version epoch="0" ver="3.5.27" rel="11.6.1"/>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
</package>
<package pkgid="7e204f7443837554ad8c8e6f89c6614edfe53e9a4e6321d231a01c3bb0317cb6" name="djvulibre" arch="src">
  <version epoch="0" ver="3.5.27" rel="11.6.1"/>
  <changelog author="mseben@suse.cz" date="1244462400">- updated to version 3.5.22
  * backported djview4 version of nsdejavu.so
  * various bug fixes
- splitted to doc package</changelog>
  <changelog author="pgajdos@suse.cz" date="1289908800">- updated to version 3.5.23:
  * Added ddjvu_document_create_by_filename_utf8
  * Generate icons with rsvg rather than imagemagick.
  * djvused: correctly outputs escape characters.
  * djvumake: added options to generate foreground colors.
  * Various bug fixes.</changelog>
  <changelog author="pgajdos@suse.cz" date="1299499200">- updated to version 3.5.24:
  * Set ddjvuapi_version to 20.
  * Added ddjvuapi support for changing the white point.
  * Added option "-u" in djvused.
  * Added option "-o djvufile" in djvuxmlparser.
  * Added support for &lt;CHARACTER&gt; tag in djvuxmlparser.
  * Added print-xmp, set-xmp, remove-smp in djvused.</changelog>
  <changelog author="idoenmez@novell.com" date="1304337600">- Add djvulibre-3.5.23-gcc46.patch to fix compilation with gcc 4.6</changelog>
  <changelog author="pgajdos@novell.com" date="1307620800">- Fix MMX code when using gcc-4.6 [bnc#696824]
  * adjusted gcc46.patch</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="pgajdos@suse.com" date="1331640000">- fix build for factory (define $QTDIR)</changelog>
  <changelog author="dimstar@opensuse.org" date="1331812800">- Add djvulibre-gcc47.patch: Fix build with gcc 4.7.</changelog>
  <changelog author="pgajdos@suse.com" date="1331899200">- updated to 3.5.25:
  * Removed the deprecated djview3 code.
  * Removed the deprecated cothreads code.
  * Removed the unmaintained japanese man pages.
  * Added ddjvu option to skip corrupted pages.
  * Miniexp API is now reentrant.
  * Bug fixes all around.</changelog>
  <changelog author="dimstar@opensuse.org" date="1332676800">- Add pkg-config BuildRequires.</changelog>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
</package>
<package pkgid="3b17a510ccd548e072f4c109aaa1a4d9f0ef4bc3a7cddccde5a014d0cc6ee876" name="djvulibre" arch="x86_64">
  <version epoch="0" ver="3.5.27" rel="11.6.1"/>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
</package>
<package pkgid="95ad5151963e265828ef0010a356978888d37355c1b357ecf03420e0f46f68f1" name="djvulibre-doc" arch="noarch">
  <version epoch="0" ver="3.5.27" rel="11.11.1"/>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1625140800">- security update
- added patches
  fix CVE-2021-3630 [bsc#1187869], out-of-bounds write in DJVU:DjVuTXT:decode() in DjVuText.cpp
  + djvulibre-CVE-2021-3630.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1627646400">- security update
  extend CVE-2021-3630 fix [bsc#1187869#c14]
- modified patches
  % djvulibre-CVE-2021-3630.patch</changelog>
</package>
<package pkgid="4e4f615600a9756de5c32aa2b78cdd794a939611e850c0ed70f28b877cab32ec" name="djvulibre-doc" arch="noarch">
  <version epoch="0" ver="3.5.27" rel="11.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1332676800">- Add pkg-config BuildRequires.</changelog>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
</package>
<package pkgid="8b3753720563f609cf595474ff3785b3072602a022ab4da3ad7f438afabfdc85" name="djvulibre-doc" arch="noarch">
  <version epoch="0" ver="3.5.27" rel="11.6.1"/>
  <changelog author="pgajdos@suse.com" date="1364385600">- updated to 3.5.25.3:
  * minor fixes
  * call autoreconf
  * do not cp not existing prebuilt icons
  * not-existing-icons.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1425038400">- Remove obsolete patches
  * djvulibre-filepath.patch
  * djvulibre-not-existing-icons.patch
- Update to 3.5.27
  * simplified configuration scripts
  * deadlock fixes
  * miniexp under win32 uses tlsalloc instead of _thread vars (pb under xp)
- New in 3.5.26
  * Thread safe miniexp
  * Now using the standard autotools approach (thanks to Vincent Torri).
  * New windows installer (thanks to Konstantin Kravtsov).
  * Fixed Russian code page issues in windows.
  * General speedup thanks to lock-free smart pointers.
  * ddjvu can produce one file per page.
  * djvused can now set the default page orientation.
  * Bug fixes all around.</changelog>
  <changelog author="bwiedemann@suse.com" date="1494849600">- Add reproducible.patch to make build fully reproducible</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1546948800">- Remove rsvg-convert BuildRequires, just use the prebuilt pngs
  from the source package.</changelog>
  <changelog author="pgajdos@suse.com" date="1567425600">- security update
- added patches
  CVE-2019-15142 [bsc#1146702]
  + djvulibre-CVE-2019-15142.patch
  CVE-2019-15143 [bsc#1146569]
  + djvulibre-CVE-2019-15143.patch
  CVE-2019-15144 [bsc#1146571]
  + djvulibre-CVE-2019-15144.patch
  CVE-2019-15145 [bsc#1146572]
  + djvulibre-CVE-2019-15145.patch
  do not segfault when libtiff encounters corrupted TIFF (upstream issue #295)
  + djvulibre-invalid-tiff.patch</changelog>
  <changelog author="jengelh@inai.de" date="1567512000">- Trim conjecture, bias, and metadata repetitions from description.
- Trim descriptions in subpackages for length. (Main package keeps
  the bigger one.)
- Use some more macros and limit fdupes to the /usr volume.</changelog>
  <changelog author="pgajdos@suse.com" date="1571400000">- do not segfault when mmx enabled [bsc#1154401]
- added patches
  https://sourceforge.net/p/djvu/bugs/293/
  + djvulibre-always-assume-that-cpuid-works-on-x86_64.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1573214400">- security update
- added patches
  CVE-2019-18804 [bsc#1156188]
  + djvulibre-CVE-2019-18804.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1620820800">- security update
- added patches
  fix CVE-2021-32490 [bsc#1185895], Out of bounds write in function DJVU:filter_bv() via crafted djvu file
  + djvulibre-CVE-2021-32490.patch
  fix CVE-2021-32491 [bsc#1185900], Integer overflow in function render() in tools/ddjvu via crafted djvu file
  + djvulibre-CVE-2021-32491.patch
  fix CVE-2021-32492 [bsc#1185904], Out of bounds read in function DJVU:DataPool:has_data() via crafted djvu file
  + djvulibre-CVE-2021-32492.patch
  fix CVE-2021-32493 [bsc#1185905], Heap buffer overflow in function DJVU:GBitmap:decode() via crafted djvu file
  + djvulibre-CVE-2021-32493.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1621857600">- security update
- added patches
  fix CVE-2021-3500 [bsc#1186253], Stack overflow in function DJVU:DjVuDocument:get_djvu_file() via crafted djvu file
  + djvulibre-CVE-2021-3500.patch</changelog>
</package>
<package pkgid="13c08f554fe481bbba941327368463d95da153f5af693d51ea0ca961507f09ff" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="47f4b23dddb4247f89427fb4bbf17a92f3176b2c3d4ed35284d35edd7ccfed98" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="44b6096ea18ab5a796299008e5fd94a8ce65b497469e1cccf44d37ec0f4f0ea8" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="2ed7a9474ee443456e43bde9dbfb0f94b6575618484deb5e11e259969beb7ff4" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="ac25e0caf9130d5c9c8666aa9366ebfd1aebbddfcc041cd6e9102594e2708427" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="55e4c23b1b680767d5762c1b069f67b9a199a3391b501a0633335999f161de6c" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="5cb856003b2890e9d8a4819f9e51d074de2cac06479dc485f800a29a2ab2d3b9" name="dlm-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="c6210c25aa818c5e5a7c822b7ea362c7dadf1b8f64500148b74bad2b32e5df88" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.11.1"/>
  <changelog author="lduncan@suse.com" date="1625140800">- Blacklisted SCSI ufs core patch: way out of context.
- commit 33b89f4</changelog>
  <changelog author="glin@suse.com" date="1625140801">- bpfilter: Specify the log level for the kmsg message
  (bsc#1155518).
- commit a6b5aff</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140802">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch
  patches.suse/xfrm-policy-Read-seqcount-outside-of-rcu-read-side-i.patch
- commit fc2830a</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140803">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140804">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140805">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140806">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140807">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140808">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="bp@suse.de" date="1625140809">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="ohering@suse.de" date="1625227201">- x86/vdso: Mark the TSC clocksource path likely (bsc#1186071).
- hv_sock: Add the support of hibernation (bsc#1186071).
- hv_sock: set VMADDR_CID_HOST in the hvs_remote_addr_init()
  (bsc#1186071).
- hv_sock: use HV_HYP_PAGE_SIZE for Hyper-V communication
  (bsc#1186071).
- hv_sock: Use consistent types for UUIDs (bsc#1186071).
- commit e34e685</changelog>
  <changelog author="ohering@suse.de" date="1625227202">- x86/vdso: Move VDSO clocksource state tracking to callback (bsc#1186071).
- commit fc5b544</changelog>
  <changelog author="ohering@suse.de" date="1625227203">- hv_netvsc: Validate number of allocated sub-channels
  (bsc#1183682).
- drivers: hv: vmbus: Fix call msleep using &lt; 20ms (bsc#1186071).
- drivers: hv: vmbus: Fix checkpatch LINE_SPACING (bsc#1186071).
- drivers: hv: vmbus: Replace symbolic permissions by octal
  permissions (bsc#1186071).
- drivers: hv: Fix hyperv_record_panic_msg path on comment
  (bsc#1183682).
- hv_netvsc: Use vmbus_requestor to generate transaction IDs
  for VMBus hardening (bsc#1183682).
- scsi: storvsc: Use vmbus_requestor to generate transaction
  IDs for VMBus hardening (bsc#1183682).
- Drivers: hv: vmbus: Add vmbus_requestor data structure for
  VMBus hardening (bsc#1183682).
- x86/hyper-v: Add synthetic debugger definitions (bsc#1186071).
- asm-generic/hyperv: Add definitions for Get/SetVpRegister
  hypercalls (bsc#1186071).
- commit f79519d</changelog>
  <changelog author="ohering@suse.de" date="1625227204">- scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback() (bsc#1183682).
- commit e599609</changelog>
  <changelog author="ohering@suse.de" date="1625227205">- drivers/hv: remove obsolete TODO and fix misleading typo in
  comment (bsc#1186071).
- drivers: hv: vmbus: Fix checkpatch SPLIT_STRING (bsc#1186071).
- commit 9cc5e50</changelog>
  <changelog author="ohering@suse.de" date="1625227206">- Revert "scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback()" (bsc#1183682).
- commit fa61bc6</changelog>
  <changelog author="ohering@suse.de" date="1625227207">- PCI: hv: Drop msi_controller structure (bsc#1186071).
- hv_netvsc: Make netvsc/VF binding check both MAC and serial
  number (bsc#1186071).
- hv_netvsc: Add error handling while switching data path
  (bsc#1186071).
- hv_netvsc: Add a comment clarifying batching logic
  (bsc#1186071).
- scsi: storvsc: Enable scatterlist entry lengths &gt; 4Kbytes
  (bsc#1186071).
- scsi: storvsc: Parameterize number hardware queues
  (bsc#1186071).
- drivers: hv: Create a consistent pattern for checking Hyper-V
  hypercall status (bsc#1186071).
- x86/hyperv: Move hv_do_rep_hypercall to asm-generic
  (bsc#1186071).
- Drivers: hv: vmbus: Check for pending channel interrupts before
  taking a CPU offline (bsc#1186071).
- Drivers: hv: vmbus: Drivers: hv: vmbus: Introduce
  CHANNELMSG_MODIFYCHANNEL_RESPONSE (bsc#1186071).
- Drivers: hv: vmbus: Introduce and negotiate VMBus protocol
  version 5.3 (bsc#1186071).
- Drivers: hv: vmbus: remove unused function (bsc#1186071).
- Drivers: hv: vmbus: Remove unused linux/version.h header
  (bsc#1186071).
- x86/hyperv: remove unused linux/version.h header (bsc#1186071).
- x86/hyperv: Fix unused variable 'hi' warning in hv_apic_read
  (bsc#1186071).
- x86/hyperv: Fix unused variable 'msr_val' warning in
  hv_qlock_wait (bsc#1186071).
- hv: hyperv.h: a few mundane typo fixes (bsc#1186071).
- drivers: hv: Fix EXPORT_SYMBOL and tab spaces issue
  (bsc#1186071).
- Drivers: hv: vmbus: Drop error message when 'No request id
  available' (bsc#1183682).
- asm-generic/hyperv: Add missing function prototypes per -W1
  warnings (bsc#1186071).
- clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts
  (bsc#1186071).
- clocksource/drivers/hyper-v: Set clocksource rating based on
  Hyper-V feature (bsc#1186071).
- clocksource/drivers/hyper-v: Handle sched_clock differences
  inline (bsc#1186071).
- Drivers: hv: vmbus: Move handling of VMbus interrupts
  (bsc#1186071).
- Drivers: hv: vmbus: Handle auto EOI quirk inline (bsc#1186071).
- Drivers: hv: vmbus: Move hyperv_report_panic_msg to arch
  neutral code (bsc#1186071).
- Drivers: hv: Redo Hyper-V synthetic MSR get/set functions
  (bsc#1186071).
- x86/hyper-v: Move hv_message_type to architecture neutral module
  (bsc#1186071).
- Drivers: hv: vmbus: Move Hyper-V page allocator to arch neutral
  code (bsc#1186071).
- hv_netvsc: Fix validation in netvsc_linkstatus_callback()
  (bsc#1183682).
- PCI: hv: Fix typo (bsc#1186071).
- scsi: storvsc: Return DID_ERROR for invalid commands
  (bsc#1186071).
- scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback() (bsc#1183682).
- scsi: storvsc: Resolve data race in storvsc_probe()
  (bsc#1183682).
- scsi: storvsc: Fix max_outstanding_req_per_channel for Win8
  and newer (bsc#1186071).
- Revert "Drivers: hv: vmbus: Copy packets sent by Hyper-V out
  of the ring buffer" (bsc#1186071).
- iommu/hyperv: setup an IO-APIC IRQ remapping domain for root
  partition (bsc#1186071).
- x86/hyperv: implement an MSI domain for root partition
  (bsc#1186071).
- asm-generic/hyperv: import data structures for mapping device
  interrupts (bsc#1186071).
- asm-generic/hyperv: introduce hv_device_id and auxiliary
  structures (bsc#1186071).
- asm-generic/hyperv: update hv_interrupt_entry (bsc#1186071).
- asm-generic/hyperv: update hv_msi_entry (bsc#1186071).
- x86/hyperv: implement and use hv_smp_prepare_cpus (bsc#1186071).
- x86/hyperv: provide a bunch of helper functions (bsc#1186071).
- x86/hyperv: handling hypercall page setup for root
  (bsc#1186071).
- x86/hyperv: extract partition ID from Microsoft Hypervisor if
  necessary (bsc#1186071).
- x86/hyperv: allocate output arg pages if required (bsc#1186071).
- clocksource/hyperv: use MSR-based access if running as root
  (bsc#1186071).
- Drivers: hv: vmbus: skip VMBus initialization if Linux is root
  (bsc#1186071).
- x86/hyperv: detect if Linux is the root partition (bsc#1186071).
- asm-generic/hyperv: change HV_CPU_POWER_MANAGEMENT to
  HV_CPU_MANAGEMENT (bsc#1186071).
- hv: hyperv.h: Replace one-element array with flexible-array
  in struct icmsg_negotiate (bsc#1186071).
- hv_netvsc: Restrict configurations on isolated guests
  (bsc#1183682).
- Drivers: hv: vmbus: Enforce 'VMBus version &gt;= 5.2' on isolated
  guests (bsc#1183682).
- Drivers: hv: vmbus: Restrict vmbus_devices on isolated guests
  (bsc#1183682).
- x86/hyperv: Load/save the Isolation Configuration leaf
  (bsc#1183682).
- hv_utils: Fix spelling mistake "Hearbeat" -&gt; "Heartbeat"
  (bsc#1186071).
- Drivers: hv: vmbus: Add /sys/bus/vmbus/hibernation
  (bsc#1186071).
- Drivers: hv: vmbus: Resolve race condition in
  vmbus_onoffer_rescind() (bsc#1183682).
- Drivers: hv: vmbus: Copy the hv_message in vmbus_on_msg_dpc()
  (bsc#1183682).
- Drivers: hv: vmbus: Reduce number of references to message in
  vmbus_on_msg_dpc() (bsc#1183682).
- Drivers: hv: vmbus: Initialize memory to be sent to the host
  (bsc#1183682).
- hv_utils: Add validation for untrusted Hyper-V values
  (bsc#1183682).
- Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the
  ring buffer (bsc#1183682).
- hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet
  info (bsc#1183682).
- hv_netvsc: Allocate the recv_buf buffers after
  NVSP_MSG1_TYPE_SEND_RECV_BUF (bsc#1183682).
- hv_netvsc: Copy packets sent by Hyper-V out of the receive
  buffer (bsc#1183682).
- hv_netvsc: Add (more) validation for untrusted Hyper-V values
  (bsc#1183682).
- hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
  (bsc#1186071).
- hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
  (bsc#1186071).
- hv_netvsc: Check VF datapath when sending traffic to VF
  (bsc#1183682).
- vsock: fix locking in vsock_shutdown() (bsc#1186071).
- x86/hyperv: check cpu mask after interrupt has been disabled
  (bsc#1186071).
- use __netdev_notify_peers in hyperv (bsc#1186071).
- hv_balloon: do adjust_managed_page_count() when
  ballooning/un-ballooning (bsc#1186071).
- hv_balloon: simplify math in alloc_balloon_pages()
  (bsc#1186071).
- commit 8aa7b0a</changelog>
  <changelog author="ohering@suse.de" date="1625227208">- x86/hyperv: fix logical processor creation (bsc#1186071).
- commit 3182d1d</changelog>
  <changelog author="bp@suse.de" date="1625486400">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
</package>
<package pkgid="116063ff33be606d57979a3411defd00463748d3fef087ee3fa102c622e66196" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.14.1"/>
  <changelog author="ohering@suse.de" date="1625227200">- scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback() (bsc#1183682).
- commit e599609</changelog>
  <changelog author="ohering@suse.de" date="1625227201">- drivers/hv: remove obsolete TODO and fix misleading typo in
  comment (bsc#1186071).
- drivers: hv: vmbus: Fix checkpatch SPLIT_STRING (bsc#1186071).
- commit 9cc5e50</changelog>
  <changelog author="ohering@suse.de" date="1625227202">- Revert "scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback()" (bsc#1183682).
- commit fa61bc6</changelog>
  <changelog author="ohering@suse.de" date="1625227203">- PCI: hv: Drop msi_controller structure (bsc#1186071).
- hv_netvsc: Make netvsc/VF binding check both MAC and serial
  number (bsc#1186071).
- hv_netvsc: Add error handling while switching data path
  (bsc#1186071).
- hv_netvsc: Add a comment clarifying batching logic
  (bsc#1186071).
- scsi: storvsc: Enable scatterlist entry lengths &gt; 4Kbytes
  (bsc#1186071).
- scsi: storvsc: Parameterize number hardware queues
  (bsc#1186071).
- drivers: hv: Create a consistent pattern for checking Hyper-V
  hypercall status (bsc#1186071).
- x86/hyperv: Move hv_do_rep_hypercall to asm-generic
  (bsc#1186071).
- Drivers: hv: vmbus: Check for pending channel interrupts before
  taking a CPU offline (bsc#1186071).
- Drivers: hv: vmbus: Drivers: hv: vmbus: Introduce
  CHANNELMSG_MODIFYCHANNEL_RESPONSE (bsc#1186071).
- Drivers: hv: vmbus: Introduce and negotiate VMBus protocol
  version 5.3 (bsc#1186071).
- Drivers: hv: vmbus: remove unused function (bsc#1186071).
- Drivers: hv: vmbus: Remove unused linux/version.h header
  (bsc#1186071).
- x86/hyperv: remove unused linux/version.h header (bsc#1186071).
- x86/hyperv: Fix unused variable 'hi' warning in hv_apic_read
  (bsc#1186071).
- x86/hyperv: Fix unused variable 'msr_val' warning in
  hv_qlock_wait (bsc#1186071).
- hv: hyperv.h: a few mundane typo fixes (bsc#1186071).
- drivers: hv: Fix EXPORT_SYMBOL and tab spaces issue
  (bsc#1186071).
- Drivers: hv: vmbus: Drop error message when 'No request id
  available' (bsc#1183682).
- asm-generic/hyperv: Add missing function prototypes per -W1
  warnings (bsc#1186071).
- clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts
  (bsc#1186071).
- clocksource/drivers/hyper-v: Set clocksource rating based on
  Hyper-V feature (bsc#1186071).
- clocksource/drivers/hyper-v: Handle sched_clock differences
  inline (bsc#1186071).
- Drivers: hv: vmbus: Move handling of VMbus interrupts
  (bsc#1186071).
- Drivers: hv: vmbus: Handle auto EOI quirk inline (bsc#1186071).
- Drivers: hv: vmbus: Move hyperv_report_panic_msg to arch
  neutral code (bsc#1186071).
- Drivers: hv: Redo Hyper-V synthetic MSR get/set functions
  (bsc#1186071).
- x86/hyper-v: Move hv_message_type to architecture neutral module
  (bsc#1186071).
- Drivers: hv: vmbus: Move Hyper-V page allocator to arch neutral
  code (bsc#1186071).
- hv_netvsc: Fix validation in netvsc_linkstatus_callback()
  (bsc#1183682).
- PCI: hv: Fix typo (bsc#1186071).
- scsi: storvsc: Return DID_ERROR for invalid commands
  (bsc#1186071).
- scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback() (bsc#1183682).
- scsi: storvsc: Resolve data race in storvsc_probe()
  (bsc#1183682).
- scsi: storvsc: Fix max_outstanding_req_per_channel for Win8
  and newer (bsc#1186071).
- Revert "Drivers: hv: vmbus: Copy packets sent by Hyper-V out
  of the ring buffer" (bsc#1186071).
- iommu/hyperv: setup an IO-APIC IRQ remapping domain for root
  partition (bsc#1186071).
- x86/hyperv: implement an MSI domain for root partition
  (bsc#1186071).
- asm-generic/hyperv: import data structures for mapping device
  interrupts (bsc#1186071).
- asm-generic/hyperv: introduce hv_device_id and auxiliary
  structures (bsc#1186071).
- asm-generic/hyperv: update hv_interrupt_entry (bsc#1186071).
- asm-generic/hyperv: update hv_msi_entry (bsc#1186071).
- x86/hyperv: implement and use hv_smp_prepare_cpus (bsc#1186071).
- x86/hyperv: provide a bunch of helper functions (bsc#1186071).
- x86/hyperv: handling hypercall page setup for root
  (bsc#1186071).
- x86/hyperv: extract partition ID from Microsoft Hypervisor if
  necessary (bsc#1186071).
- x86/hyperv: allocate output arg pages if required (bsc#1186071).
- clocksource/hyperv: use MSR-based access if running as root
  (bsc#1186071).
- Drivers: hv: vmbus: skip VMBus initialization if Linux is root
  (bsc#1186071).
- x86/hyperv: detect if Linux is the root partition (bsc#1186071).
- asm-generic/hyperv: change HV_CPU_POWER_MANAGEMENT to
  HV_CPU_MANAGEMENT (bsc#1186071).
- hv: hyperv.h: Replace one-element array with flexible-array
  in struct icmsg_negotiate (bsc#1186071).
- hv_netvsc: Restrict configurations on isolated guests
  (bsc#1183682).
- Drivers: hv: vmbus: Enforce 'VMBus version &gt;= 5.2' on isolated
  guests (bsc#1183682).
- Drivers: hv: vmbus: Restrict vmbus_devices on isolated guests
  (bsc#1183682).
- x86/hyperv: Load/save the Isolation Configuration leaf
  (bsc#1183682).
- hv_utils: Fix spelling mistake "Hearbeat" -&gt; "Heartbeat"
  (bsc#1186071).
- Drivers: hv: vmbus: Add /sys/bus/vmbus/hibernation
  (bsc#1186071).
- Drivers: hv: vmbus: Resolve race condition in
  vmbus_onoffer_rescind() (bsc#1183682).
- Drivers: hv: vmbus: Copy the hv_message in vmbus_on_msg_dpc()
  (bsc#1183682).
- Drivers: hv: vmbus: Reduce number of references to message in
  vmbus_on_msg_dpc() (bsc#1183682).
- Drivers: hv: vmbus: Initialize memory to be sent to the host
  (bsc#1183682).
- hv_utils: Add validation for untrusted Hyper-V values
  (bsc#1183682).
- Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the
  ring buffer (bsc#1183682).
- hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet
  info (bsc#1183682).
- hv_netvsc: Allocate the recv_buf buffers after
  NVSP_MSG1_TYPE_SEND_RECV_BUF (bsc#1183682).
- hv_netvsc: Copy packets sent by Hyper-V out of the receive
  buffer (bsc#1183682).
- hv_netvsc: Add (more) validation for untrusted Hyper-V values
  (bsc#1183682).
- hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
  (bsc#1186071).
- hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
  (bsc#1186071).
- hv_netvsc: Check VF datapath when sending traffic to VF
  (bsc#1183682).
- vsock: fix locking in vsock_shutdown() (bsc#1186071).
- x86/hyperv: check cpu mask after interrupt has been disabled
  (bsc#1186071).
- use __netdev_notify_peers in hyperv (bsc#1186071).
- hv_balloon: do adjust_managed_page_count() when
  ballooning/un-ballooning (bsc#1186071).
- hv_balloon: simplify math in alloc_balloon_pages()
  (bsc#1186071).
- commit 8aa7b0a</changelog>
  <changelog author="ohering@suse.de" date="1625227204">- x86/hyperv: fix logical processor creation (bsc#1186071).
- commit 3182d1d</changelog>
  <changelog author="dwagner@suse.de" date="1625227205">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227206">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227207">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227208">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227209">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="7dde65a7cda2aad0e2c43d5eda531d0d5e255027af80f7891518bbb3e689a6fb" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.17.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="bc3d53ea15ee913e030e74166ac79838fea1c82ff7df60d7791d56e9be5869f9" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.22.2"/>
  <changelog author="msuchanek@suse.de" date="1631188800">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188802">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- commit 561fbd8</changelog>
  <changelog author="mkoutny@suse.com" date="1631534407">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="86b09f31cda0b3d99df912722785b5992f93c9cad88ea0574b00ddabeef73151" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.25.2"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="cc0c35b63f72081263f82c25a061072e25051d925969cce2b85b134a0680c85d" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.28.2"/>
  <changelog author="dwagner@suse.de" date="1635422400">- nvme-pci: fix error unwind in nvme_map_data (bsc#1191934).
- nvme-pci: refactor nvme_unmap_data (bsc#1191934).
- commit 3a9d8cd</changelog>
  <changelog author="dwagner@suse.de" date="1635422401">- nvme-pci: fix error unwind in nvme_map_data (bsc#1191934).
- nvme-pci: refactor nvme_unmap_data (bsc#1191934).
- commit fc21d20</changelog>
  <changelog author="tiwai@suse.de" date="1635422402">- Update patch reference for ISDN fix (CVE-2021-3896 bsc#1191958)
- commit b1524c3</changelog>
  <changelog author="msuchanek@suse.de" date="1635422403">- powerpc/idle: Don't corrupt back chain when going idle
  (bko#206669 bsc#1174585 bsc#1192107 CVE-2021-43056).
- KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return
  0 if it went to guest (bko#206669 bsc#1174585 bsc#1192107
  CVE-2021-43056).
- KVM: PPC: Book3S HV: Fix stack handling in
  idle_kvm_start_guest() (bko#206669 bsc#1174585 bsc#1192107
  CVE-2021-43056).
- powerpc64/idle: Fix SP offsets when saving GPRs (bko#206669
  bsc#1174585 bsc#1192107 CVE-2021-43056).
- commit 90745c9</changelog>
  <changelog author="mkubecek@suse.cz" date="1635508800">- sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
  (CVE-2021-3655 bsc#1188563).
- sctp: validate chunk size in __rcv_asconf_lookup (CVE-2021-3655
  bsc#1188563).
- sctp: add size validation when walking chunks (CVE-2021-3655
  bsc#1188563).
- commit e419503</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1635508801">- netfilter: xt_IDLETIMER: fix panic that occurs when timer_type
  has garbage value (bsc#1176447).
- ice: fix getting UDP tunnel entry (jsc#SLE-12878).
- net/mlx5: E-Switch, Fix double allocation of acl flow counter
  (jsc#SLE-15172).
- net/mlx5e: IPSEC RX, enable checksum complete (jsc#SLE-15172).
- RDMA/cma: Do not change route.addr.src_addr.ss_family
  (bsc#1181147).
- RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
  (bsc#1181147).
- net: hns3: check queue id range before using (jsc#SLE-14777).
- bnxt_en: make bnxt_free_skbs() safe to call after
  bnxt_free_mem() (jsc#SLE-16649).
- ice: Only lock to update netdev dev_addr (git-fixes).
- net/sched: ets: fix crash when flipping from 'strict' to
  'quantum' (bsc#1176774).
- net/mlx5e: RX, Avoid possible data corruption when relaxed
  ordering and LRO combined (jsc#SLE-15172).
- commit 016bdb7</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1635508802">- ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
  (git-fixes).
- commit c406ead</changelog>
  <changelog author="tiwai@suse.de" date="1635508803">- net: lan78xx: fix division by zero in send path (git-fixes).
- net: batman-adv: fix error handling (git-fixes).
- nfc: port100: fix using -ERRNO as command type mask (git-fixes).
- cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
  (git-fixes).
- regmap: Fix possible double-free in regcache_rbtree_exit()
  (git-fixes).
- commit 1fb45c2</changelog>
  <changelog author="tiwai@suse.de" date="1635508804">- cfg80211: correct bridge/4addr mode check (git-fixes).
- cfg80211: fix management registrations locking (git-fixes).
- commit 38a77a6</changelog>
  <changelog author="tiwai@suse.de" date="1635508805">- kABI workaround for cfg80211 mgmt_registration_lock changes
  (git-fixes).
- commit 85ca292</changelog>
  <changelog author="dwagner@suse.de" date="1635508806">- scsi: lpfc: Update lpfc version to 14.0.0.3 (bsc#1192145).
- scsi: lpfc: Allow fabric node recovery if recovery is in
  progress before devloss (bsc#1192145).
- scsi: lpfc: Fix link down processing to address NULL pointer
  dereference (bsc#1192145).
- scsi: lpfc: Allow PLOGI retry if previous PLOGI was aborted
  (bsc#1192145).
- scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
  (bsc#1192145).
- scsi: lpfc: Correct sysfs reporting of loop support after SFP
  status change (bsc#1192145).
- scsi: lpfc: Wait for successful restart of SLI3 adapter during
  host sg_reset (bsc#1192145).
- scsi: lpfc: Revert LOG_TRACE_EVENT back to LOG_INIT prior to
  driver_resource_setup() (bsc#1192145).
- commit ea0ad63</changelog>
  <changelog author="tiwai@suse.de" date="1635595200">- mmc: vub300: fix control-message timeouts (git-fixes).
- mmc: dw_mmc: exynos: fix the finding clock sample value
  (git-fixes).
- commit 15296ab</changelog>
  <changelog author="mkubecek@suse.cz" date="1635768000">- sctp: add vtag check in sctp_sf_ootb (CVE-2021-3772
  bsc#1190351).
- sctp: add vtag check in sctp_sf_do_8_5_1_E_sa (CVE-2021-3772
  bsc#1190351).
- sctp: add vtag check in sctp_sf_violation (CVE-2021-3772
  bsc#1190351).
- sctp: fix the processing for COOKIE_ECHO chunk (CVE-2021-3772
  bsc#1190351).
- sctp: fix the processing for INIT_ACK chunk (CVE-2021-3772
  bsc#1190351).
- sctp: fix the processing for INIT chunk (CVE-2021-3772
  bsc#1190351).
- sctp: use init_tag from inithdr for ABORT chunk (CVE-2021-3772
  bsc#1190351).
- sctp: check asoc peer.asconf_capable before processing asconf
  (bsc#1190351).
- commit c4ecd47</changelog>
  <changelog author="msuchanek@suse.de" date="1635768001">- KVM: PPC: Book3S HV: Save host FSCR in the P7/8 path
  (bsc#1065729).
- commit 4a60f84</changelog>
  <changelog author="bp@suse.de" date="1635768002">- x86/pat: Pass valid address to sanitize_phys() (bsc#1152489).
- commit 1702f6b</changelog>
  <changelog author="msuchanek@suse.de" date="1635768003">- powerpc/64s: Remove irq mask workaround in
  accumulate_stolen_time() (jsc#SLE-9246 git-fixes).
- commit 5f2cf7e</changelog>
  <changelog author="msuchanek@suse.de" date="1635768004">- powerpc/xive: Discard disabled interrupts in get_irqchip_state()
  (fate#322438 bsc#1085030 git-fixes).
- commit 3106974</changelog>
  <changelog author="msuchanek@suse.de" date="1635768005">- KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode
  changing registers (bsc#1156395).
- KVM: PPC: Fix clearing never mapped TCEs in realmode
  (bsc#1156395).
- KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0
  when guest SPRs are live (bsc#1156395).
- KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state
  (bsc#1156395).
- KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak (bsc#1156395).
- commit 2ce76cc</changelog>
  <changelog author="mkubecek@suse.cz" date="1635768006">- ipv6/netfilter: Discard first fragment not including all headers
  (bsc#1191241).
- IPv6: reply ICMP error if the first fragment don't include
  all headers (bsc#1191241).
- ICMPv6: Add ICMPv6 Parameter Problem, code 3 definition
  (bsc#1191241).
- net: ipv6: Discard next-hop MTU less than minimum link MTU
  (bsc#1191241).
- commit c74316d</changelog>
  <changelog author="mkubecek@suse.cz" date="1635768007">- netfilter: conntrack: collect all entries in one cycle
  (bsc#1173604).
- commit c4117de</changelog>
</package>
<package pkgid="61a6ad760fb1d3c0dffaa8e9cecb05ad5fd0b528ea4f2df507c821e15811ad64" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.3.1"/>
  <changelog author="hare@suse.de" date="1622462400">- nvme-pci: use simple suspend when a HMB is enabled (git-fixes).
- nvme-pci: make sure write/poll_queues less or equal then cpu
  (git-fixes).
- nvme-pci: align io queue count with allocted nvme_queue in
  (git-fixes).
- nvme-pci: remove last_sq_tail (git-fixes).
- nvme-pci: remove volatile cqes (git-fixes).
- nvme-pci: avoid race between nvme_reap_pending_cqes() and
  nvme_poll() (git-fixes).
- nvme-pci: dma read memory barrier for completions (git-fixes).
- nvme-pci: fix "slimmer CQ head update" (git-fixes).
- nvme-pci: Simplify nvme_poll_irqdisable (git-fixes).
- nvme-pci: Remove two-pass completions (git-fixes).
- nvme-pci: Remove tag from process cq (git-fixes).
- nvme-pci: slimmer CQ head update (git-fixes).
- commit dd74a78</changelog>
  <changelog author="hare@suse.de" date="1622462401">- nvme: document nvme controller states (git-fixes).
- commit 495f482</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- blacklist.conf: arm64: add fix for unsupported SOC
- commit 7c4e5f6</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- arm64: vdso32: make vdso32 install conditional (git-fixes).
- commit de92552</changelog>
  <changelog author="hare@suse.de" date="1622462405">- nvme: fix deadlock in disconnect during scan_work and/or
  ana_work (git-fixes).
- Refresh
  patches.suse/nvme-fabrics-reject-I-O-to-offline-device.patch.
- commit 4805fdc</changelog>
  <changelog author="varad.gautam@suse.com" date="1622462406">- series.conf: cleanup
  update upstream references and resort:
  patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch
- commit a8331c9</changelog>
  <changelog author="ykaukab@suse.de" date="1622462407">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462408">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462409">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="bp@suse.de" date="1622462410">- x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is
  supported (bsc#1152489).
- commit 1931741</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="hare@suse.de" date="1622548801">- block/genhd: use atomic_t for disk_event-&gt;block (bsc#1185497).
- commit 57427b3</changelog>
  <changelog author="oneukum@suse.com" date="1622548802">- nxp-nci: add NXP1002 id (bsc#1185589).
- commit 9d43526</changelog>
  <changelog author="oneukum@suse.com" date="1622548803">- nxp-i2c: restore includes for kABI (bsc#1185589).
- commit 1786af1</changelog>
  <changelog author="msuchanek@suse.de" date="1622548804">- Refresh patches.suse/scsi-ibmvfc-Reinit-target-retries.patch.
  Update patch metadata.
- commit e269098</changelog>
  <changelog author="mkubecek@suse.cz" date="1622548805">- series.conf: cleanup
- move unsortable patch out of sorted section
  patches.suse/nxp-nci-add-NXP1002-id.patch
- commit d0ca1ba</changelog>
  <changelog author="dwagner@suse.de" date="1622548806">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
  Refresh:
  - patches.suse/nvme-multipath-retry-commands-for-dying-queues.patch
- commit f0fe006</changelog>
  <changelog author="dwagner@suse.de" date="1622548807">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="71e8e32175af03b572b3becb4d118b8e9da35c41cff585692d436644b6f19807" name="dlm-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.8.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="eda8d10352e519bc8c86d374d4cb4d26cd2fccc45d803c3d5dd3ece4fc642e7b" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="ccb9ead19f616bf2cece2442915a83afa87e3165218683b5f2a2b9df9487036e" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="9a1e3bd4ed6f7c57b57aab66311ec2f06b07e767486b9c2984aaac499d354fca" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="91e977e33f6e54e5fc615f8296d77b59e802e1481099c22c51e52cf9c44e0ff2" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="afb79d4bff3f2cf3a78f0ff9fba59aaaf9fccbdaded7e2b3d97aac695921f4fa" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="7932cf6ceabecd5c475067291b76adcef5d606e03916e9494dca47524d9c77a1" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="00e709921833870d9e74c61a8eb6a4266a4ff2a7384db0e719d4058f591e5623" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="426b728b1215d61c1cb5a5094ae356a60c2893719d81ccf05eb14f4d01c61fe5" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="9a8031c1e39167e0ede23899c93b76d00aeb05bc4c5333b4034de7c4ecc95d98" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="03f1dcf6d39903c6d6f6b45a4842e7399ad49274421cbb53f2655f9888d5c9e5" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="f56fabc08af69772999490cf7d9107d23aa84aa87ed9c0684abf453365e538c9" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="aacb2acb279be32a48f3f94f77de6446085f345129322f630623a9fc9118121d" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="1de47057e574dffad5b72bd2aaa5702564bdb2cb704dbb01ea54a4a731ec1e11" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="85e3bc4ccf1315ac9bd38325caf3f349cc2f405fc7f8bb5406d06baa40224855" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="752e2b85ed8678bcb8d3d884a429c4a06263446c0fd4543302a1f3750543e011" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="1d7926d29b89e3b2ffbb1e8bc2f6f8f970fabdae010299713f64d93bab5c93c1" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="3993b1859963d7b0f4814d99f20944f3d29ad03c99e65929c29f57f72cb18280" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="19fb3ea876ed602113925b44c1427eae90f50d16bfb4b931f90d0d4159717f25" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="b2c9ae4fcd1c653cb9b851d2f02b05da6722f3df40bd96ba2c80fd2f611f9e56" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="04585f2ce48b0a8521aa00ef60a652f0aa14e6bbe1c6094d745a7d93fa092c7a" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="0bc8cd91722d85416005f969fdcd0b33b14422537edc883ad4c82c95db85d8a2" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="896201af60f60e7b9e1a7525125e38bc86eb2d89c79b8677e73181d695d40731" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="cacfc9972271f5071e00c9436a70302025bceb0648215744f32441e021de7f03" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="fd5a5241ea103ea63b42c1be2e2c6c1fdf9c568d30eb9739253acf722ce5f1c0" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="457596b44fbdd6387c6799b38f5e95761a94a10971572dc981d247c5167a56b7" name="dlm-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="0f45fb445498f331042261739a69c096713f411ea34a3f67f9404f1dc92ac64f" name="dlm-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="54399e9be00561292b5c05f490a70be4a229013735eab40de555b827ced0392d" name="dlm-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="e743a6a5fa5d1d68f590ba5325939b20960fa9c3c323e60fc5677e9dcb39cefe" name="dlm-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="19e36348ce06c3b4fe51b3159d3bfdc57195893f379bb5ae1d845e811d8683cb" name="dlm-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="340d90b18eecd0a246594087158af47a3f5f625d9020a560ac045b7263ad63d0" name="dlm-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="f7831bb543149282a0b501e4e64e4537ce1d655fc653c6a3bddb02a281ca4b35" name="dlm-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="b5ea1389c1ff98cab4d98d8a2120aa2fc4ff107cf6304da02e2c8a5d29c92949" name="dlm-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="7a0f39de87f077ab709d1d36e6ef70fcfcd8bf8098d7ec742e48cc6a233d8c85" name="dlm-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="d3a8ab854ff2dcbf07d4d807036af792cc44d9c083ddd0a6beaebbecdb6ab387" name="dlm-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="be2b760209610bd726a5ebd9ffcf0c5a56b35bcb66fa4c365866351ad9ef2236" name="dlm-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="b42f870a991d40a21a8a00fcc0e0514ccc92ee31049d06118d0a8d63b4c00289" name="dlm-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="4e2ec62b47c9f753f6ecd89a923cd444032202c54a9c8f7900a74f71dfda8a40" name="dlm-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="5be4938163223714eb263ce5d00406825034ee35793d529f26912aada0eed2ba" name="dlm-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="3370879e9c92f1bb17a34a35aa8e95ea6ace64c4df53eed42ce64f6947d90014" name="dlm-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="9ab32a4d2febe68020f220bc46ebf607464c148db467a46eb8d33701c29db634" name="dlm-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="5a35b83bf849ca888e6d6fb0f6ff3deffbbdf03cdb58f2dcee82641b020061b2" name="dlm-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="c220333cd38b01fff6df42b42c7710688a042d23a89b5f7ef7381c21c42fa586" name="dlm-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="82f5509048d4b9ff2a0415950f811d2674229103f11236af16ff3bc67aca964f" name="dnsmasq" arch="aarch64">
  <version epoch="0" ver="2.86" rel="7.14.1"/>
  <changelog author="jengelh@inai.de" date="1540209600">- Ensure neutrality of descriptions. / Replace description with
  new upstream description.
- Do not hide failures from user/group additions.
- Replace old $RPM_* shell vars by macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1548244800">- libidn should not be used anymore, switch to libidn2</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560254400">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="jslaby@suse.com" date="1562760000">- add 0001-fix-build-after-y2038-changes-in-glibc.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1563883200">- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by
  firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1567598400">- Add Fix-build-with-libnettle-3.5.patch</changelog>
  <changelog author="max@suse.com" date="1573646400">- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
  memory leak in the create_helper() function in /src/helper.c
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
- Package contrib/lease-tools/dhcp_release6.
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .</changelog>
  <changelog author="dimstar@opensuse.org" date="1575115200">- Remove redundant %else without meaning (if/else/else/endif?)</changelog>
  <changelog author="info@paolostivanin.com" date="1588680000">- Update to 2.81:
  * Improve cache behaviour for TCP connections
  * Remove the NO_FORK compile-time option, and support for uclinux
  * Fix line-counting when reading /etc/hosts and friends
  * Fix bug in DNS non-terminal code, added in 2.80, which could
  sometimes cause a NODATA rather than an NXDOMAIN reply.
  * Support TCP-fastopen (RFC-7413) on both incoming and
  outgoing TCP connections, if supported and enabled in the OS.
  * Improve kernel-capability manipulation code under Linux
  * Add --shared-network config. This enables allocation of addresses
  by the DHCP server in subnets where the server (or relay) does not
  have an interface on the network in that subnet. Many thanks to
  kamp.de for sponsoring this feature.
  * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet
  validation check got borked in commit 2b38e382 and release 2.80.
  Thanks to Tomasz Szajner for spotting this.
  * Fix compilation against nettle version 3.5 and later.
  * Fix spurious DNSSEC validation failures when the auth section
  of a reply contains unsigned RRs from a signed zone,
  with the exception that NSEC and NSEC3 RRs must always be signed.
    Thanks to Tore Anderson for spotting and diagnosing the bug.
  * Add --dhcp-ignore-clid. This disables reading of DHCP client
  identifier option (option 61), so clients are only identified by
  MAC addresses.
  * Fix a bug which stopped --dhcp-name-match from working when a hostname
  is supplied in --dhcp-host. Thanks to James Feeney for spotting this.
  * Fix bug which caused very rarely caused zero-length DHCPv6 packets.
  Thanks to Dereck Higgins for spotting this.
  * Add --tftp-single-port option.
  * Enhance --conf-dir to load files in a deterministic order
  * Add filtering by tag of --dhcp-host directives
  * Remove DSA signature verification from DNSSEC, as specified in
  RFC 8624
  * Add --script-on-renewal option.
- Remove Fix-build-with-libnettle-3.5.patch
- Remove 0001-fix-build-after-y2038-changes-in-glibc.patch
- Remove dnsmasq-CVE-2019-14834.patch</changelog>
  <changelog author="mrey@suse.com" date="1595937600">- Update to 2.82:
  * Improve behaviour in the face of network interfaces which come
    and go and change index.
  * Convert hard startup failure on NETLINK_NO_ENOBUFS under
    qemu-user to a warning.
  * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in
  - -dhcp-option.
  * Fix crash under heavy TCP connection load introduced in 2.81.
  * Change default lease time for DHCPv6 to one day.
  * Alter calculation of preferred and valid times in router
    advertisements, so that these do not have a floor applied of
    the lease time in the dhcp-range if this is not explicitly
    specified and is merely the default.
- Reformat spec file with spec-cleaner</changelog>
  <changelog author="max@suse.com" date="1611057600">- Update to 2.83:
  * bsc#1177077: Fixed DNSpooq vulnerabilities
  * Use the values of --min-port and --max-port in outgoing
    TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code.
    Any dnsmasq with DNSSEC compiled in and enabled is vulnerable
    to this, referenced by CVE-2020-25681, CVE-2020-25682,
    CVE-2020-25683 CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address
    from which the query was originated. This keeps as much
    entropy in the {query-ID, random-port} tuple as possible, to
    help defeat cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers
    received are for the questions originally asked. This replaces
    the slightly insecure SHA-1 (when compiled with DNSSEC) or
    the very insecure CRC32 (otherwise). Refer: CVE-2020-25685
  * Handle multiple identical near simultaneous DNS queries better.
    Previously, such queries would all be forwarded independently.
    This is, in theory, inefficent but in practise not a problem,
    _except_ that is means that an answer for any of the forwarded
    queries will be accepted and cached.
    An attacker can send a query multiple times, and for each
    repeat, another {port, ID} becomes capable of accepting the
    answer he is sending in the blind, to random IDs and ports.
    The chance of a succesful attack is therefore multiplied by the
    number of repeats of the query. The new behaviour detects
    repeated queries and merely stores the clients sending repeats
    so that when the first query completes, the answer can be sent
    to all the clients who asked. Refer: CVE-2020-25686.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Fix building with lua54</changelog>
  <changelog author="dmueller@suse.com" date="1612785600">- update to 2.84:
  * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH
  * Tidy initialisation in hash_questions.c
  * Optimise sort_rrset for the case where the RR type
  * Move fd into frec_src</changelog>
  <changelog author="max@suse.com" date="1618833600">- Update to 2.85:
  * Fix problem with DNS retries in 2.83/2.84.
  * Tweak sort order of tags in get-version.
  * Avoid treating a --dhcp-host which has an IPv6 address as
    eligible for use with DHCPv4 on the grounds that it has
    no address, and vice-versa.
  * Add --dynamic-host option: A and AAAA records which take their
    network part from the network of a local interface. Useful
    for routers with dynamically prefixes.
  * Teach --bogus-nxdomain and --ignore-address to take an IPv4
    subnet.
  * CVE-2021-3448, bsc#1183709: Use random source ports where
    possible if source addresses/interfaces in use.
  * Change the method of allocation of random source ports for DNS.
  * Scale the size of the DNS random-port pool based on the
    value of the --dns-forward-max configuration.
  * Tweak TFTP code to check sender of all received packets, as
    specified in RFC 1350 para 4.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers on TW</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400).</changelog>
  <changelog author="max@suse.com" date="1631880000">- Update to 2.86:
  * Handle DHCPREBIND requests in the DHCPv6 server code.
  * Fix bug which caused dnsmasq to lose track of processes forked
    to handle TCP DNS connections under heavy load.
  * Major rewrite of the DNS server and domain handling code. This
    should be largely transparent, but it drastically improves
    performance and reduces memory foot-print when configuring
    large numbers of domains.
  * Revise resource handling for number of concurrent DNS queries.
  * Improve efficiency of DNSSEC.
  * Connection track mark based DNS query filtering.
  * Allow smaller than 64 prefix lengths in synth-domain, with
    caveats.
  - -synth-domain=1234:4567::/56,example.com is now valid.
  * Make domains generated by --synth-domain appear in replies
    when in authoritative mode.
  * Ensure CAP_NET_ADMIN capability is available when conntrack
    is configured.
  * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are
    given a directory as argument, define the order in which files
    within that directory are read (alphabetical order of filename).</changelog>
  <changelog author="max@suse.com" date="1632398400">- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1.
- SLE bugs that got fixed upstream between 2.79 and 2.86, but for
  which we need to keep references when syncing:
  * bsc#1176076: dnsmasq-servfail.patch
  * bsc#1156543: dnsmasq-siocgstamp.patch
  * bsc#1138743: dnsmasq-cache-size.patch
  * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
  * bsc#1180914: Open inotify socket only when used.
  * removed dnsmasq-dnspooq.patch
- bsc#1173646, CVE-2020-14312: Set --local-service by default.</changelog>
</package>
<package pkgid="21abf041c72de6ddf308c2a6262fb4e94bff990742c4c34e9aed14f8f7674e16" name="dnsmasq" arch="ppc64le">
  <version epoch="0" ver="2.86" rel="7.14.1"/>
  <changelog author="jengelh@inai.de" date="1540209600">- Ensure neutrality of descriptions. / Replace description with
  new upstream description.
- Do not hide failures from user/group additions.
- Replace old $RPM_* shell vars by macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1548244800">- libidn should not be used anymore, switch to libidn2</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560254400">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="jslaby@suse.com" date="1562760000">- add 0001-fix-build-after-y2038-changes-in-glibc.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1563883200">- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by
  firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1567598400">- Add Fix-build-with-libnettle-3.5.patch</changelog>
  <changelog author="max@suse.com" date="1573646400">- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
  memory leak in the create_helper() function in /src/helper.c
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
- Package contrib/lease-tools/dhcp_release6.
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .</changelog>
  <changelog author="dimstar@opensuse.org" date="1575115200">- Remove redundant %else without meaning (if/else/else/endif?)</changelog>
  <changelog author="info@paolostivanin.com" date="1588680000">- Update to 2.81:
  * Improve cache behaviour for TCP connections
  * Remove the NO_FORK compile-time option, and support for uclinux
  * Fix line-counting when reading /etc/hosts and friends
  * Fix bug in DNS non-terminal code, added in 2.80, which could
  sometimes cause a NODATA rather than an NXDOMAIN reply.
  * Support TCP-fastopen (RFC-7413) on both incoming and
  outgoing TCP connections, if supported and enabled in the OS.
  * Improve kernel-capability manipulation code under Linux
  * Add --shared-network config. This enables allocation of addresses
  by the DHCP server in subnets where the server (or relay) does not
  have an interface on the network in that subnet. Many thanks to
  kamp.de for sponsoring this feature.
  * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet
  validation check got borked in commit 2b38e382 and release 2.80.
  Thanks to Tomasz Szajner for spotting this.
  * Fix compilation against nettle version 3.5 and later.
  * Fix spurious DNSSEC validation failures when the auth section
  of a reply contains unsigned RRs from a signed zone,
  with the exception that NSEC and NSEC3 RRs must always be signed.
    Thanks to Tore Anderson for spotting and diagnosing the bug.
  * Add --dhcp-ignore-clid. This disables reading of DHCP client
  identifier option (option 61), so clients are only identified by
  MAC addresses.
  * Fix a bug which stopped --dhcp-name-match from working when a hostname
  is supplied in --dhcp-host. Thanks to James Feeney for spotting this.
  * Fix bug which caused very rarely caused zero-length DHCPv6 packets.
  Thanks to Dereck Higgins for spotting this.
  * Add --tftp-single-port option.
  * Enhance --conf-dir to load files in a deterministic order
  * Add filtering by tag of --dhcp-host directives
  * Remove DSA signature verification from DNSSEC, as specified in
  RFC 8624
  * Add --script-on-renewal option.
- Remove Fix-build-with-libnettle-3.5.patch
- Remove 0001-fix-build-after-y2038-changes-in-glibc.patch
- Remove dnsmasq-CVE-2019-14834.patch</changelog>
  <changelog author="mrey@suse.com" date="1595937600">- Update to 2.82:
  * Improve behaviour in the face of network interfaces which come
    and go and change index.
  * Convert hard startup failure on NETLINK_NO_ENOBUFS under
    qemu-user to a warning.
  * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in
  - -dhcp-option.
  * Fix crash under heavy TCP connection load introduced in 2.81.
  * Change default lease time for DHCPv6 to one day.
  * Alter calculation of preferred and valid times in router
    advertisements, so that these do not have a floor applied of
    the lease time in the dhcp-range if this is not explicitly
    specified and is merely the default.
- Reformat spec file with spec-cleaner</changelog>
  <changelog author="max@suse.com" date="1611057600">- Update to 2.83:
  * bsc#1177077: Fixed DNSpooq vulnerabilities
  * Use the values of --min-port and --max-port in outgoing
    TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code.
    Any dnsmasq with DNSSEC compiled in and enabled is vulnerable
    to this, referenced by CVE-2020-25681, CVE-2020-25682,
    CVE-2020-25683 CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address
    from which the query was originated. This keeps as much
    entropy in the {query-ID, random-port} tuple as possible, to
    help defeat cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers
    received are for the questions originally asked. This replaces
    the slightly insecure SHA-1 (when compiled with DNSSEC) or
    the very insecure CRC32 (otherwise). Refer: CVE-2020-25685
  * Handle multiple identical near simultaneous DNS queries better.
    Previously, such queries would all be forwarded independently.
    This is, in theory, inefficent but in practise not a problem,
    _except_ that is means that an answer for any of the forwarded
    queries will be accepted and cached.
    An attacker can send a query multiple times, and for each
    repeat, another {port, ID} becomes capable of accepting the
    answer he is sending in the blind, to random IDs and ports.
    The chance of a succesful attack is therefore multiplied by the
    number of repeats of the query. The new behaviour detects
    repeated queries and merely stores the clients sending repeats
    so that when the first query completes, the answer can be sent
    to all the clients who asked. Refer: CVE-2020-25686.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Fix building with lua54</changelog>
  <changelog author="dmueller@suse.com" date="1612785600">- update to 2.84:
  * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH
  * Tidy initialisation in hash_questions.c
  * Optimise sort_rrset for the case where the RR type
  * Move fd into frec_src</changelog>
  <changelog author="max@suse.com" date="1618833600">- Update to 2.85:
  * Fix problem with DNS retries in 2.83/2.84.
  * Tweak sort order of tags in get-version.
  * Avoid treating a --dhcp-host which has an IPv6 address as
    eligible for use with DHCPv4 on the grounds that it has
    no address, and vice-versa.
  * Add --dynamic-host option: A and AAAA records which take their
    network part from the network of a local interface. Useful
    for routers with dynamically prefixes.
  * Teach --bogus-nxdomain and --ignore-address to take an IPv4
    subnet.
  * CVE-2021-3448, bsc#1183709: Use random source ports where
    possible if source addresses/interfaces in use.
  * Change the method of allocation of random source ports for DNS.
  * Scale the size of the DNS random-port pool based on the
    value of the --dns-forward-max configuration.
  * Tweak TFTP code to check sender of all received packets, as
    specified in RFC 1350 para 4.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers on TW</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400).</changelog>
  <changelog author="max@suse.com" date="1631880000">- Update to 2.86:
  * Handle DHCPREBIND requests in the DHCPv6 server code.
  * Fix bug which caused dnsmasq to lose track of processes forked
    to handle TCP DNS connections under heavy load.
  * Major rewrite of the DNS server and domain handling code. This
    should be largely transparent, but it drastically improves
    performance and reduces memory foot-print when configuring
    large numbers of domains.
  * Revise resource handling for number of concurrent DNS queries.
  * Improve efficiency of DNSSEC.
  * Connection track mark based DNS query filtering.
  * Allow smaller than 64 prefix lengths in synth-domain, with
    caveats.
  - -synth-domain=1234:4567::/56,example.com is now valid.
  * Make domains generated by --synth-domain appear in replies
    when in authoritative mode.
  * Ensure CAP_NET_ADMIN capability is available when conntrack
    is configured.
  * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are
    given a directory as argument, define the order in which files
    within that directory are read (alphabetical order of filename).</changelog>
  <changelog author="max@suse.com" date="1632398400">- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1.
- SLE bugs that got fixed upstream between 2.79 and 2.86, but for
  which we need to keep references when syncing:
  * bsc#1176076: dnsmasq-servfail.patch
  * bsc#1156543: dnsmasq-siocgstamp.patch
  * bsc#1138743: dnsmasq-cache-size.patch
  * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
  * bsc#1180914: Open inotify socket only when used.
  * removed dnsmasq-dnspooq.patch
- bsc#1173646, CVE-2020-14312: Set --local-service by default.</changelog>
</package>
<package pkgid="7bfa6648520c8344e5d5f8f1161ced76230f8fe446c735a81b8bd1e901c222be" name="dnsmasq" arch="s390x">
  <version epoch="0" ver="2.86" rel="7.14.1"/>
  <changelog author="jengelh@inai.de" date="1540209600">- Ensure neutrality of descriptions. / Replace description with
  new upstream description.
- Do not hide failures from user/group additions.
- Replace old $RPM_* shell vars by macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1548244800">- libidn should not be used anymore, switch to libidn2</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560254400">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="jslaby@suse.com" date="1562760000">- add 0001-fix-build-after-y2038-changes-in-glibc.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1563883200">- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by
  firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1567598400">- Add Fix-build-with-libnettle-3.5.patch</changelog>
  <changelog author="max@suse.com" date="1573646400">- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
  memory leak in the create_helper() function in /src/helper.c
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
- Package contrib/lease-tools/dhcp_release6.
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .</changelog>
  <changelog author="dimstar@opensuse.org" date="1575115200">- Remove redundant %else without meaning (if/else/else/endif?)</changelog>
  <changelog author="info@paolostivanin.com" date="1588680000">- Update to 2.81:
  * Improve cache behaviour for TCP connections
  * Remove the NO_FORK compile-time option, and support for uclinux
  * Fix line-counting when reading /etc/hosts and friends
  * Fix bug in DNS non-terminal code, added in 2.80, which could
  sometimes cause a NODATA rather than an NXDOMAIN reply.
  * Support TCP-fastopen (RFC-7413) on both incoming and
  outgoing TCP connections, if supported and enabled in the OS.
  * Improve kernel-capability manipulation code under Linux
  * Add --shared-network config. This enables allocation of addresses
  by the DHCP server in subnets where the server (or relay) does not
  have an interface on the network in that subnet. Many thanks to
  kamp.de for sponsoring this feature.
  * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet
  validation check got borked in commit 2b38e382 and release 2.80.
  Thanks to Tomasz Szajner for spotting this.
  * Fix compilation against nettle version 3.5 and later.
  * Fix spurious DNSSEC validation failures when the auth section
  of a reply contains unsigned RRs from a signed zone,
  with the exception that NSEC and NSEC3 RRs must always be signed.
    Thanks to Tore Anderson for spotting and diagnosing the bug.
  * Add --dhcp-ignore-clid. This disables reading of DHCP client
  identifier option (option 61), so clients are only identified by
  MAC addresses.
  * Fix a bug which stopped --dhcp-name-match from working when a hostname
  is supplied in --dhcp-host. Thanks to James Feeney for spotting this.
  * Fix bug which caused very rarely caused zero-length DHCPv6 packets.
  Thanks to Dereck Higgins for spotting this.
  * Add --tftp-single-port option.
  * Enhance --conf-dir to load files in a deterministic order
  * Add filtering by tag of --dhcp-host directives
  * Remove DSA signature verification from DNSSEC, as specified in
  RFC 8624
  * Add --script-on-renewal option.
- Remove Fix-build-with-libnettle-3.5.patch
- Remove 0001-fix-build-after-y2038-changes-in-glibc.patch
- Remove dnsmasq-CVE-2019-14834.patch</changelog>
  <changelog author="mrey@suse.com" date="1595937600">- Update to 2.82:
  * Improve behaviour in the face of network interfaces which come
    and go and change index.
  * Convert hard startup failure on NETLINK_NO_ENOBUFS under
    qemu-user to a warning.
  * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in
  - -dhcp-option.
  * Fix crash under heavy TCP connection load introduced in 2.81.
  * Change default lease time for DHCPv6 to one day.
  * Alter calculation of preferred and valid times in router
    advertisements, so that these do not have a floor applied of
    the lease time in the dhcp-range if this is not explicitly
    specified and is merely the default.
- Reformat spec file with spec-cleaner</changelog>
  <changelog author="max@suse.com" date="1611057600">- Update to 2.83:
  * bsc#1177077: Fixed DNSpooq vulnerabilities
  * Use the values of --min-port and --max-port in outgoing
    TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code.
    Any dnsmasq with DNSSEC compiled in and enabled is vulnerable
    to this, referenced by CVE-2020-25681, CVE-2020-25682,
    CVE-2020-25683 CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address
    from which the query was originated. This keeps as much
    entropy in the {query-ID, random-port} tuple as possible, to
    help defeat cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers
    received are for the questions originally asked. This replaces
    the slightly insecure SHA-1 (when compiled with DNSSEC) or
    the very insecure CRC32 (otherwise). Refer: CVE-2020-25685
  * Handle multiple identical near simultaneous DNS queries better.
    Previously, such queries would all be forwarded independently.
    This is, in theory, inefficent but in practise not a problem,
    _except_ that is means that an answer for any of the forwarded
    queries will be accepted and cached.
    An attacker can send a query multiple times, and for each
    repeat, another {port, ID} becomes capable of accepting the
    answer he is sending in the blind, to random IDs and ports.
    The chance of a succesful attack is therefore multiplied by the
    number of repeats of the query. The new behaviour detects
    repeated queries and merely stores the clients sending repeats
    so that when the first query completes, the answer can be sent
    to all the clients who asked. Refer: CVE-2020-25686.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Fix building with lua54</changelog>
  <changelog author="dmueller@suse.com" date="1612785600">- update to 2.84:
  * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH
  * Tidy initialisation in hash_questions.c
  * Optimise sort_rrset for the case where the RR type
  * Move fd into frec_src</changelog>
  <changelog author="max@suse.com" date="1618833600">- Update to 2.85:
  * Fix problem with DNS retries in 2.83/2.84.
  * Tweak sort order of tags in get-version.
  * Avoid treating a --dhcp-host which has an IPv6 address as
    eligible for use with DHCPv4 on the grounds that it has
    no address, and vice-versa.
  * Add --dynamic-host option: A and AAAA records which take their
    network part from the network of a local interface. Useful
    for routers with dynamically prefixes.
  * Teach --bogus-nxdomain and --ignore-address to take an IPv4
    subnet.
  * CVE-2021-3448, bsc#1183709: Use random source ports where
    possible if source addresses/interfaces in use.
  * Change the method of allocation of random source ports for DNS.
  * Scale the size of the DNS random-port pool based on the
    value of the --dns-forward-max configuration.
  * Tweak TFTP code to check sender of all received packets, as
    specified in RFC 1350 para 4.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers on TW</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400).</changelog>
  <changelog author="max@suse.com" date="1631880000">- Update to 2.86:
  * Handle DHCPREBIND requests in the DHCPv6 server code.
  * Fix bug which caused dnsmasq to lose track of processes forked
    to handle TCP DNS connections under heavy load.
  * Major rewrite of the DNS server and domain handling code. This
    should be largely transparent, but it drastically improves
    performance and reduces memory foot-print when configuring
    large numbers of domains.
  * Revise resource handling for number of concurrent DNS queries.
  * Improve efficiency of DNSSEC.
  * Connection track mark based DNS query filtering.
  * Allow smaller than 64 prefix lengths in synth-domain, with
    caveats.
  - -synth-domain=1234:4567::/56,example.com is now valid.
  * Make domains generated by --synth-domain appear in replies
    when in authoritative mode.
  * Ensure CAP_NET_ADMIN capability is available when conntrack
    is configured.
  * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are
    given a directory as argument, define the order in which files
    within that directory are read (alphabetical order of filename).</changelog>
  <changelog author="max@suse.com" date="1632398400">- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1.
- SLE bugs that got fixed upstream between 2.79 and 2.86, but for
  which we need to keep references when syncing:
  * bsc#1176076: dnsmasq-servfail.patch
  * bsc#1156543: dnsmasq-siocgstamp.patch
  * bsc#1138743: dnsmasq-cache-size.patch
  * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
  * bsc#1180914: Open inotify socket only when used.
  * removed dnsmasq-dnspooq.patch
- bsc#1173646, CVE-2020-14312: Set --local-service by default.</changelog>
</package>
<package pkgid="939d8dd55c44699f19acb3ecfea452152133587493f1fa6ab704ca45f25b7fcd" name="dnsmasq" arch="src">
  <version epoch="0" ver="2.86" rel="7.14.1"/>
  <changelog author="jengelh@inai.de" date="1540209600">- Ensure neutrality of descriptions. / Replace description with
  new upstream description.
- Do not hide failures from user/group additions.
- Replace old $RPM_* shell vars by macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1548244800">- libidn should not be used anymore, switch to libidn2</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560254400">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="jslaby@suse.com" date="1562760000">- add 0001-fix-build-after-y2038-changes-in-glibc.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1563883200">- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by
  firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1567598400">- Add Fix-build-with-libnettle-3.5.patch</changelog>
  <changelog author="max@suse.com" date="1573646400">- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
  memory leak in the create_helper() function in /src/helper.c
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
- Package contrib/lease-tools/dhcp_release6.
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .</changelog>
  <changelog author="dimstar@opensuse.org" date="1575115200">- Remove redundant %else without meaning (if/else/else/endif?)</changelog>
  <changelog author="info@paolostivanin.com" date="1588680000">- Update to 2.81:
  * Improve cache behaviour for TCP connections
  * Remove the NO_FORK compile-time option, and support for uclinux
  * Fix line-counting when reading /etc/hosts and friends
  * Fix bug in DNS non-terminal code, added in 2.80, which could
  sometimes cause a NODATA rather than an NXDOMAIN reply.
  * Support TCP-fastopen (RFC-7413) on both incoming and
  outgoing TCP connections, if supported and enabled in the OS.
  * Improve kernel-capability manipulation code under Linux
  * Add --shared-network config. This enables allocation of addresses
  by the DHCP server in subnets where the server (or relay) does not
  have an interface on the network in that subnet. Many thanks to
  kamp.de for sponsoring this feature.
  * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet
  validation check got borked in commit 2b38e382 and release 2.80.
  Thanks to Tomasz Szajner for spotting this.
  * Fix compilation against nettle version 3.5 and later.
  * Fix spurious DNSSEC validation failures when the auth section
  of a reply contains unsigned RRs from a signed zone,
  with the exception that NSEC and NSEC3 RRs must always be signed.
    Thanks to Tore Anderson for spotting and diagnosing the bug.
  * Add --dhcp-ignore-clid. This disables reading of DHCP client
  identifier option (option 61), so clients are only identified by
  MAC addresses.
  * Fix a bug which stopped --dhcp-name-match from working when a hostname
  is supplied in --dhcp-host. Thanks to James Feeney for spotting this.
  * Fix bug which caused very rarely caused zero-length DHCPv6 packets.
  Thanks to Dereck Higgins for spotting this.
  * Add --tftp-single-port option.
  * Enhance --conf-dir to load files in a deterministic order
  * Add filtering by tag of --dhcp-host directives
  * Remove DSA signature verification from DNSSEC, as specified in
  RFC 8624
  * Add --script-on-renewal option.
- Remove Fix-build-with-libnettle-3.5.patch
- Remove 0001-fix-build-after-y2038-changes-in-glibc.patch
- Remove dnsmasq-CVE-2019-14834.patch</changelog>
  <changelog author="mrey@suse.com" date="1595937600">- Update to 2.82:
  * Improve behaviour in the face of network interfaces which come
    and go and change index.
  * Convert hard startup failure on NETLINK_NO_ENOBUFS under
    qemu-user to a warning.
  * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in
  - -dhcp-option.
  * Fix crash under heavy TCP connection load introduced in 2.81.
  * Change default lease time for DHCPv6 to one day.
  * Alter calculation of preferred and valid times in router
    advertisements, so that these do not have a floor applied of
    the lease time in the dhcp-range if this is not explicitly
    specified and is merely the default.
- Reformat spec file with spec-cleaner</changelog>
  <changelog author="max@suse.com" date="1611057600">- Update to 2.83:
  * bsc#1177077: Fixed DNSpooq vulnerabilities
  * Use the values of --min-port and --max-port in outgoing
    TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code.
    Any dnsmasq with DNSSEC compiled in and enabled is vulnerable
    to this, referenced by CVE-2020-25681, CVE-2020-25682,
    CVE-2020-25683 CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address
    from which the query was originated. This keeps as much
    entropy in the {query-ID, random-port} tuple as possible, to
    help defeat cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers
    received are for the questions originally asked. This replaces
    the slightly insecure SHA-1 (when compiled with DNSSEC) or
    the very insecure CRC32 (otherwise). Refer: CVE-2020-25685
  * Handle multiple identical near simultaneous DNS queries better.
    Previously, such queries would all be forwarded independently.
    This is, in theory, inefficent but in practise not a problem,
    _except_ that is means that an answer for any of the forwarded
    queries will be accepted and cached.
    An attacker can send a query multiple times, and for each
    repeat, another {port, ID} becomes capable of accepting the
    answer he is sending in the blind, to random IDs and ports.
    The chance of a succesful attack is therefore multiplied by the
    number of repeats of the query. The new behaviour detects
    repeated queries and merely stores the clients sending repeats
    so that when the first query completes, the answer can be sent
    to all the clients who asked. Refer: CVE-2020-25686.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Fix building with lua54</changelog>
  <changelog author="dmueller@suse.com" date="1612785600">- update to 2.84:
  * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH
  * Tidy initialisation in hash_questions.c
  * Optimise sort_rrset for the case where the RR type
  * Move fd into frec_src</changelog>
  <changelog author="max@suse.com" date="1618833600">- Update to 2.85:
  * Fix problem with DNS retries in 2.83/2.84.
  * Tweak sort order of tags in get-version.
  * Avoid treating a --dhcp-host which has an IPv6 address as
    eligible for use with DHCPv4 on the grounds that it has
    no address, and vice-versa.
  * Add --dynamic-host option: A and AAAA records which take their
    network part from the network of a local interface. Useful
    for routers with dynamically prefixes.
  * Teach --bogus-nxdomain and --ignore-address to take an IPv4
    subnet.
  * CVE-2021-3448, bsc#1183709: Use random source ports where
    possible if source addresses/interfaces in use.
  * Change the method of allocation of random source ports for DNS.
  * Scale the size of the DNS random-port pool based on the
    value of the --dns-forward-max configuration.
  * Tweak TFTP code to check sender of all received packets, as
    specified in RFC 1350 para 4.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers on TW</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400).</changelog>
  <changelog author="max@suse.com" date="1631880000">- Update to 2.86:
  * Handle DHCPREBIND requests in the DHCPv6 server code.
  * Fix bug which caused dnsmasq to lose track of processes forked
    to handle TCP DNS connections under heavy load.
  * Major rewrite of the DNS server and domain handling code. This
    should be largely transparent, but it drastically improves
    performance and reduces memory foot-print when configuring
    large numbers of domains.
  * Revise resource handling for number of concurrent DNS queries.
  * Improve efficiency of DNSSEC.
  * Connection track mark based DNS query filtering.
  * Allow smaller than 64 prefix lengths in synth-domain, with
    caveats.
  - -synth-domain=1234:4567::/56,example.com is now valid.
  * Make domains generated by --synth-domain appear in replies
    when in authoritative mode.
  * Ensure CAP_NET_ADMIN capability is available when conntrack
    is configured.
  * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are
    given a directory as argument, define the order in which files
    within that directory are read (alphabetical order of filename).</changelog>
  <changelog author="max@suse.com" date="1632398400">- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1.
- SLE bugs that got fixed upstream between 2.79 and 2.86, but for
  which we need to keep references when syncing:
  * bsc#1176076: dnsmasq-servfail.patch
  * bsc#1156543: dnsmasq-siocgstamp.patch
  * bsc#1138743: dnsmasq-cache-size.patch
  * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
  * bsc#1180914: Open inotify socket only when used.
  * removed dnsmasq-dnspooq.patch
- bsc#1173646, CVE-2020-14312: Set --local-service by default.</changelog>
</package>
<package pkgid="2ece11377956be3ac5a632186917dcdb207075e00665da1a541ffd273986dd78" name="dnsmasq" arch="x86_64">
  <version epoch="0" ver="2.86" rel="7.14.1"/>
  <changelog author="jengelh@inai.de" date="1540209600">- Ensure neutrality of descriptions. / Replace description with
  new upstream description.
- Do not hide failures from user/group additions.
- Replace old $RPM_* shell vars by macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1548244800">- libidn should not be used anymore, switch to libidn2</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560254400">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="jslaby@suse.com" date="1562760000">- add 0001-fix-build-after-y2038-changes-in-glibc.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1563883200">- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by
  firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1567598400">- Add Fix-build-with-libnettle-3.5.patch</changelog>
  <changelog author="max@suse.com" date="1573646400">- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
  memory leak in the create_helper() function in /src/helper.c
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
- Package contrib/lease-tools/dhcp_release6.
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .</changelog>
  <changelog author="dimstar@opensuse.org" date="1575115200">- Remove redundant %else without meaning (if/else/else/endif?)</changelog>
  <changelog author="info@paolostivanin.com" date="1588680000">- Update to 2.81:
  * Improve cache behaviour for TCP connections
  * Remove the NO_FORK compile-time option, and support for uclinux
  * Fix line-counting when reading /etc/hosts and friends
  * Fix bug in DNS non-terminal code, added in 2.80, which could
  sometimes cause a NODATA rather than an NXDOMAIN reply.
  * Support TCP-fastopen (RFC-7413) on both incoming and
  outgoing TCP connections, if supported and enabled in the OS.
  * Improve kernel-capability manipulation code under Linux
  * Add --shared-network config. This enables allocation of addresses
  by the DHCP server in subnets where the server (or relay) does not
  have an interface on the network in that subnet. Many thanks to
  kamp.de for sponsoring this feature.
  * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet
  validation check got borked in commit 2b38e382 and release 2.80.
  Thanks to Tomasz Szajner for spotting this.
  * Fix compilation against nettle version 3.5 and later.
  * Fix spurious DNSSEC validation failures when the auth section
  of a reply contains unsigned RRs from a signed zone,
  with the exception that NSEC and NSEC3 RRs must always be signed.
    Thanks to Tore Anderson for spotting and diagnosing the bug.
  * Add --dhcp-ignore-clid. This disables reading of DHCP client
  identifier option (option 61), so clients are only identified by
  MAC addresses.
  * Fix a bug which stopped --dhcp-name-match from working when a hostname
  is supplied in --dhcp-host. Thanks to James Feeney for spotting this.
  * Fix bug which caused very rarely caused zero-length DHCPv6 packets.
  Thanks to Dereck Higgins for spotting this.
  * Add --tftp-single-port option.
  * Enhance --conf-dir to load files in a deterministic order
  * Add filtering by tag of --dhcp-host directives
  * Remove DSA signature verification from DNSSEC, as specified in
  RFC 8624
  * Add --script-on-renewal option.
- Remove Fix-build-with-libnettle-3.5.patch
- Remove 0001-fix-build-after-y2038-changes-in-glibc.patch
- Remove dnsmasq-CVE-2019-14834.patch</changelog>
  <changelog author="mrey@suse.com" date="1595937600">- Update to 2.82:
  * Improve behaviour in the face of network interfaces which come
    and go and change index.
  * Convert hard startup failure on NETLINK_NO_ENOBUFS under
    qemu-user to a warning.
  * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in
  - -dhcp-option.
  * Fix crash under heavy TCP connection load introduced in 2.81.
  * Change default lease time for DHCPv6 to one day.
  * Alter calculation of preferred and valid times in router
    advertisements, so that these do not have a floor applied of
    the lease time in the dhcp-range if this is not explicitly
    specified and is merely the default.
- Reformat spec file with spec-cleaner</changelog>
  <changelog author="max@suse.com" date="1611057600">- Update to 2.83:
  * bsc#1177077: Fixed DNSpooq vulnerabilities
  * Use the values of --min-port and --max-port in outgoing
    TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code.
    Any dnsmasq with DNSSEC compiled in and enabled is vulnerable
    to this, referenced by CVE-2020-25681, CVE-2020-25682,
    CVE-2020-25683 CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address
    from which the query was originated. This keeps as much
    entropy in the {query-ID, random-port} tuple as possible, to
    help defeat cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers
    received are for the questions originally asked. This replaces
    the slightly insecure SHA-1 (when compiled with DNSSEC) or
    the very insecure CRC32 (otherwise). Refer: CVE-2020-25685
  * Handle multiple identical near simultaneous DNS queries better.
    Previously, such queries would all be forwarded independently.
    This is, in theory, inefficent but in practise not a problem,
    _except_ that is means that an answer for any of the forwarded
    queries will be accepted and cached.
    An attacker can send a query multiple times, and for each
    repeat, another {port, ID} becomes capable of accepting the
    answer he is sending in the blind, to random IDs and ports.
    The chance of a succesful attack is therefore multiplied by the
    number of repeats of the query. The new behaviour detects
    repeated queries and merely stores the clients sending repeats
    so that when the first query completes, the answer can be sent
    to all the clients who asked. Refer: CVE-2020-25686.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Fix building with lua54</changelog>
  <changelog author="dmueller@suse.com" date="1612785600">- update to 2.84:
  * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH
  * Tidy initialisation in hash_questions.c
  * Optimise sort_rrset for the case where the RR type
  * Move fd into frec_src</changelog>
  <changelog author="max@suse.com" date="1618833600">- Update to 2.85:
  * Fix problem with DNS retries in 2.83/2.84.
  * Tweak sort order of tags in get-version.
  * Avoid treating a --dhcp-host which has an IPv6 address as
    eligible for use with DHCPv4 on the grounds that it has
    no address, and vice-versa.
  * Add --dynamic-host option: A and AAAA records which take their
    network part from the network of a local interface. Useful
    for routers with dynamically prefixes.
  * Teach --bogus-nxdomain and --ignore-address to take an IPv4
    subnet.
  * CVE-2021-3448, bsc#1183709: Use random source ports where
    possible if source addresses/interfaces in use.
  * Change the method of allocation of random source ports for DNS.
  * Scale the size of the DNS random-port pool based on the
    value of the --dns-forward-max configuration.
  * Tweak TFTP code to check sender of all received packets, as
    specified in RFC 1350 para 4.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers on TW</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400).</changelog>
  <changelog author="max@suse.com" date="1631880000">- Update to 2.86:
  * Handle DHCPREBIND requests in the DHCPv6 server code.
  * Fix bug which caused dnsmasq to lose track of processes forked
    to handle TCP DNS connections under heavy load.
  * Major rewrite of the DNS server and domain handling code. This
    should be largely transparent, but it drastically improves
    performance and reduces memory foot-print when configuring
    large numbers of domains.
  * Revise resource handling for number of concurrent DNS queries.
  * Improve efficiency of DNSSEC.
  * Connection track mark based DNS query filtering.
  * Allow smaller than 64 prefix lengths in synth-domain, with
    caveats.
  - -synth-domain=1234:4567::/56,example.com is now valid.
  * Make domains generated by --synth-domain appear in replies
    when in authoritative mode.
  * Ensure CAP_NET_ADMIN capability is available when conntrack
    is configured.
  * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are
    given a directory as argument, define the order in which files
    within that directory are read (alphabetical order of filename).</changelog>
  <changelog author="max@suse.com" date="1632398400">- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1.
- SLE bugs that got fixed upstream between 2.79 and 2.86, but for
  which we need to keep references when syncing:
  * bsc#1176076: dnsmasq-servfail.patch
  * bsc#1156543: dnsmasq-siocgstamp.patch
  * bsc#1138743: dnsmasq-cache-size.patch
  * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
  * bsc#1180914: Open inotify socket only when used.
  * removed dnsmasq-dnspooq.patch
- bsc#1173646, CVE-2020-14312: Set --local-service by default.</changelog>
</package>
<package pkgid="9cb2edecd0311e3d360fd72e87eac4e22cc9091f06c02053dab645637c75e630" name="dnsmasq-utils" arch="aarch64">
  <version epoch="0" ver="2.86" rel="7.14.1"/>
  <changelog author="jengelh@inai.de" date="1540209600">- Ensure neutrality of descriptions. / Replace description with
  new upstream description.
- Do not hide failures from user/group additions.
- Replace old $RPM_* shell vars by macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1548244800">- libidn should not be used anymore, switch to libidn2</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560254400">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="jslaby@suse.com" date="1562760000">- add 0001-fix-build-after-y2038-changes-in-glibc.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1563883200">- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by
  firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1567598400">- Add Fix-build-with-libnettle-3.5.patch</changelog>
  <changelog author="max@suse.com" date="1573646400">- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
  memory leak in the create_helper() function in /src/helper.c
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
- Package contrib/lease-tools/dhcp_release6.
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .</changelog>
  <changelog author="dimstar@opensuse.org" date="1575115200">- Remove redundant %else without meaning (if/else/else/endif?)</changelog>
  <changelog author="info@paolostivanin.com" date="1588680000">- Update to 2.81:
  * Improve cache behaviour for TCP connections
  * Remove the NO_FORK compile-time option, and support for uclinux
  * Fix line-counting when reading /etc/hosts and friends
  * Fix bug in DNS non-terminal code, added in 2.80, which could
  sometimes cause a NODATA rather than an NXDOMAIN reply.
  * Support TCP-fastopen (RFC-7413) on both incoming and
  outgoing TCP connections, if supported and enabled in the OS.
  * Improve kernel-capability manipulation code under Linux
  * Add --shared-network config. This enables allocation of addresses
  by the DHCP server in subnets where the server (or relay) does not
  have an interface on the network in that subnet. Many thanks to
  kamp.de for sponsoring this feature.
  * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet
  validation check got borked in commit 2b38e382 and release 2.80.
  Thanks to Tomasz Szajner for spotting this.
  * Fix compilation against nettle version 3.5 and later.
  * Fix spurious DNSSEC validation failures when the auth section
  of a reply contains unsigned RRs from a signed zone,
  with the exception that NSEC and NSEC3 RRs must always be signed.
    Thanks to Tore Anderson for spotting and diagnosing the bug.
  * Add --dhcp-ignore-clid. This disables reading of DHCP client
  identifier option (option 61), so clients are only identified by
  MAC addresses.
  * Fix a bug which stopped --dhcp-name-match from working when a hostname
  is supplied in --dhcp-host. Thanks to James Feeney for spotting this.
  * Fix bug which caused very rarely caused zero-length DHCPv6 packets.
  Thanks to Dereck Higgins for spotting this.
  * Add --tftp-single-port option.
  * Enhance --conf-dir to load files in a deterministic order
  * Add filtering by tag of --dhcp-host directives
  * Remove DSA signature verification from DNSSEC, as specified in
  RFC 8624
  * Add --script-on-renewal option.
- Remove Fix-build-with-libnettle-3.5.patch
- Remove 0001-fix-build-after-y2038-changes-in-glibc.patch
- Remove dnsmasq-CVE-2019-14834.patch</changelog>
  <changelog author="mrey@suse.com" date="1595937600">- Update to 2.82:
  * Improve behaviour in the face of network interfaces which come
    and go and change index.
  * Convert hard startup failure on NETLINK_NO_ENOBUFS under
    qemu-user to a warning.
  * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in
  - -dhcp-option.
  * Fix crash under heavy TCP connection load introduced in 2.81.
  * Change default lease time for DHCPv6 to one day.
  * Alter calculation of preferred and valid times in router
    advertisements, so that these do not have a floor applied of
    the lease time in the dhcp-range if this is not explicitly
    specified and is merely the default.
- Reformat spec file with spec-cleaner</changelog>
  <changelog author="max@suse.com" date="1611057600">- Update to 2.83:
  * bsc#1177077: Fixed DNSpooq vulnerabilities
  * Use the values of --min-port and --max-port in outgoing
    TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code.
    Any dnsmasq with DNSSEC compiled in and enabled is vulnerable
    to this, referenced by CVE-2020-25681, CVE-2020-25682,
    CVE-2020-25683 CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address
    from which the query was originated. This keeps as much
    entropy in the {query-ID, random-port} tuple as possible, to
    help defeat cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers
    received are for the questions originally asked. This replaces
    the slightly insecure SHA-1 (when compiled with DNSSEC) or
    the very insecure CRC32 (otherwise). Refer: CVE-2020-25685
  * Handle multiple identical near simultaneous DNS queries better.
    Previously, such queries would all be forwarded independently.
    This is, in theory, inefficent but in practise not a problem,
    _except_ that is means that an answer for any of the forwarded
    queries will be accepted and cached.
    An attacker can send a query multiple times, and for each
    repeat, another {port, ID} becomes capable of accepting the
    answer he is sending in the blind, to random IDs and ports.
    The chance of a succesful attack is therefore multiplied by the
    number of repeats of the query. The new behaviour detects
    repeated queries and merely stores the clients sending repeats
    so that when the first query completes, the answer can be sent
    to all the clients who asked. Refer: CVE-2020-25686.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Fix building with lua54</changelog>
  <changelog author="dmueller@suse.com" date="1612785600">- update to 2.84:
  * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH
  * Tidy initialisation in hash_questions.c
  * Optimise sort_rrset for the case where the RR type
  * Move fd into frec_src</changelog>
  <changelog author="max@suse.com" date="1618833600">- Update to 2.85:
  * Fix problem with DNS retries in 2.83/2.84.
  * Tweak sort order of tags in get-version.
  * Avoid treating a --dhcp-host which has an IPv6 address as
    eligible for use with DHCPv4 on the grounds that it has
    no address, and vice-versa.
  * Add --dynamic-host option: A and AAAA records which take their
    network part from the network of a local interface. Useful
    for routers with dynamically prefixes.
  * Teach --bogus-nxdomain and --ignore-address to take an IPv4
    subnet.
  * CVE-2021-3448, bsc#1183709: Use random source ports where
    possible if source addresses/interfaces in use.
  * Change the method of allocation of random source ports for DNS.
  * Scale the size of the DNS random-port pool based on the
    value of the --dns-forward-max configuration.
  * Tweak TFTP code to check sender of all received packets, as
    specified in RFC 1350 para 4.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers on TW</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400).</changelog>
  <changelog author="max@suse.com" date="1631880000">- Update to 2.86:
  * Handle DHCPREBIND requests in the DHCPv6 server code.
  * Fix bug which caused dnsmasq to lose track of processes forked
    to handle TCP DNS connections under heavy load.
  * Major rewrite of the DNS server and domain handling code. This
    should be largely transparent, but it drastically improves
    performance and reduces memory foot-print when configuring
    large numbers of domains.
  * Revise resource handling for number of concurrent DNS queries.
  * Improve efficiency of DNSSEC.
  * Connection track mark based DNS query filtering.
  * Allow smaller than 64 prefix lengths in synth-domain, with
    caveats.
  - -synth-domain=1234:4567::/56,example.com is now valid.
  * Make domains generated by --synth-domain appear in replies
    when in authoritative mode.
  * Ensure CAP_NET_ADMIN capability is available when conntrack
    is configured.
  * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are
    given a directory as argument, define the order in which files
    within that directory are read (alphabetical order of filename).</changelog>
  <changelog author="max@suse.com" date="1632398400">- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1.
- SLE bugs that got fixed upstream between 2.79 and 2.86, but for
  which we need to keep references when syncing:
  * bsc#1176076: dnsmasq-servfail.patch
  * bsc#1156543: dnsmasq-siocgstamp.patch
  * bsc#1138743: dnsmasq-cache-size.patch
  * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
  * bsc#1180914: Open inotify socket only when used.
  * removed dnsmasq-dnspooq.patch
- bsc#1173646, CVE-2020-14312: Set --local-service by default.</changelog>
</package>
<package pkgid="d8584d289a73ad581a3a36135f0304c0dd4b28476b5fb1b4dbe6850060ec4103" name="dnsmasq-utils" arch="ppc64le">
  <version epoch="0" ver="2.86" rel="7.14.1"/>
  <changelog author="jengelh@inai.de" date="1540209600">- Ensure neutrality of descriptions. / Replace description with
  new upstream description.
- Do not hide failures from user/group additions.
- Replace old $RPM_* shell vars by macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1548244800">- libidn should not be used anymore, switch to libidn2</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560254400">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="jslaby@suse.com" date="1562760000">- add 0001-fix-build-after-y2038-changes-in-glibc.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1563883200">- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by
  firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1567598400">- Add Fix-build-with-libnettle-3.5.patch</changelog>
  <changelog author="max@suse.com" date="1573646400">- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
  memory leak in the create_helper() function in /src/helper.c
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
- Package contrib/lease-tools/dhcp_release6.
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .</changelog>
  <changelog author="dimstar@opensuse.org" date="1575115200">- Remove redundant %else without meaning (if/else/else/endif?)</changelog>
  <changelog author="info@paolostivanin.com" date="1588680000">- Update to 2.81:
  * Improve cache behaviour for TCP connections
  * Remove the NO_FORK compile-time option, and support for uclinux
  * Fix line-counting when reading /etc/hosts and friends
  * Fix bug in DNS non-terminal code, added in 2.80, which could
  sometimes cause a NODATA rather than an NXDOMAIN reply.
  * Support TCP-fastopen (RFC-7413) on both incoming and
  outgoing TCP connections, if supported and enabled in the OS.
  * Improve kernel-capability manipulation code under Linux
  * Add --shared-network config. This enables allocation of addresses
  by the DHCP server in subnets where the server (or relay) does not
  have an interface on the network in that subnet. Many thanks to
  kamp.de for sponsoring this feature.
  * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet
  validation check got borked in commit 2b38e382 and release 2.80.
  Thanks to Tomasz Szajner for spotting this.
  * Fix compilation against nettle version 3.5 and later.
  * Fix spurious DNSSEC validation failures when the auth section
  of a reply contains unsigned RRs from a signed zone,
  with the exception that NSEC and NSEC3 RRs must always be signed.
    Thanks to Tore Anderson for spotting and diagnosing the bug.
  * Add --dhcp-ignore-clid. This disables reading of DHCP client
  identifier option (option 61), so clients are only identified by
  MAC addresses.
  * Fix a bug which stopped --dhcp-name-match from working when a hostname
  is supplied in --dhcp-host. Thanks to James Feeney for spotting this.
  * Fix bug which caused very rarely caused zero-length DHCPv6 packets.
  Thanks to Dereck Higgins for spotting this.
  * Add --tftp-single-port option.
  * Enhance --conf-dir to load files in a deterministic order
  * Add filtering by tag of --dhcp-host directives
  * Remove DSA signature verification from DNSSEC, as specified in
  RFC 8624
  * Add --script-on-renewal option.
- Remove Fix-build-with-libnettle-3.5.patch
- Remove 0001-fix-build-after-y2038-changes-in-glibc.patch
- Remove dnsmasq-CVE-2019-14834.patch</changelog>
  <changelog author="mrey@suse.com" date="1595937600">- Update to 2.82:
  * Improve behaviour in the face of network interfaces which come
    and go and change index.
  * Convert hard startup failure on NETLINK_NO_ENOBUFS under
    qemu-user to a warning.
  * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in
  - -dhcp-option.
  * Fix crash under heavy TCP connection load introduced in 2.81.
  * Change default lease time for DHCPv6 to one day.
  * Alter calculation of preferred and valid times in router
    advertisements, so that these do not have a floor applied of
    the lease time in the dhcp-range if this is not explicitly
    specified and is merely the default.
- Reformat spec file with spec-cleaner</changelog>
  <changelog author="max@suse.com" date="1611057600">- Update to 2.83:
  * bsc#1177077: Fixed DNSpooq vulnerabilities
  * Use the values of --min-port and --max-port in outgoing
    TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code.
    Any dnsmasq with DNSSEC compiled in and enabled is vulnerable
    to this, referenced by CVE-2020-25681, CVE-2020-25682,
    CVE-2020-25683 CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address
    from which the query was originated. This keeps as much
    entropy in the {query-ID, random-port} tuple as possible, to
    help defeat cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers
    received are for the questions originally asked. This replaces
    the slightly insecure SHA-1 (when compiled with DNSSEC) or
    the very insecure CRC32 (otherwise). Refer: CVE-2020-25685
  * Handle multiple identical near simultaneous DNS queries better.
    Previously, such queries would all be forwarded independently.
    This is, in theory, inefficent but in practise not a problem,
    _except_ that is means that an answer for any of the forwarded
    queries will be accepted and cached.
    An attacker can send a query multiple times, and for each
    repeat, another {port, ID} becomes capable of accepting the
    answer he is sending in the blind, to random IDs and ports.
    The chance of a succesful attack is therefore multiplied by the
    number of repeats of the query. The new behaviour detects
    repeated queries and merely stores the clients sending repeats
    so that when the first query completes, the answer can be sent
    to all the clients who asked. Refer: CVE-2020-25686.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Fix building with lua54</changelog>
  <changelog author="dmueller@suse.com" date="1612785600">- update to 2.84:
  * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH
  * Tidy initialisation in hash_questions.c
  * Optimise sort_rrset for the case where the RR type
  * Move fd into frec_src</changelog>
  <changelog author="max@suse.com" date="1618833600">- Update to 2.85:
  * Fix problem with DNS retries in 2.83/2.84.
  * Tweak sort order of tags in get-version.
  * Avoid treating a --dhcp-host which has an IPv6 address as
    eligible for use with DHCPv4 on the grounds that it has
    no address, and vice-versa.
  * Add --dynamic-host option: A and AAAA records which take their
    network part from the network of a local interface. Useful
    for routers with dynamically prefixes.
  * Teach --bogus-nxdomain and --ignore-address to take an IPv4
    subnet.
  * CVE-2021-3448, bsc#1183709: Use random source ports where
    possible if source addresses/interfaces in use.
  * Change the method of allocation of random source ports for DNS.
  * Scale the size of the DNS random-port pool based on the
    value of the --dns-forward-max configuration.
  * Tweak TFTP code to check sender of all received packets, as
    specified in RFC 1350 para 4.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers on TW</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400).</changelog>
  <changelog author="max@suse.com" date="1631880000">- Update to 2.86:
  * Handle DHCPREBIND requests in the DHCPv6 server code.
  * Fix bug which caused dnsmasq to lose track of processes forked
    to handle TCP DNS connections under heavy load.
  * Major rewrite of the DNS server and domain handling code. This
    should be largely transparent, but it drastically improves
    performance and reduces memory foot-print when configuring
    large numbers of domains.
  * Revise resource handling for number of concurrent DNS queries.
  * Improve efficiency of DNSSEC.
  * Connection track mark based DNS query filtering.
  * Allow smaller than 64 prefix lengths in synth-domain, with
    caveats.
  - -synth-domain=1234:4567::/56,example.com is now valid.
  * Make domains generated by --synth-domain appear in replies
    when in authoritative mode.
  * Ensure CAP_NET_ADMIN capability is available when conntrack
    is configured.
  * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are
    given a directory as argument, define the order in which files
    within that directory are read (alphabetical order of filename).</changelog>
  <changelog author="max@suse.com" date="1632398400">- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1.
- SLE bugs that got fixed upstream between 2.79 and 2.86, but for
  which we need to keep references when syncing:
  * bsc#1176076: dnsmasq-servfail.patch
  * bsc#1156543: dnsmasq-siocgstamp.patch
  * bsc#1138743: dnsmasq-cache-size.patch
  * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
  * bsc#1180914: Open inotify socket only when used.
  * removed dnsmasq-dnspooq.patch
- bsc#1173646, CVE-2020-14312: Set --local-service by default.</changelog>
</package>
<package pkgid="f37c1d20ad996031a795308c2104bb4ed6af52a65eed0b3e3c71cd15197aeb2c" name="dnsmasq-utils" arch="s390x">
  <version epoch="0" ver="2.86" rel="7.14.1"/>
  <changelog author="jengelh@inai.de" date="1540209600">- Ensure neutrality of descriptions. / Replace description with
  new upstream description.
- Do not hide failures from user/group additions.
- Replace old $RPM_* shell vars by macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1548244800">- libidn should not be used anymore, switch to libidn2</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560254400">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="jslaby@suse.com" date="1562760000">- add 0001-fix-build-after-y2038-changes-in-glibc.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1563883200">- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by
  firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1567598400">- Add Fix-build-with-libnettle-3.5.patch</changelog>
  <changelog author="max@suse.com" date="1573646400">- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
  memory leak in the create_helper() function in /src/helper.c
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
- Package contrib/lease-tools/dhcp_release6.
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .</changelog>
  <changelog author="dimstar@opensuse.org" date="1575115200">- Remove redundant %else without meaning (if/else/else/endif?)</changelog>
  <changelog author="info@paolostivanin.com" date="1588680000">- Update to 2.81:
  * Improve cache behaviour for TCP connections
  * Remove the NO_FORK compile-time option, and support for uclinux
  * Fix line-counting when reading /etc/hosts and friends
  * Fix bug in DNS non-terminal code, added in 2.80, which could
  sometimes cause a NODATA rather than an NXDOMAIN reply.
  * Support TCP-fastopen (RFC-7413) on both incoming and
  outgoing TCP connections, if supported and enabled in the OS.
  * Improve kernel-capability manipulation code under Linux
  * Add --shared-network config. This enables allocation of addresses
  by the DHCP server in subnets where the server (or relay) does not
  have an interface on the network in that subnet. Many thanks to
  kamp.de for sponsoring this feature.
  * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet
  validation check got borked in commit 2b38e382 and release 2.80.
  Thanks to Tomasz Szajner for spotting this.
  * Fix compilation against nettle version 3.5 and later.
  * Fix spurious DNSSEC validation failures when the auth section
  of a reply contains unsigned RRs from a signed zone,
  with the exception that NSEC and NSEC3 RRs must always be signed.
    Thanks to Tore Anderson for spotting and diagnosing the bug.
  * Add --dhcp-ignore-clid. This disables reading of DHCP client
  identifier option (option 61), so clients are only identified by
  MAC addresses.
  * Fix a bug which stopped --dhcp-name-match from working when a hostname
  is supplied in --dhcp-host. Thanks to James Feeney for spotting this.
  * Fix bug which caused very rarely caused zero-length DHCPv6 packets.
  Thanks to Dereck Higgins for spotting this.
  * Add --tftp-single-port option.
  * Enhance --conf-dir to load files in a deterministic order
  * Add filtering by tag of --dhcp-host directives
  * Remove DSA signature verification from DNSSEC, as specified in
  RFC 8624
  * Add --script-on-renewal option.
- Remove Fix-build-with-libnettle-3.5.patch
- Remove 0001-fix-build-after-y2038-changes-in-glibc.patch
- Remove dnsmasq-CVE-2019-14834.patch</changelog>
  <changelog author="mrey@suse.com" date="1595937600">- Update to 2.82:
  * Improve behaviour in the face of network interfaces which come
    and go and change index.
  * Convert hard startup failure on NETLINK_NO_ENOBUFS under
    qemu-user to a warning.
  * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in
  - -dhcp-option.
  * Fix crash under heavy TCP connection load introduced in 2.81.
  * Change default lease time for DHCPv6 to one day.
  * Alter calculation of preferred and valid times in router
    advertisements, so that these do not have a floor applied of
    the lease time in the dhcp-range if this is not explicitly
    specified and is merely the default.
- Reformat spec file with spec-cleaner</changelog>
  <changelog author="max@suse.com" date="1611057600">- Update to 2.83:
  * bsc#1177077: Fixed DNSpooq vulnerabilities
  * Use the values of --min-port and --max-port in outgoing
    TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code.
    Any dnsmasq with DNSSEC compiled in and enabled is vulnerable
    to this, referenced by CVE-2020-25681, CVE-2020-25682,
    CVE-2020-25683 CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address
    from which the query was originated. This keeps as much
    entropy in the {query-ID, random-port} tuple as possible, to
    help defeat cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers
    received are for the questions originally asked. This replaces
    the slightly insecure SHA-1 (when compiled with DNSSEC) or
    the very insecure CRC32 (otherwise). Refer: CVE-2020-25685
  * Handle multiple identical near simultaneous DNS queries better.
    Previously, such queries would all be forwarded independently.
    This is, in theory, inefficent but in practise not a problem,
    _except_ that is means that an answer for any of the forwarded
    queries will be accepted and cached.
    An attacker can send a query multiple times, and for each
    repeat, another {port, ID} becomes capable of accepting the
    answer he is sending in the blind, to random IDs and ports.
    The chance of a succesful attack is therefore multiplied by the
    number of repeats of the query. The new behaviour detects
    repeated queries and merely stores the clients sending repeats
    so that when the first query completes, the answer can be sent
    to all the clients who asked. Refer: CVE-2020-25686.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Fix building with lua54</changelog>
  <changelog author="dmueller@suse.com" date="1612785600">- update to 2.84:
  * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH
  * Tidy initialisation in hash_questions.c
  * Optimise sort_rrset for the case where the RR type
  * Move fd into frec_src</changelog>
  <changelog author="max@suse.com" date="1618833600">- Update to 2.85:
  * Fix problem with DNS retries in 2.83/2.84.
  * Tweak sort order of tags in get-version.
  * Avoid treating a --dhcp-host which has an IPv6 address as
    eligible for use with DHCPv4 on the grounds that it has
    no address, and vice-versa.
  * Add --dynamic-host option: A and AAAA records which take their
    network part from the network of a local interface. Useful
    for routers with dynamically prefixes.
  * Teach --bogus-nxdomain and --ignore-address to take an IPv4
    subnet.
  * CVE-2021-3448, bsc#1183709: Use random source ports where
    possible if source addresses/interfaces in use.
  * Change the method of allocation of random source ports for DNS.
  * Scale the size of the DNS random-port pool based on the
    value of the --dns-forward-max configuration.
  * Tweak TFTP code to check sender of all received packets, as
    specified in RFC 1350 para 4.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers on TW</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400).</changelog>
  <changelog author="max@suse.com" date="1631880000">- Update to 2.86:
  * Handle DHCPREBIND requests in the DHCPv6 server code.
  * Fix bug which caused dnsmasq to lose track of processes forked
    to handle TCP DNS connections under heavy load.
  * Major rewrite of the DNS server and domain handling code. This
    should be largely transparent, but it drastically improves
    performance and reduces memory foot-print when configuring
    large numbers of domains.
  * Revise resource handling for number of concurrent DNS queries.
  * Improve efficiency of DNSSEC.
  * Connection track mark based DNS query filtering.
  * Allow smaller than 64 prefix lengths in synth-domain, with
    caveats.
  - -synth-domain=1234:4567::/56,example.com is now valid.
  * Make domains generated by --synth-domain appear in replies
    when in authoritative mode.
  * Ensure CAP_NET_ADMIN capability is available when conntrack
    is configured.
  * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are
    given a directory as argument, define the order in which files
    within that directory are read (alphabetical order of filename).</changelog>
  <changelog author="max@suse.com" date="1632398400">- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1.
- SLE bugs that got fixed upstream between 2.79 and 2.86, but for
  which we need to keep references when syncing:
  * bsc#1176076: dnsmasq-servfail.patch
  * bsc#1156543: dnsmasq-siocgstamp.patch
  * bsc#1138743: dnsmasq-cache-size.patch
  * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
  * bsc#1180914: Open inotify socket only when used.
  * removed dnsmasq-dnspooq.patch
- bsc#1173646, CVE-2020-14312: Set --local-service by default.</changelog>
</package>
<package pkgid="c5d0383d5db2d0c9f9b7b5a2ad83a949f47536f9b8568f8458d3ed38b2ce75e7" name="dnsmasq-utils" arch="x86_64">
  <version epoch="0" ver="2.86" rel="7.14.1"/>
  <changelog author="jengelh@inai.de" date="1540209600">- Ensure neutrality of descriptions. / Replace description with
  new upstream description.
- Do not hide failures from user/group additions.
- Replace old $RPM_* shell vars by macros.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1548244800">- libidn should not be used anymore, switch to libidn2</changelog>
  <changelog author="fbui@suse.com" date="1550836800">- Drop use of $FIRST_ARG in .spec
  The use of $FIRST_ARG was probably required because of the
  %service_* rpm macros were playing tricks with the shell positional
  parameters. This is bad practice and error prones so let's assume
  that no macros should do that anymore and hence it's safe to assume
  that positional parameters remains unchanged after any rpm macro
  call.</changelog>
  <changelog author="dimstar@opensuse.org" date="1560254400">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut the build queues by allowing usage of systemd-mini</changelog>
  <changelog author="jslaby@suse.com" date="1562760000">- add 0001-fix-build-after-y2038-changes-in-glibc.patch</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1563883200">- removal of SuSEfirewall2 service, since SuSEfirewall2 has been replaced by
  firewalld, see [1].
  [1]: https://lists.opensuse.org/opensuse-factory/2019-01/msg00490.html</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1567598400">- Add Fix-build-with-libnettle-3.5.patch</changelog>
  <changelog author="max@suse.com" date="1573646400">- bsc#1154849, CVE-2019-14834, dnsmasq-CVE-2019-14834.patch:
  memory leak in the create_helper() function in /src/helper.c
- bsc#1143454: Require user(tftp) instead of creating it ourselves.
- Package contrib/lease-tools/dhcp_release6.
- bsc#1152539: include config files from /etc/dnsmasq.d/*.conf .</changelog>
  <changelog author="dimstar@opensuse.org" date="1575115200">- Remove redundant %else without meaning (if/else/else/endif?)</changelog>
  <changelog author="info@paolostivanin.com" date="1588680000">- Update to 2.81:
  * Improve cache behaviour for TCP connections
  * Remove the NO_FORK compile-time option, and support for uclinux
  * Fix line-counting when reading /etc/hosts and friends
  * Fix bug in DNS non-terminal code, added in 2.80, which could
  sometimes cause a NODATA rather than an NXDOMAIN reply.
  * Support TCP-fastopen (RFC-7413) on both incoming and
  outgoing TCP connections, if supported and enabled in the OS.
  * Improve kernel-capability manipulation code under Linux
  * Add --shared-network config. This enables allocation of addresses
  by the DHCP server in subnets where the server (or relay) does not
  have an interface on the network in that subnet. Many thanks to
  kamp.de for sponsoring this feature.
  * Fix broken contrib/lease_tools/dhcp_lease_time.c. A packet
  validation check got borked in commit 2b38e382 and release 2.80.
  Thanks to Tomasz Szajner for spotting this.
  * Fix compilation against nettle version 3.5 and later.
  * Fix spurious DNSSEC validation failures when the auth section
  of a reply contains unsigned RRs from a signed zone,
  with the exception that NSEC and NSEC3 RRs must always be signed.
    Thanks to Tore Anderson for spotting and diagnosing the bug.
  * Add --dhcp-ignore-clid. This disables reading of DHCP client
  identifier option (option 61), so clients are only identified by
  MAC addresses.
  * Fix a bug which stopped --dhcp-name-match from working when a hostname
  is supplied in --dhcp-host. Thanks to James Feeney for spotting this.
  * Fix bug which caused very rarely caused zero-length DHCPv6 packets.
  Thanks to Dereck Higgins for spotting this.
  * Add --tftp-single-port option.
  * Enhance --conf-dir to load files in a deterministic order
  * Add filtering by tag of --dhcp-host directives
  * Remove DSA signature verification from DNSSEC, as specified in
  RFC 8624
  * Add --script-on-renewal option.
- Remove Fix-build-with-libnettle-3.5.patch
- Remove 0001-fix-build-after-y2038-changes-in-glibc.patch
- Remove dnsmasq-CVE-2019-14834.patch</changelog>
  <changelog author="mrey@suse.com" date="1595937600">- Update to 2.82:
  * Improve behaviour in the face of network interfaces which come
    and go and change index.
  * Convert hard startup failure on NETLINK_NO_ENOBUFS under
    qemu-user to a warning.
  * Allow IPv6 addresses ofthe form [::ffff:1.2.3.4] in
  - -dhcp-option.
  * Fix crash under heavy TCP connection load introduced in 2.81.
  * Change default lease time for DHCPv6 to one day.
  * Alter calculation of preferred and valid times in router
    advertisements, so that these do not have a floor applied of
    the lease time in the dhcp-range if this is not explicitly
    specified and is merely the default.
- Reformat spec file with spec-cleaner</changelog>
  <changelog author="max@suse.com" date="1611057600">- Update to 2.83:
  * bsc#1177077: Fixed DNSpooq vulnerabilities
  * Use the values of --min-port and --max-port in outgoing
    TCP connections to upstream DNS servers.
  * Fix a remote buffer overflow problem in the DNSSEC code.
    Any dnsmasq with DNSSEC compiled in and enabled is vulnerable
    to this, referenced by CVE-2020-25681, CVE-2020-25682,
    CVE-2020-25683 CVE-2020-25687.
  * Be sure to only accept UDP DNS query replies at the address
    from which the query was originated. This keeps as much
    entropy in the {query-ID, random-port} tuple as possible, to
    help defeat cache poisoning attacks. Refer: CVE-2020-25684.
  * Use the SHA-256 hash function to verify that DNS answers
    received are for the questions originally asked. This replaces
    the slightly insecure SHA-1 (when compiled with DNSSEC) or
    the very insecure CRC32 (otherwise). Refer: CVE-2020-25685
  * Handle multiple identical near simultaneous DNS queries better.
    Previously, such queries would all be forwarded independently.
    This is, in theory, inefficent but in practise not a problem,
    _except_ that is means that an answer for any of the forwarded
    queries will be accepted and cached.
    An attacker can send a query multiple times, and for each
    repeat, another {port, ID} becomes capable of accepting the
    answer he is sending in the blind, to random IDs and ports.
    The chance of a succesful attack is therefore multiplied by the
    number of repeats of the query. The new behaviour detects
    repeated queries and merely stores the clients sending repeats
    so that when the first query completes, the answer can be sent
    to all the clients who asked. Refer: CVE-2020-25686.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1611748800">- Fix building with lua54</changelog>
  <changelog author="dmueller@suse.com" date="1612785600">- update to 2.84:
  * Change HAVE_NETTLEHASH compile-time to HAVE_CRYPTOHASH
  * Tidy initialisation in hash_questions.c
  * Optimise sort_rrset for the case where the RR type
  * Move fd into frec_src</changelog>
  <changelog author="max@suse.com" date="1618833600">- Update to 2.85:
  * Fix problem with DNS retries in 2.83/2.84.
  * Tweak sort order of tags in get-version.
  * Avoid treating a --dhcp-host which has an IPv6 address as
    eligible for use with DHCPv4 on the grounds that it has
    no address, and vice-versa.
  * Add --dynamic-host option: A and AAAA records which take their
    network part from the network of a local interface. Useful
    for routers with dynamically prefixes.
  * Teach --bogus-nxdomain and --ignore-address to take an IPv4
    subnet.
  * CVE-2021-3448, bsc#1183709: Use random source ports where
    possible if source addresses/interfaces in use.
  * Change the method of allocation of random source ports for DNS.
  * Scale the size of the DNS random-port pool based on the
    value of the --dns-forward-max configuration.
  * Tweak TFTP code to check sender of all received packets, as
    specified in RFC 1350 para 4.</changelog>
  <changelog author="gmbr3@opensuse.org" date="1622635200">- Change to using systemd-sysusers on TW</changelog>
  <changelog author="gmbr3@opensuse.org" date="1623585600">- Add now working CONFIG parameter to sysusers generator</changelog>
  <changelog author="jsegitz@suse.com" date="1631620800">- Added hardening to systemd service(s) (bsc#1181400).</changelog>
  <changelog author="max@suse.com" date="1631880000">- Update to 2.86:
  * Handle DHCPREBIND requests in the DHCPv6 server code.
  * Fix bug which caused dnsmasq to lose track of processes forked
    to handle TCP DNS connections under heavy load.
  * Major rewrite of the DNS server and domain handling code. This
    should be largely transparent, but it drastically improves
    performance and reduces memory foot-print when configuring
    large numbers of domains.
  * Revise resource handling for number of concurrent DNS queries.
  * Improve efficiency of DNSSEC.
  * Connection track mark based DNS query filtering.
  * Allow smaller than 64 prefix lengths in synth-domain, with
    caveats.
  - -synth-domain=1234:4567::/56,example.com is now valid.
  * Make domains generated by --synth-domain appear in replies
    when in authoritative mode.
  * Ensure CAP_NET_ADMIN capability is available when conntrack
    is configured.
  * When --dhcp-hostsfile --dhcp-optsfile and --addn-hosts are
    given a directory as argument, define the order in which files
    within that directory are read (alphabetical order of filename).</changelog>
  <changelog author="max@suse.com" date="1632398400">- jsc#SLE-17936: Sync this state from Factory to SLE-15-SP1.
- SLE bugs that got fixed upstream between 2.79 and 2.86, but for
  which we need to keep references when syncing:
  * bsc#1176076: dnsmasq-servfail.patch
  * bsc#1156543: dnsmasq-siocgstamp.patch
  * bsc#1138743: dnsmasq-cache-size.patch
  * bsc#1076958: CVE-2017-15107, dnsmasq-CVE-2017-15107.patch
  * bsc#1180914: Open inotify socket only when used.
  * removed dnsmasq-dnspooq.patch
- bsc#1173646, CVE-2020-14312: Set --local-service by default.</changelog>
</package>
<package pkgid="f3dbfce3064a49900c0b0c9c75213c69b1166127f9161bed0a8bbaaed75eabd4" name="docker" arch="aarch64">
  <version epoch="0" ver="20.10.6_ce" rel="153.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="e21720d1c7a36b3d7a2e3cdd6bf04de741dd1ee5de6963b305833e9bd54c561c" name="docker" arch="ppc64le">
  <version epoch="0" ver="20.10.6_ce" rel="153.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="197050629c88ca49a3085f6ac8ff39b48bfbb59d7d872c86648c7e04f5c9ad73" name="docker" arch="s390x">
  <version epoch="0" ver="20.10.6_ce" rel="153.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="a2a829e7e9d4c13d8c6fb3a03dacd4bec5c39f24ae72dc26157a46c2703d7c99" name="docker" arch="src">
  <version epoch="0" ver="20.10.6_ce" rel="153.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="bcd26054700f99303f8e8d9c0b0d47863a3383fde87b98f8e9c37748caa4bd60" name="docker" arch="x86_64">
  <version epoch="0" ver="20.10.6_ce" rel="153.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="e96d648332988d3887a957cd127e9265bb8230a911bfd15856e955610038a08e" name="docker" arch="aarch64">
  <version epoch="0" ver="20.10.6_ce" rel="6.49.3"/>
  <changelog author="asarai@suse.com" date="1576152000">- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
</package>
<package pkgid="3c9db42c97a19ebd7814ff5a56eb6daf0cd34b295f8d2c54fdafb485784c7b95" name="docker" arch="ppc64le">
  <version epoch="0" ver="20.10.6_ce" rel="6.49.3"/>
  <changelog author="asarai@suse.com" date="1576152000">- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
</package>
<package pkgid="6a81330b3075e6499952c5ee34fa1c012785a7e31bd9cc966d06396ca316ffc7" name="docker" arch="s390x">
  <version epoch="0" ver="20.10.6_ce" rel="6.49.3"/>
  <changelog author="asarai@suse.com" date="1576152000">- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
</package>
<package pkgid="056e4cbf6219af718291ac8f5298eba90fbc8b7d7a285a4957a42aaf6a86493a" name="docker" arch="src">
  <version epoch="0" ver="20.10.6_ce" rel="6.49.3"/>
  <changelog author="asarai@suse.com" date="1576152000">- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
</package>
<package pkgid="5381a7c9853b06c2f546ebb3edb96711cd9a98012b81d20e48f8035ef37c55f0" name="docker" arch="x86_64">
  <version epoch="0" ver="20.10.6_ce" rel="6.49.3"/>
  <changelog author="asarai@suse.com" date="1576152000">- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
</package>
<package pkgid="f2a033c28521a8cfd723ad41424a1302c35f97c5d9a7d70e449a6e1d93b0ffd9" name="docker" arch="aarch64">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="65a2109f457e69958f7ba553fe674dcbd44798c4e0424f3b7091eec4f6a7b5a6" name="docker" arch="ppc64le">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="20e44f40a39679d37d06c5657782d60f654e31147d7b9f85c3866c1bb21cceeb" name="docker" arch="s390x">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="6383765ee6d54c9199441364ad43722fc1818630e6e01059f4ecd0e79211d771" name="docker" arch="src">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="c657b4acd53a6dc181bea7d6cedf0e95b424373cebfdb50cd1007a4245a1b94f" name="docker" arch="x86_64">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="9f9b0a835fc549de8aa2382457a93edd7ca72eb56b7c10a95f87e4a49be3cb05" name="docker-bash-completion" arch="noarch">
  <version epoch="0" ver="20.10.6_ce" rel="153.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="ec9a91a217bc263b99137544c79963795cb0123fe52c1574d5b8f933c4990ee1" name="docker-bash-completion" arch="noarch">
  <version epoch="0" ver="20.10.6_ce" rel="6.49.3"/>
  <changelog author="asarai@suse.com" date="1576152000">- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
</package>
<package pkgid="4316e9c1c678db0c5b0b0d525d7c88177ac9c9fc9b32187d5b948da359e3c91a" name="docker-bash-completion" arch="noarch">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="70673ab1754588390748621529d86eff291b5ba62aba64039c1450bb3fa25fab" name="docker-fish-completion" arch="noarch">
  <version epoch="0" ver="20.10.6_ce" rel="153.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="86af3cf3af7a6f54563000f5e72cfbf2a63b44d24f2404b80de8f41a2646c824" name="docker-fish-completion" arch="noarch">
  <version epoch="0" ver="20.10.6_ce" rel="6.49.3"/>
  <changelog author="asarai@suse.com" date="1576152000">- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
</package>
<package pkgid="86ed06fe5f0f7445071603ea50bbb09117dc9e8981b1352e55f5840889f95d34" name="docker-fish-completion" arch="noarch">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="dc83679bcf5f75ec748f84af23fbe4a58d4ef898a28f7a5ec3ab7d6f00296ffe" name="docker-kubic" arch="aarch64">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="e941944354d6cc166b08811678d4d88c76e3eb8e26d09b241abf4591f5ae81a0" name="docker-kubic" arch="ppc64le">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="b14ab12318fc035156be0c7524f89394e4634f97880a3dfa04894cb98a5c4aab" name="docker-kubic" arch="s390x">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="191e346a7aafa03b1ef34a4f18698ca5a2299079dd7de6660af57a6d27c34b67" name="docker-kubic" arch="src">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="c5da12638dc25804f414c5adab7971fdcd10991af0168ae4942f064e11da4bd5" name="docker-kubic" arch="x86_64">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="bd5860f312f502ff761383e40449883b8cee5bd99511371dbb94dee7e3a6fe01" name="docker-kubic" arch="aarch64">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="66c8138b6d1fae1102242521b3d216e0befe7e407ef70bcdcccc39ab0bc0f653" name="docker-kubic" arch="ppc64le">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="88c8cb9da26ffadd285d016716c1a445c01cb249f8c7a16493e1fcb8f1e9a39c" name="docker-kubic" arch="s390x">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="a34f9f1f960307ff086aa4aa7d5d0b232bf3117669414466a6358317c0125c67" name="docker-kubic" arch="src">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="81cefc0c02425bc6f6cf1c1992bdb53e552ff7816cd95f12afb55f977f179027" name="docker-kubic" arch="x86_64">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="95016bd8ee8bc6111da0ab7c0602a007a7d679cdaeca35033b1087873940b0ea" name="docker-kubic-bash-completion" arch="noarch">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="258e1b29585630f38bf974d27854110bdb9f4d7e140bb16e47e17ee2c50a5a5e" name="docker-kubic-bash-completion" arch="noarch">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="8f8810c9044c5c43f70213682a67037aee7b91304028488b16f38bd9e274ab49" name="docker-kubic-fish-completion" arch="noarch">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="413a3ba1b759ab7044a7eefbe69bb23e112da34c22c9c307d87904e84927e6f6" name="docker-kubic-fish-completion" arch="noarch">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="5969101229b54565ea21a78023655bc377232d2f566c001f8e2d9c4d25db7d66" name="docker-kubic-kubeadm-criconfig" arch="aarch64">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="ff1a8ee260eeb83bcf2ba0d53d947992872a4957495bbbc2d9e8f9f608225a47" name="docker-kubic-kubeadm-criconfig" arch="ppc64le">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="c8b3ea92b01a924b4f58566c170a566d434b8d9fe9b77422f50542f585d078ba" name="docker-kubic-kubeadm-criconfig" arch="s390x">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="5042bc933403b94d6ff99d6ad23870de53b213fa5d31cc3c7f3be2cd1c16f30a" name="docker-kubic-kubeadm-criconfig" arch="x86_64">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="2a13906146d481a661be9bbc653cc1897048e849e9c3c208f9f1cec1098f1e0c" name="docker-kubic-kubeadm-criconfig" arch="aarch64">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="b1aaf3de1d1c352318ea264268025030d8aca5e02cc9c4e060d28cc7ba99a41d" name="docker-kubic-kubeadm-criconfig" arch="ppc64le">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="46020953eb86d3260da4116a8bd9c4b6aee994640969adf8d0242c1fdc698228" name="docker-kubic-kubeadm-criconfig" arch="s390x">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="b4536e803bb938b5587c64f84e6df479bf248c7c9c63aedf98ffea8028de3c40" name="docker-kubic-kubeadm-criconfig" arch="x86_64">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="a9ac11139023a415bc7b2508870ac41f1e41fe1144104af98f0a9afe6f44500d" name="docker-kubic-zsh-completion" arch="noarch">
  <version epoch="0" ver="20.10.6_ce" rel="6.52.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="c2ef6384cc988c24a69183e3e899b07a8d14f04ca34a76fac22197fbd8f1b4a1" name="docker-kubic-zsh-completion" arch="noarch">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="836c5eb7b60e98135d3968b88a886c54f992b336dd939a6c404a0f3d6ee98898" name="docker-zsh-completion" arch="noarch">
  <version epoch="0" ver="20.10.6_ce" rel="153.1"/>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
</package>
<package pkgid="351a536abd6f48aa6e67af408f6c740e3988ebb4f7d9348d07dd7a6e506bdf77" name="docker-zsh-completion" arch="noarch">
  <version epoch="0" ver="20.10.6_ce" rel="6.49.3"/>
  <changelog author="asarai@suse.com" date="1576152000">- Add backport of https://github.com/docker/docker/pull/39121. bsc#1122469
  + bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1576756800">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  Allow OBS to shortcut through the -mini flavors.</changelog>
  <changelog author="asarai@suse.com" date="1591099200">- Update to Docker 19.03.11-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1172377 CVE-2020-13401
- Backport https://github.com/gotestyourself/gotest.tools/pull/169 so that we
  can build Docker with Go 1.14 (upstream uses Go 1.13).
  + bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch</changelog>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
</package>
<package pkgid="d272e6deb0d069467e14b8af54a9ce652516fc1cedd70694d0a45736a4a48297" name="docker-zsh-completion" arch="noarch">
  <version epoch="0" ver="20.10.9_ce" rel="156.1"/>
  <changelog author="asarai@suse.com" date="1593086400">- Update to Docker 19.03.12-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md.
- Use Go 1.13 instead of Go 1.14 because Go 1.14 can cause all sorts of
  spurrious errors due to Go returning -EINTR from I/O syscalls much more often
  (due to Go 1.14's pre-emptive goroutine support).
  - bsc1172377-0001-unexport-testcase.Cleanup-to-fix-Go-1.14.patch
- Add BuildRequires for all -git dependencies so that we catch missing
  dependencies much more quickly.</changelog>
  <changelog author="dimstar@opensuse.org" date="1593518400">- Emergency fix: %requires_eq does not work with provide symbols,
  only effective package names. Convert back to regular Requires.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1596456000">- Fixes for %_libexecdir changing to /usr/libexec (bsc#1174075)</changelog>
  <changelog author="asarai@suse.com" date="1600430400">- Update to Docker 19.03.13-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1176708</changelog>
  <changelog author="mrostecki@suse.com" date="1605182400">- Add a patch which makes Docker compatible with firewalld with
  nftables backend. Backport of https://github.com/moby/libnetwork/pull/2548
  (boo#1178801, SLE-16460)
  * boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="rombert@apache.org" date="1607947200">- Enable fish-completion</changelog>
  <changelog author="asarai@suse.com" date="1608552000">- Update to Docker 19.03.14-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. CVE-2020-15257 bsc#1180243
  https://github.com/docker/docker-ce/releases/tag/v19.03.14</changelog>
  <changelog author="asarai@suse.com" date="1608724800">- Add Conflicts and Provides for kubic flavour of docker-fish-completion.</changelog>
  <changelog author="asarai@suse.com" date="1611921600">- Re-apply secrets fix for bsc#1065609 which appears to have been lost after it
  was fixed.
  * secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  * secrets-0002-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1611921601">- Update to Docker 20.10.2-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1181594
- Remove upstreamed patches:
  - bsc1122469-0001-apparmor-allow-readby-and-tracedby.patch
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch
- Add patches to fix build:
  + cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Since upstream has changed their source repo (again) we have to rebase all of
  our patches. While doing this, I've collapsed all patches into one branch
  per-release and thus all the patches are now just one series:
  - packaging-0001-revert-Remove-docker-prefix-for-containerd-and-runc-.patch
  + 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch
  - secrets-0001-daemon-allow-directory-creation-in-run-secrets.patch
  + 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - secrets-0002-SUSE-implement-SUSE-container-secrets.patch
  + 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - private-registry-0001-Add-private-registry-mirror-support.patch
  + 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
  + 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267200">- Drop docker-runc, docker-test and docker-libnetwork packages. We now just use
  the upstream runc package (it's stable enough and Docker no longer pins git
  versions). docker-libnetwork is so unstable that it doesn't have any
  versioning scheme and so it really doesn't make sense to maintain the project
  as a separate package. bsc#1181641 bsc#1181677
- Remove no-longer-needed patch for packaging now that we've dropped
  docker-runc and docker-libnetwork.
  - 0001-PACKAGING-revert-Remove-docker-prefix-for-containerd.patch</changelog>
  <changelog author="asarai@suse.com" date="1612267201">- Update to Docker 20.10.3-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. Fixes bsc#1181732
  (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches on top of 20.10.3-ce.
  - 0002-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  + 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  - 0003-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  + 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  - 0004-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  + 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  - 0005-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  + 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch</changelog>
  <changelog author="asarai@suse.com" date="1612612800">[NOTE: This update was only ever released in SLES and Leap.]
- Update Docker to 19.03.15-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for
  bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285).
- Rebase patches:
  * bsc1073877-0001-apparmor-clobber-docker-default-profile-on-start.patch
- Only apply the boo#1178801 libnetwork patch to handle firewalld on openSUSE.
  It appears that SLES doesn't like the patch. bsc#1180401</changelog>
  <changelog author="asarai@suse.com" date="1612958400">- Fix incorrect cast in SUSE secrets patches causing warnings on SLES.
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch</changelog>
  <changelog author="asarai@suse.com" date="1613304000">[NOTE: This update was only ever released in SLES and Leap.]
- It turns out the boo#1178801 libnetwork patch is also broken on Leap, so drop
  the patch entirely. bsc#1180401 bsc#1182168
  - boo1178801-0001-Add-docker-interfaces-to-firewalld-docker-zone.patch</changelog>
  <changelog author="asarai@suse.com" date="1614772800">- Update to Docker 20.10.5-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1182947
- Update runc dependency to 1.0.0~rc93.
- Remove upstreamed patches:
  - cli-0001-Rename-bin-md2man-to-bin-go-md2man.patch
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Switch version to use -ce suffix rather than _ce to avoid confusing other
  tools. boo#1182476</changelog>
  <changelog author="asarai@suse.com" date="1618488000">- Update to Docker 20.10.6-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1184768
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Backport upstream fix &lt;https://github.com/moby/moby/pull/42273&gt; for btrfs
  quotas being removed by Docker regularly. bsc#1183855 bsc#1175081
  + 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch</changelog>
  <changelog author="asarai@suse.com" date="1620043200">- Add shell requires for the *-completion subpackages.</changelog>
  <changelog author="asarai@suse.com" date="1632139200">- Add patch to return ENOSYS for clone3 to avoid breaking glibc again.
  bsc#1190670
  + 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch</changelog>
  <changelog author="asarai@suse.com" date="1633521600">- Update to Docker 20.10.9-ce. See upstream changelog in the packaged
  /usr/share/doc/packages/docker/CHANGELOG.md. bsc#1191355
  CVE-2021-41092 CVE-2021-41089 CVE-2021-41091 CVE-2021-41103
- Rebase patches:
  * 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
  * 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
  * 0003-PRIVATE-REGISTRY-add-private-registry-mirror-support.patch
  * 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
  * 0005-bsc1183855-btrfs-Do-not-disable-quota-on-cleanup.patch
  * 0006-bsc1190670-seccomp-add-support-for-clone3-syscall-in.patch
- Switch to Go 1.16.x compiler, in line with upstream.</changelog>
</package>
<package pkgid="1ed74719437fdf53b8ddbaeae038fb7d39d187652227f1bde1bf4121ffc62733" name="dosfstools" arch="aarch64">
  <version epoch="0" ver="4.1" rel="3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1394107200">- updated to 3.0.25:
  * Prevent corruption of FAT during fsck on 64 bit platforms.
    unsigned long is 64 bit on x86-64, which means set_fat was writing two
    entries, which corrupts the next entry. This can cause loss of data in
    another file.
  * Fixed remaining 64 bit build warnings.</changelog>
  <changelog author="pgajdos@suse.com" date="1395057600">- updated to 3.0.26:
  * Fix "odd" files created by frequent power-loss.</changelog>
  <changelog author="pgajdos@suse.com" date="1403784000">- added fsck.{v,}fat and mkfs.{v,}fat compat symlinks in /sbin
  [bnc#884516]
- call spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1411473600">- Drop gpg-offline build-time requirement; this is now handled by
  the local source validator</changelog>
  <changelog author="pgajdos@suse.com" date="1421409600">- updated to 3.0.27:
  * fsck.fat: Don't print version string every time -v is
    encountered
  * Fix attempt to rename root dir in fsck due to uninitialized
    fields
  * Support long file names in volume labeling code
- upstream changed</changelog>
  <changelog author="pgajdos@suse.com" date="1431345600">- fix url</changelog>
  <changelog author="mpluskal@suse.com" date="1433332800">- Update to 3.0.28
  * mkfs.fat now allows choosing 0xF0 as the media byte which was
    previously rejected.
  * mkfs.fat now supports the --invariant option to facilitate
    testing mkfs.fat itself.
  * Bugs fixed in fsck.fat are a read one byte beyond the end of
    an allocated array when checking some FAT12 filesystems, and
    checking that the first cluster of a file as specified in the
    directory entry is not 1.
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1462622400">- Update to 4.0
  * Switch build system to autotools.
  * Fixed data corruption errors in fsck.fat Writing to the third
    to last cluster on FAT12 with an odd number of clusters would
    corrupt the following cluster.
  * The automatic alignment of data clusters that was added in
    3.0.8 and broken for FAT32 starting with 3.0.20 has been
    reinstated.
- Small spec file cleanup
- Drop no longer needed dosfstools-suse-dirs.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1485432000">- Update to version 4.1:
  * Now the default for mkfs for filesystems smaller than 512 MB is
    64 / 32 sectors
  * The parsing of octal character specifications for filenames in
    the -u and -d 25 options of fsck now works.
  * Fixed a possible fatlabel crash when writing a label to an
    unlabelled filesystem
  * Testsuite is now available</changelog>
  <changelog author="mcepl@suse.com" date="1622030400">- Add fix-calculation.patch (gh#dosfstools/dosfstools#153, bsc#1172863)
  to work with different size of clusters.</changelog>
</package>
<package pkgid="2e32873126afb438a33553555078fc4363d0bad5fcf5468f439d0c3e6417d2e1" name="dosfstools" arch="ppc64le">
  <version epoch="0" ver="4.1" rel="3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1394107200">- updated to 3.0.25:
  * Prevent corruption of FAT during fsck on 64 bit platforms.
    unsigned long is 64 bit on x86-64, which means set_fat was writing two
    entries, which corrupts the next entry. This can cause loss of data in
    another file.
  * Fixed remaining 64 bit build warnings.</changelog>
  <changelog author="pgajdos@suse.com" date="1395057600">- updated to 3.0.26:
  * Fix "odd" files created by frequent power-loss.</changelog>
  <changelog author="pgajdos@suse.com" date="1403784000">- added fsck.{v,}fat and mkfs.{v,}fat compat symlinks in /sbin
  [bnc#884516]
- call spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1411473600">- Drop gpg-offline build-time requirement; this is now handled by
  the local source validator</changelog>
  <changelog author="pgajdos@suse.com" date="1421409600">- updated to 3.0.27:
  * fsck.fat: Don't print version string every time -v is
    encountered
  * Fix attempt to rename root dir in fsck due to uninitialized
    fields
  * Support long file names in volume labeling code
- upstream changed</changelog>
  <changelog author="pgajdos@suse.com" date="1431345600">- fix url</changelog>
  <changelog author="mpluskal@suse.com" date="1433332800">- Update to 3.0.28
  * mkfs.fat now allows choosing 0xF0 as the media byte which was
    previously rejected.
  * mkfs.fat now supports the --invariant option to facilitate
    testing mkfs.fat itself.
  * Bugs fixed in fsck.fat are a read one byte beyond the end of
    an allocated array when checking some FAT12 filesystems, and
    checking that the first cluster of a file as specified in the
    directory entry is not 1.
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1462622400">- Update to 4.0
  * Switch build system to autotools.
  * Fixed data corruption errors in fsck.fat Writing to the third
    to last cluster on FAT12 with an odd number of clusters would
    corrupt the following cluster.
  * The automatic alignment of data clusters that was added in
    3.0.8 and broken for FAT32 starting with 3.0.20 has been
    reinstated.
- Small spec file cleanup
- Drop no longer needed dosfstools-suse-dirs.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1485432000">- Update to version 4.1:
  * Now the default for mkfs for filesystems smaller than 512 MB is
    64 / 32 sectors
  * The parsing of octal character specifications for filenames in
    the -u and -d 25 options of fsck now works.
  * Fixed a possible fatlabel crash when writing a label to an
    unlabelled filesystem
  * Testsuite is now available</changelog>
  <changelog author="mcepl@suse.com" date="1622030400">- Add fix-calculation.patch (gh#dosfstools/dosfstools#153, bsc#1172863)
  to work with different size of clusters.</changelog>
</package>
<package pkgid="ef1f5e1bf4f129054d72d30267e4ca0c0117d76730f12623c1d4f51ba3428430" name="dosfstools" arch="s390x">
  <version epoch="0" ver="4.1" rel="3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1394107200">- updated to 3.0.25:
  * Prevent corruption of FAT during fsck on 64 bit platforms.
    unsigned long is 64 bit on x86-64, which means set_fat was writing two
    entries, which corrupts the next entry. This can cause loss of data in
    another file.
  * Fixed remaining 64 bit build warnings.</changelog>
  <changelog author="pgajdos@suse.com" date="1395057600">- updated to 3.0.26:
  * Fix "odd" files created by frequent power-loss.</changelog>
  <changelog author="pgajdos@suse.com" date="1403784000">- added fsck.{v,}fat and mkfs.{v,}fat compat symlinks in /sbin
  [bnc#884516]
- call spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1411473600">- Drop gpg-offline build-time requirement; this is now handled by
  the local source validator</changelog>
  <changelog author="pgajdos@suse.com" date="1421409600">- updated to 3.0.27:
  * fsck.fat: Don't print version string every time -v is
    encountered
  * Fix attempt to rename root dir in fsck due to uninitialized
    fields
  * Support long file names in volume labeling code
- upstream changed</changelog>
  <changelog author="pgajdos@suse.com" date="1431345600">- fix url</changelog>
  <changelog author="mpluskal@suse.com" date="1433332800">- Update to 3.0.28
  * mkfs.fat now allows choosing 0xF0 as the media byte which was
    previously rejected.
  * mkfs.fat now supports the --invariant option to facilitate
    testing mkfs.fat itself.
  * Bugs fixed in fsck.fat are a read one byte beyond the end of
    an allocated array when checking some FAT12 filesystems, and
    checking that the first cluster of a file as specified in the
    directory entry is not 1.
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1462622400">- Update to 4.0
  * Switch build system to autotools.
  * Fixed data corruption errors in fsck.fat Writing to the third
    to last cluster on FAT12 with an odd number of clusters would
    corrupt the following cluster.
  * The automatic alignment of data clusters that was added in
    3.0.8 and broken for FAT32 starting with 3.0.20 has been
    reinstated.
- Small spec file cleanup
- Drop no longer needed dosfstools-suse-dirs.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1485432000">- Update to version 4.1:
  * Now the default for mkfs for filesystems smaller than 512 MB is
    64 / 32 sectors
  * The parsing of octal character specifications for filenames in
    the -u and -d 25 options of fsck now works.
  * Fixed a possible fatlabel crash when writing a label to an
    unlabelled filesystem
  * Testsuite is now available</changelog>
  <changelog author="mcepl@suse.com" date="1622030400">- Add fix-calculation.patch (gh#dosfstools/dosfstools#153, bsc#1172863)
  to work with different size of clusters.</changelog>
</package>
<package pkgid="f07c40edefebccea7d0d31f8dbd13a4b18bc7a27315f2fc8e20e39d3c100447a" name="dosfstools" arch="src">
  <version epoch="0" ver="4.1" rel="3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1362398400">- update to 3.0.16: label fixes
  * dropped upstreamed
  - dosfstools-create-rootdir-label.patch
  - dosfstools-dosfslabel-forbid-lowercase.patch
  - dosfstools-dosfslabel-from-rootdir.patch
  - dosfstools-fsck-file-name.patch
  - dosfstools-mkdosfs-no-label.patch
  - dosfstools-mkdosfs-uppercase-label.patch</changelog>
  <changelog author="mmeister@suse.com" date="1364212800">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="pgajdos@suse.com" date="1370260800">- update to 3.0.17:
  * Fixing segfault in dosfslabel.
  * Allow operation on SH4 CPUs.
  * Finish cleanup of byteswap code.
  * Fix offsetof definition.
  * etc., see ChangeLog
- refreshed ppc-reserved-sectors-fix.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1370952000">- update to 3.0.18:
  * Adding initial i18n support for manpages with po4a.
  * Renaming tools to sane namespace and keeping legacy symlinks in place.
    | dosfslabel becomes fatlabel,
    | dosfsck becomes fsck.fat,
    | and mkdosfs becomes mkfs.fat.
  * Correcting spelling typo in boot.c.
  * dosfslabel: Do not read beyond string length (Closes: #709587).
- refreshed both dosfstools-suse-dirs.patch and
  ppc-reserved-sectors-fix.patch
- added dosfstools-system_id-overflow.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1371038400">- update to 3.0.19:
  * This release fixes  a  segfault with fortify.
- removed dosfstools-system_id-overflow.patch</changelog>
  <changelog author="jengelh@inai.de" date="1371124800">- Update to new upstream release 3.0.20
  * This release updates default sectors per cluster for FAT32.
- Remove ppc-reserved-sectors-fix.patch (implemented upstream)
  (use -a switch to disable aligning structures)
- Signature verification; more robust make install call</changelog>
  <changelog author="pgajdos@suse.com" date="1374062400">- updated to 3.0.21
  * Minor miscellaneous cleanups.</changelog>
  <changelog author="pgajdos@suse.com" date="1375099200">- updated to 3.0.22:
  * Improved boot compatiblity.</changelog>
  <changelog author="pgajdos@suse.com" date="1381924800">- updated to 3.0.23:
  * Corrects clustersize to fix issues with EFI System Partitions.</changelog>
  <changelog author="pgajdos@suse.com" date="1385380800">- updated to 3.0.24:
  * Fixed dosfsck on big endian platforms.</changelog>
  <changelog author="pgajdos@suse.com" date="1394107200">- updated to 3.0.25:
  * Prevent corruption of FAT during fsck on 64 bit platforms.
    unsigned long is 64 bit on x86-64, which means set_fat was writing two
    entries, which corrupts the next entry. This can cause loss of data in
    another file.
  * Fixed remaining 64 bit build warnings.</changelog>
  <changelog author="pgajdos@suse.com" date="1395057600">- updated to 3.0.26:
  * Fix "odd" files created by frequent power-loss.</changelog>
  <changelog author="pgajdos@suse.com" date="1403784000">- added fsck.{v,}fat and mkfs.{v,}fat compat symlinks in /sbin
  [bnc#884516]
- call spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1411473600">- Drop gpg-offline build-time requirement; this is now handled by
  the local source validator</changelog>
  <changelog author="pgajdos@suse.com" date="1421409600">- updated to 3.0.27:
  * fsck.fat: Don't print version string every time -v is
    encountered
  * Fix attempt to rename root dir in fsck due to uninitialized
    fields
  * Support long file names in volume labeling code
- upstream changed</changelog>
  <changelog author="pgajdos@suse.com" date="1431345600">- fix url</changelog>
  <changelog author="mpluskal@suse.com" date="1433332800">- Update to 3.0.28
  * mkfs.fat now allows choosing 0xF0 as the media byte which was
    previously rejected.
  * mkfs.fat now supports the --invariant option to facilitate
    testing mkfs.fat itself.
  * Bugs fixed in fsck.fat are a read one byte beyond the end of
    an allocated array when checking some FAT12 filesystems, and
    checking that the first cluster of a file as specified in the
    directory entry is not 1.
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1462622400">- Update to 4.0
  * Switch build system to autotools.
  * Fixed data corruption errors in fsck.fat Writing to the third
    to last cluster on FAT12 with an odd number of clusters would
    corrupt the following cluster.
  * The automatic alignment of data clusters that was added in
    3.0.8 and broken for FAT32 starting with 3.0.20 has been
    reinstated.
- Small spec file cleanup
- Drop no longer needed dosfstools-suse-dirs.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1485432000">- Update to version 4.1:
  * Now the default for mkfs for filesystems smaller than 512 MB is
    64 / 32 sectors
  * The parsing of octal character specifications for filenames in
    the -u and -d 25 options of fsck now works.
  * Fixed a possible fatlabel crash when writing a label to an
    unlabelled filesystem
  * Testsuite is now available</changelog>
  <changelog author="mcepl@suse.com" date="1622030400">- Add fix-calculation.patch (gh#dosfstools/dosfstools#153, bsc#1172863)
  to work with different size of clusters.</changelog>
</package>
<package pkgid="e238be44a9ff73bdced2e3f0033258c6adc52f3e5a2b48e6226a02631db53850" name="dosfstools" arch="x86_64">
  <version epoch="0" ver="4.1" rel="3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1394107200">- updated to 3.0.25:
  * Prevent corruption of FAT during fsck on 64 bit platforms.
    unsigned long is 64 bit on x86-64, which means set_fat was writing two
    entries, which corrupts the next entry. This can cause loss of data in
    another file.
  * Fixed remaining 64 bit build warnings.</changelog>
  <changelog author="pgajdos@suse.com" date="1395057600">- updated to 3.0.26:
  * Fix "odd" files created by frequent power-loss.</changelog>
  <changelog author="pgajdos@suse.com" date="1403784000">- added fsck.{v,}fat and mkfs.{v,}fat compat symlinks in /sbin
  [bnc#884516]
- call spec-cleaner</changelog>
  <changelog author="jengelh@inai.de" date="1411473600">- Drop gpg-offline build-time requirement; this is now handled by
  the local source validator</changelog>
  <changelog author="pgajdos@suse.com" date="1421409600">- updated to 3.0.27:
  * fsck.fat: Don't print version string every time -v is
    encountered
  * Fix attempt to rename root dir in fsck due to uninitialized
    fields
  * Support long file names in volume labeling code
- upstream changed</changelog>
  <changelog author="pgajdos@suse.com" date="1431345600">- fix url</changelog>
  <changelog author="mpluskal@suse.com" date="1433332800">- Update to 3.0.28
  * mkfs.fat now allows choosing 0xF0 as the media byte which was
    previously rejected.
  * mkfs.fat now supports the --invariant option to facilitate
    testing mkfs.fat itself.
  * Bugs fixed in fsck.fat are a read one byte beyond the end of
    an allocated array when checking some FAT12 filesystems, and
    checking that the first cluster of a file as specified in the
    directory entry is not 1.
- Cleanup spec file with spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1462622400">- Update to 4.0
  * Switch build system to autotools.
  * Fixed data corruption errors in fsck.fat Writing to the third
    to last cluster on FAT12 with an odd number of clusters would
    corrupt the following cluster.
  * The automatic alignment of data clusters that was added in
    3.0.8 and broken for FAT32 starting with 3.0.20 has been
    reinstated.
- Small spec file cleanup
- Drop no longer needed dosfstools-suse-dirs.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1485432000">- Update to version 4.1:
  * Now the default for mkfs for filesystems smaller than 512 MB is
    64 / 32 sectors
  * The parsing of octal character specifications for filenames in
    the -u and -d 25 options of fsck now works.
  * Fixed a possible fatlabel crash when writing a label to an
    unlabelled filesystem
  * Testsuite is now available</changelog>
  <changelog author="mcepl@suse.com" date="1622030400">- Add fix-calculation.patch (gh#dosfstools/dosfstools#153, bsc#1172863)
  to work with different size of clusters.</changelog>
</package>
<package pkgid="697da7c2076f198ea750f27a8b6d065604a5c361b220b44cd4a79873e9729680" name="dovecot23" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="94ff12812ae1ee24a7e84b9edfe9ca2578b175aa9cf227bc3f949a0da69ef645" name="dovecot23" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="08cee15a7828315047cdd7c8bf725378913441f261d08ba6d9dd63e02bf80b30" name="dovecot23" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="5ce87da6e1974698cf77724da72c3037b43e5f104c55787c9ef29293994bf0eb" name="dovecot23" arch="src">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="2e3202128046f00465d27d380515b258e39030bcf2cbb5d73c307f612e0fb7ad" name="dovecot23" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="a5aa54e5a8e4883447b7795490e928a1ddc79f1f4f7419ec155da291a8668fcc" name="dovecot23" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="f06a30b72fe737634b73fb40ea2b0f14f1f81901afdc518fa4943dd57df5613d" name="dovecot23" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="db27bddfd085edf15d24542c7a935e348befe9c41566451b10c3331a09ea6895" name="dovecot23" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="b56beaf4ece194c1ea1bfa106201d5012234f4244ef4efd660e20d63cab98cf2" name="dovecot23" arch="src">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="b7d153cd9784a2449d4e7b05c523f62a1e51a967ef418b9214cab608178f26f8" name="dovecot23" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="c82b6d546bbba0fb88c1ac8733c88b83dd29080a78b0d5f04462b1ad62ac106a" name="dovecot23" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="09b2d817bbcb3b3d421166200f7cdaa92eb24b1a64a0348adf4f92893564380d" name="dovecot23" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="4bd8a36922c4b9eaeaffd17607f4e584fb440a3f5c57ad3623cef37e5bbe6d21" name="dovecot23" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="4ddeda2af44ce5306761b9dab13a7cfd53129775da5988a9230ec6a45bd583b6" name="dovecot23" arch="src">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="0b032d734e95f30c9335761cdd0ba396831c1ffebed28fe78deda270177c1904" name="dovecot23" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="0a6167f760e5b47b28c8f16be12b09469ac1bddaadbfad4a3dab255ee659b3f3" name="dovecot23-backend-mysql" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="99b5d2b1d495e1aaa122c0b6ac0976add68e0d94f2118d0313241873b4665cd3" name="dovecot23-backend-mysql" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="dc8862434bce19e7de9cdbdf8e5993f8560d6835033195b85c959f1859a0a179" name="dovecot23-backend-mysql" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="d09fd86d495d2e5e9b6139931c25ab6ae2b5d056f74d3d3faa8f7ffc766cc1ca" name="dovecot23-backend-mysql" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="1aa3cba9e9287991bc3878dc5605f43d8ab4ab768e8f291b7a0a1f42db651753" name="dovecot23-backend-mysql" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="4afcc2788a0dae803983858d1b5e30775985f5a2757f8b9446ecbbdfbc4c8a41" name="dovecot23-backend-mysql" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="76f2069ea893d0cc4ef5e8c94c798ab6c11eacaa50e1fb77efa39216282fc71c" name="dovecot23-backend-mysql" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="b4f6ebf238b6387bd1b7ca42dea336c3d39fff43d393ac2b435894c8506d52c8" name="dovecot23-backend-mysql" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="d2438051e3d937199e036ea98da9981452a3c4ee6a5ee4b80507b3400979477d" name="dovecot23-backend-mysql" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="5ed2498edab2adcd4b144773d0871e7deaed6abc07cde9207f2bcc04cc0fe1c0" name="dovecot23-backend-mysql" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="6e4fbee535ff4962990b8073bb476133007c741db658e14a88d17d0c14590454" name="dovecot23-backend-mysql" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="7c7d4fb8ad5178a175ab256ac2fee1e844240d933abe758f74c7e7080586a4a5" name="dovecot23-backend-mysql" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="cd7b5839483f0076cad2d542283b97b3544e4acf43e8978bed14014be42e2e4a" name="dovecot23-backend-pgsql" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="cfd07d789e82e9196dd99f0b5323339fef1c23592552a9390c2bec0338ea37f0" name="dovecot23-backend-pgsql" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="5edbd48a1fc0389fbf3f1a152f4d7eee6d87a4fcfb1a4d94469e556bf68a3b20" name="dovecot23-backend-pgsql" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="2688c009540f45c559d5d3e40906d64268aeecce0dcb7b62d7765a4c96983d25" name="dovecot23-backend-pgsql" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="566e557933ad266fab043d5c361181109487a6344a4bc8117867682807a16e52" name="dovecot23-backend-pgsql" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="89d8b9fd25a227e4709f65168895e6873720f15e3b5b614e5609682e89bc6bca" name="dovecot23-backend-pgsql" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="6eac15a15aeed8e782a8ef79e70c49d4a28d739e47e7ab7471d0e5d60e6e195e" name="dovecot23-backend-pgsql" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="122d646b347f7ef32f745d58c424ec5a48fe8d4261cbc2a6225ee483a794843b" name="dovecot23-backend-pgsql" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="424d17d7b250c9ec83179bf1220a8bedae13ba030f3a4562c5bb21b73c93c905" name="dovecot23-backend-pgsql" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="c455b0350d314d1daca482e56b3db92f3af69cab8949c9359357aafe294bcdbe" name="dovecot23-backend-pgsql" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="c1e92765f4c93f2b48d580da6ba0d3ab3b2f7c5647a37ec27c933490a6736cd6" name="dovecot23-backend-pgsql" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="a7b93de988dcc78460bca19af417831a9d0527c48086a6a14ca6f8bb3328a860" name="dovecot23-backend-pgsql" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="608b4a118f977d9ae809f520f8c9179f1e1528e1bde478cb5a0f68dba5768c39" name="dovecot23-backend-sqlite" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="c04219e6a89a42a45b417d18a18676b77c64f285ce3cf6703fe42887917eed98" name="dovecot23-backend-sqlite" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="95c35a430388098c7f73dbee219cbc50abe67c32b0c3d7c0a4ff4fb960270249" name="dovecot23-backend-sqlite" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="aadd3a570c59d6e721ae53f93f4b68b80012a59dfeeb732ba5ba72f0196556fb" name="dovecot23-backend-sqlite" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="dc38eaf0410239e325d51b230e70bf53b4fff059e61b7ed0782a2a8a92f71f65" name="dovecot23-backend-sqlite" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="b09a1e2c2cf57fbcd8d00304fc19c3bbb11e6eea608ca4d7138faa21fe87b05a" name="dovecot23-backend-sqlite" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="d34fc939cf8121e223daf0c7d0feef71e24300fe0f582abf57801ace7f630550" name="dovecot23-backend-sqlite" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="ddddcf50f73f42651a5ff978a21edc828c555442e38d65ff95889c56121a4bad" name="dovecot23-backend-sqlite" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="7e0df30caa375323b4418c204ae4d4c8e8a84bae8b2ae3665ff339c20af7ca73" name="dovecot23-backend-sqlite" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="09652867973f57a1b838eba13ff4691c76d088b5fa2144629bc40229400c48f5" name="dovecot23-backend-sqlite" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="ab03a14f550de92a7bee692ce61fa8a82a4f36e0637e60d1f765c360f4648553" name="dovecot23-backend-sqlite" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="2d4a176a74731ad84636a834a28e7a597f0603774d23776e6d7d11090678a13b" name="dovecot23-backend-sqlite" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="0df7d80343ffbc73bb28cb6f7f1424c7ecbd07649fdb313745c5b06dd0a81228" name="dovecot23-devel" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="e60a5a2a1fb22d5c088fe9acd32395f27eb53083719707e6de0dd53bf98c2116" name="dovecot23-devel" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="65514464fdd32e818f7a832987e6592fb6dd91bece6d8223b80cbca2c5bbca63" name="dovecot23-devel" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="24bc1acd8b433b59192b5986290ccf232b13ec666f7e9d097e296479361b7208" name="dovecot23-devel" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="b34f746124b364cb29886e77148a45379048bd24ee9be865f89568b124b94a25" name="dovecot23-devel" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="46f42807364755ff805186ef6bab1d5381c7a53d89fb8d0dd194758afa57a34b" name="dovecot23-devel" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="e8d10483eca937322ca3c4ed438e4cf5252c76567cb1cbd20e115243f0a6f288" name="dovecot23-devel" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="38a387423313dfdc14fc4f627c04991643b8b52725b3fa589b5e72ccc2068a81" name="dovecot23-devel" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="eca20225a14d970d53e34814ce0c778928ec0b27f1f105e1ce0f9b6f51ed8542" name="dovecot23-devel" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="a64da7fc39ed0bdc77a9bd2b2499ecfe7cd9d8022310f650788179c005dbe74e" name="dovecot23-devel" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="b7c97d054dc9bb39a6401fbf827f06dee046721b50b828681035710c2d4cade3" name="dovecot23-devel" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="3bef71331c9ee1225ec3aae9cb953fffe6151038f11eba75119e99ad5df5ca27" name="dovecot23-devel" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="bfff6afd18acf1f649b834859a6af685cd888c20b99da407825f51b66bec6c4a" name="dovecot23-fts" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="edc499a0f9146d1e21614c2341fa98ddc0d0b0f4746aa2fe2bb8b82c1b099d10" name="dovecot23-fts" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="c58c4944d6427d2835714a8d299f3b79f8baa82a319c4850c64ecda13760e9b4" name="dovecot23-fts" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="da8b41fa11500b4c06a36a935662f6ad3c9b53bc908adc6194ebf3f04c60e2ec" name="dovecot23-fts" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="2879b03dfd1ce18a9108b1e3a8bd71099f0370ed9e2ef3b661a8cdd8147a3528" name="dovecot23-fts" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="651e06bb14f6c6090ef8a7e85d898663ce9b59fad68b56083205456c705fa31e" name="dovecot23-fts" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="ff6b1cb0cfce74265dd62bc51b3325d8abfc15b6143e4b40dd0d2f5472969431" name="dovecot23-fts" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="7b5c270a4f5b8518d1ac46f7cacb8db74b623354997c80afed6964a24ca3b5a6" name="dovecot23-fts" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="035dbadd0a5e9eb93efbc8a05aee2d492e7e5eb572a9c27ea44499a3f5fcf548" name="dovecot23-fts" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="99d53bedfa41ed0fc8b0f4b5042ae33bf39d2776d761db7dba526fd4b3b334e8" name="dovecot23-fts" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="02f608c8387dacc58d9146a09508e2157af7a229cb0ae70d19ff45a598663960" name="dovecot23-fts" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="5955e64fbc855865911fdf5105b42d1b302fe18dc2d9dcf8aa496d16701c028d" name="dovecot23-fts" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="c53e8613b6e5d7cf8d41d0ed1b22d82a6f1064b4263e55f3ea397a5b44fb3123" name="dovecot23-fts-lucene" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="7d07eb65161b0894088e2f7117174c9494f9759b28057ce6f69f0245270de1ce" name="dovecot23-fts-lucene" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="bccc10b9cb2ae02cc152955980b4c2346b06b01e7eca22a72123b3a1745e8238" name="dovecot23-fts-lucene" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="7b789d4a83be33ad4268ca9778bdd83845b4788a400dee3ccb1f7bd8d200f002" name="dovecot23-fts-lucene" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="ae8ef447cf9e5a646211923126beec6f925fd62e4bdd5ffe66e1425c28895c60" name="dovecot23-fts-lucene" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="393f2736379761c3d4d547c4ec0e486c7951b129d65b1e65381262cfb6edddb3" name="dovecot23-fts-lucene" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="8798dfdd80beb04f395baa652a8e24cf2fef87c2285aa644674f4332cc1dad19" name="dovecot23-fts-lucene" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="3909d1b380583b99efdda005a0b08fa3bded9f6b323446ded525ecf0d985cce6" name="dovecot23-fts-lucene" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="e0e3d60b5daa37573a9f56356d471dd9ceba883c21d6cf0ca9acfa56241533c4" name="dovecot23-fts-lucene" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="92c0c25307c2f1a0d424b06f15826a96bf529db7673c34f3eedcaa066d5b2e6b" name="dovecot23-fts-lucene" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="0d9a93f2fcea71148e18cc5f7103fb8e5af54adb8a1f87fc4c9a6e8ec026ece2" name="dovecot23-fts-lucene" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="c4806939f7d916b37b3eaa9505a7e58e60e2d178a47fa72b57f782e80896b7c3" name="dovecot23-fts-lucene" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="492b1957da94be85535713da9cfebea184281d564723cb4df7f7c9c3f42507e7" name="dovecot23-fts-solr" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="58cfcadc658df9407cc5f43c9f500cacadd163c29ad60f9d320afa90a4a9545f" name="dovecot23-fts-solr" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="c4a2bf4ebc333f2b2e4fbffb63c2de85368e3cbc71a7b36259530314a9ec770e" name="dovecot23-fts-solr" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="0136fc1ba98d020212cd6a69cea3466322a6a8e983ccd4e5f33df98aed017569" name="dovecot23-fts-solr" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="0205c18cc15be37556a36444708921de36f0cbb6aee092dcdcbb33ef02eec37a" name="dovecot23-fts-solr" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="e9dfb2af301dde03e6bd1d58e6e4280d7c70cadee806b6377102ddf49486e35f" name="dovecot23-fts-solr" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="7aae21279a75629925f376895b35dac7d099c737a56602e588807c7b2840baa5" name="dovecot23-fts-solr" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="ead740fdeb2fa84b53f1e723b7e83f6e852f1af000ca07063bbed9b437e37527" name="dovecot23-fts-solr" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="67c655e64af332f40f274f6ce2ce0ab8a7b1bb764784f5db6226b995e378bcca" name="dovecot23-fts-solr" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="ab4987e412fdee0392135ed06a465a6c42bb5d2fb1eee7187a5fa4aa28406ea5" name="dovecot23-fts-solr" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="872fcb69fed024fb18b31d0cb5d5f3ad12c7b4067c5d8914b48ca7be31616c1a" name="dovecot23-fts-solr" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="6bb129ab349c4daf84818394070a56c60c81fa4bbad5a5cfa0d654c4d85e7199" name="dovecot23-fts-solr" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="d6bbfc56d45c56a46a133c1a69aa911713de318e665c1bb150813c929593a5e1" name="dovecot23-fts-squat" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="147cd32c851a15405ea0cd1ac148ea84faec3b3a01535ee75679886b8e03c29c" name="dovecot23-fts-squat" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="e261793bcbbf0a8d1372f0f0996cc9afe1f88804916243f9142e79eccfbff66f" name="dovecot23-fts-squat" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="a8a5b64c992b91f4fb104f31eb3fd157bc1dc8b3dc8aba56c59c73f90746d53d" name="dovecot23-fts-squat" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="52.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update to 2.3.0.1
  * CVE-2017-15130: TLS SNI config lookups may lead to excessive
    memory usage, causing imap-login/pop3-login VSZ limit to be
    reached and the process restarted. This happens only if Dovecot
    config has local_name { } or local { } configuration blocks and
    attacker uses randomly generated SNI servernames. (boo#1082828)
  * CVE-2017-14461: Parsing invalid email addresses may cause a
    crash or leak memory contents to attacker. For example, these
    memory contents might contain parts of an email from another
    user if the same imap process is reused for multiple users.
    First discovered by Aleksandar Nikolic of Cisco Talos.
    Independently also discovered by "flxflndy" via HackerOne.
    (boo#1082826)
  * CVE-2017-15132: Aborted SASL authentication leaks memory in
    login process. (boo#1075608)
  * Linux: Core dumping is no longer enabled by default via
    PR_SET_DUMPABLE, because this may allow attackers to bypass
    chroot/group restrictions. Found by cPanel Security Team.
    Nowadays core dumps can be safely enabled by using "sysctl -w
    fs.suid_dumpable=2". If the old behaviour is wanted, it can
    still be enabled by setting:
    import_environment=$import_environment PR_SET_DUMPABLE=1
  - imap-login with SSL/TLS connections may end up in infinite loop</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337602">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
</package>
<package pkgid="6424ade650020e0425cbe47a286919f1efa13c27a8803cc64c0e92df0722550e" name="dovecot23-fts-squat" arch="aarch64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="c6c63a06ad2411db9b6705cd898f34ccf945ab96d6fbe423531e0ad1aec07d71" name="dovecot23-fts-squat" arch="ppc64le">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="8c987f5477ac18c2d28d46d2206a91178528d3fc20adb96a4b797f7c161548ab" name="dovecot23-fts-squat" arch="s390x">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="0a162d5245bdf838256864c5cc23fa150cbfe345306f532b6951bb8f680187a0" name="dovecot23-fts-squat" arch="x86_64">
  <version epoch="0" ver="2.3.11.3" rel="55.1"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- pull backport patch dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520337601">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="5fb04737e0c097506a04e7294cfa45fbb4d5ddc19bbbc0e4c530aaa15f610dab" name="dovecot23-fts-squat" arch="aarch64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="d5e6a952ec6ee68ea07056578f36fef43639822d79e5f48cb43f237f57baad15" name="dovecot23-fts-squat" arch="ppc64le">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="d6d716db964c632334012e00b4c829874ea3f2078647a0969af198a6bfdde876" name="dovecot23-fts-squat" arch="s390x">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="03426e8bc0b148943366d9481414b218eaa676ec763741b94ea54b50a5680892" name="dovecot23-fts-squat" arch="x86_64">
  <version epoch="0" ver="2.3.15" rel="58.3"/>
  <changelog author="mrueckert@suse.de" date="1520337600">- update pigeonhole to 0.5.0.1
  - imap4flags extension: Fix binary corruption occurring when
    setflag/addflag/removeflag flag-list is a variable.
  - sieve-extprograms plugin: Fix segfault occurring when used in
    IMAPSieve context.
- drop 321a39be974deb2e7eff7b2a509a3ee6ff2e5ae1.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1520424000">- update license to SPDX-3</changelog>
  <changelog author="mrueckert@suse.de" date="1520424001">- added 23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch</changelog>
  <changelog author="dimstar@opensuse.org" date="1520942400">- Fix License tag.</changelog>
  <changelog author="mrueckert@suse.de" date="1522152000">- update to 2.3.1
  * Submission server support improvements and bug fixes
  - Lots of bug fixes to submission server
  * API CHANGE: array_idx_modifiable will no longer allocate space
  - Particularly affects how you should check MODULE_CONTEXT
    result, or use REQUIRE_MODULE_CONTEXT.
  + mail_attachment_detection_options setting controls when
    $HasAttachment and $HasNoAttachment keywords are set for mails.
  + imap: Support fetching body snippets using FETCH (SNIPPET) or
    (SNIPPET (LAZY=FUZZY))
  + fs-compress: Automatically detect whether input is compressed
    or not.  Prefix the compression algorithm with "maybe-" to
    enable the detection, for example: "compress:maybe-gz:6:..."
  + Added settings to change dovecot.index* files' optimization
    behavior.  See https://wiki2.dovecot.org/IndexFiles#Settings
  + Auth cache can now utilize auth workers to do password hash
    verification by setting
    auth_cache_verify_password_with_worker=yes.
  + Added charset_alias plugin. See
    https://wiki2.dovecot.org/Plugins/CharsetAlias
  + imap_logout_format and pop3_logout_format settings now support
    all of the generic variables (e.g. %{rip}, %{session}, etc.)
  + Added auth_policy_check_before_auth,
    auth_policy_check_after_auth and auth_policy_report_after_auth
    settings.
  + master: Support HAProxy PP2_TYPE_SSL command and set "secured"
    variable appropriately
  - Invalid UCS4 escape in HTML can cause crashes
  - imap: IMAP COMPRESS -enabled client crashes on disconnect
  - lmtp: Fix crash when user is over quota
  - lib-lda: Parsing Return-Path header address fails when it
    contains CFWS
  - auth: SASL with Exim fails for AUTH commands without an initial
    response
  - imap: SPECIAL-USE capability isn't automatically added
  - auth: LDAP subqueries do not support standard auth variables in
    var-expand
  - auth: SHA256-CRYPT and SHA512-CRYPT schemes do not work
  - lib-index: mail_always/never_cache_fields are not used for
    existing cache files
  - imap: Fetching headers leaks memory if search doesn't find any
    mails
  - lmtp: ORCPT support in RCPT TO
  - imap-login: Process sometimes ends up in infinite loop
  - sdbox: Rolled back save/copy transaction doesn't delete temp
    files
  - mail: lock_method=dotlock causes crashes
- drop patches which are included in the update
  23da0fa1b30cc11bcc1d467674a0950c527e9ff1.patch
  dovecot-2.3.0.1-over-quota-lmtp-crash.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1522238400">- update pigeonhole to 0.5.1
  - Explicitly disallow UTF-8 in localpart in addresses parsed from
    Sieve script.
  - editheader extension: Corrected the stream position
    calculations performed while making the modified message
    available as a stream.  Pigeonhole Sieve crashed in LMTP with
    an assertion panic when the Sieve editheader extension was used
    before the message was redirected.  Experiments indicate that
    the problem occurred only with LMTP and that LDA is not
    affected.
  - fileinto extension: Fix assert panic occurring when fileinto is
    used without being listed in the require line, while the copy
    extension is listed there. This is a very old bug.
  - imapsieve plugin: Do not assert crash or log an error for
    messages that disappear concurrently while applying Sieve
    scripts. This event is now logged as a debug message.
  - Sieve extprograms plugin: Large output from "execute" command
    crashed delivery. Fixed buffering issue in code that handles
    output from the external program.</changelog>
  <changelog author="varkoly@suse.com" date="1523361600">- bnc#1088911 - dovecot23 can not build ond s390
  add: 35497604d80090a02619024aeec069b32568e4b4.diff
  add: 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff</changelog>
  <changelog author="kbabioch@suse.com" date="1527163200">- Use OpenPGP signatures provided upstream
- Added dovecot23.keyring, which contains the keys from the upstream projects</changelog>
  <changelog author="mrueckert@suse.de" date="1527422400">- added 847790d5aab84df38256a6f9b4849af0eb408419.patch:
  Fix crash for over quota users</changelog>
  <changelog author="mrueckert@suse.de" date="1530360000">- update to 2.3.2
  * old-stats plugin: Don't temporarily enable PR_SET_DUMPABLE
    while opening /proc/self/io. This may still cause security
    problems if the process is ptrace()d at the same time.
    Instead, open it while still running as root.
  + doveadm: Added mailbox cache decision&amp;remove commands. See
    doveadm-mailbox(1) man page for details.
  + doveadm: Added rebuild attachments command for rebuilding
    $HasAttachment or $HasNoAttachment flags for matching mails.
    See doveadm-rebuild(1) man page for details.
  + cassandra: Use fallback_consistency on more types of errors
  + lmtp proxy: Support outgoing SSL/TLS connections
  + lmtp: Add lmtp_rawlog_dir and lmtp_proxy_rawlog_dir settings.
  + submission: Add support for rawlog_dir
  + submission: Add submission_client_workarounds setting.
  + lua auth: Add password_verify() function and additional fields
    in auth request.
  - doveadm-server: TCP connections are hanging when there is a lot
    of network output. This especially caused hangs in
    dsync-replication.
  - Using multiple type=shared mdbox namespaces crashed
  - mail_fsync setting was ignored. It was always set to
    "optimized".
  - lua auth: Fix potential crash at deinit
  - SSL/TLS servers may have crashed if client disconnected during
    handshake.
  - SSL/TLS servers: Don't send extraneous certificates to client
    when alt certs are used.
  - lda, lmtp: Return-Path header without '&lt;' may have
    assert-crashed.
  - lda, lmtp: Unencoded UTF-8 in email address headers may
    assert-crash
  - lda: -f parameter didn't allow empty/null/domainless address
  - lmtp, submission: Message size limit was hardcoded to 40 MB.
    Exceeding it caused the connection to get dropped during
    transfer.
  - lmtp: Fix potential crash when delivery fails at DATA stage
  - lmtp: login_greeting setting was ignored
  - Fix to work with OpenSSL v1.0.2f
  - systemd unit restrictions were too strict by default
  - Fix potential crashes when a lot of log output was produced
  - SMTP client may have assert-crashed when sending mail
  - IMAP COMPRESS: Send "end of compression" marker when
    disconnecting.
  - cassandra: Fix consistency=quorum to work
  - dsync: Lock file generation failed if home directory didn't
    exist
  - Snippet generation for HTML mails didn't ignore &amp;entities
    inside blockquotes, producing strange looking snippets.
  - imapc: Fix assert-crash if getting disconnected and after
    reconnection all mails in the selected mailbox are gone.
  - pop3c: Handle unexpected server disconnections without
    assert-crash
  - fts: Fixes to indexing mails via virtual mailboxes.
  - fts: If mails contained NUL characters, the text around it
    wasn't indexed.
  - Obsolete dovecot.index.cache offsets were sometimes used.
    Trying to fetch a field that was just added to cache file may
    not have always found it.
- update pigeonhole to 0.5.2
  + Implement plugin for the a vendor-defined IMAP capability
    called "FILTER=SIEVE". It adds the ability to manually invoke
    Sieve filtering in IMAP. More information can be found in
    doc/plugins/imap_filter_sieve.txt.
  - The Sieve addess test caused an assertion panic for invalid
    addresses with UTF-8 codepoints in the localpart. Fixed by
    properly detecting invalid addresses with UTF-8 codepoints in
    the localpart and skipping these like other invalid addresses
    while iterating addresses for the address test.
  - Make the length of the subject header for the vacation response
    configurable and enforce the limit in UTF-8 codepoints rather
    than bytes. The subject header for a vacation response was
    statically truncated to 256 bytes, which is too limited for
    multi-byte UTF-8 characters.
  - Sieve editheader extension: Fix assertion panic occurring when
    it is used to manipulate a message header with a very large
    header field.
  - Properly abort execution of the sieve_discard script upon
    error.  Before, the LDA Sieve plugin attempted to execute the
    sieve_discard script when an error occurs. This can lead to the
    message being lost.
  - Fix the interaction between quota and the sieve_discard script.
    When quota was used together with a sieve_discard script, the
    message delivery did not bounce when the quota was exceeded.
- refreshed to apply cleanly again dovecot-2.3.0-better_ssl_defaults.patch
- dropped patches:
  - 35497604d80090a02619024aeec069b32568e4b4.diff
  - 5522b8b3d3ed1a99c3b63bb120216af0bd427403.diff
  - 847790d5aab84df38256a6f9b4849af0eb408419.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1531310400">- update to 2.3.2.1
  - SSL/TLS servers may have crashed during client disconnection
  - lmtp: With lmtp_rcpt_check_quota=yes mail deliveries may have
    sometimes assert-crashed.
  - v2.3.2: "make check" may have crashed with 32bit systems</changelog>
  <changelog author="mrueckert@suse.de" date="1531483200">- added
  https://github.com/dovecot/core/commit/4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch</changelog>
  <changelog author="mrueckert@suse.de" date="1538395200">- update to 2.3.3
  * doveconf hides more secrets now in the default output.
  * ssl_dh setting is no longer enforced at startup. If it's not
    set and non-ECC DH key exchange happens, error is logged and
    client is disconnected.
  + Added log_debug=&lt;filter&gt; setting.
  + Added log_core_filter=&lt;log filter&gt; setting.
  + quota-clone: Write to dict asynchronously
  + --enable-hardening attempts to use retpoline Spectre 2
    mitigations
  + lmtp proxy: Support source_ip passdb extra field.
  + doveadm stats dump: Support more fields and output stddev
    by default.
  + push-notification: Add SSL support for OX backend.
  - NUL bytes in mail headers can cause truncated replies when
    fetched.
  - director: Conflicting host up/down state changes may in some
    rare situations ended up in a loop of two directors constantly
    overwriting each others' changes.
  - director: Fix hang/crash when multiple doveadm commands are
    being handled concurrently.
  - director: Fix assert-crash if doveadm disconnects too early
  - virtual plugin: Some searches used 100% CPU for many seconds
  - dsync assert-crashed with acl plugin in some situations.
  - mail_attachment_detection_options=add-flags-on-save
    assert-crashed with some specific Sieve scripts.
  - Mail snippet generation crashed with mails containing invalid
    Content-Type:multipart header.
  - Log prefix ordering was different for some log lines.
  - quota: With noenforcing option current quota usage wasn't
    updated.
  - auth: Kerberos authentication against Samba assert-crashed.
  - stats clients were unnecessarily chatty with the stats server.
  - imapc: Fixed various assert-crashes when reconnecting to
    server.
  - lmtp, submission: Fix potential crash if client disconnects
    while handling a command.
  - quota: Fixed compiling with glibc-2.26 / support libtirpc.
  - fts-solr: Empty search values resulted in 400 Bad Request
    errors
  - fts-solr: default_ns parameter couldn't be used
  - submission server crashed if relay server returned over 7 lines
    in a reply (e.g. to EHLO)
- dropped 4ff4bd024a9b6e7973b76b186ce085c2ca669d3e.patch:
  included in update</changelog>
  <changelog author="mrueckert@suse.de" date="1538395201">- update pigeonhole to 0.5.3
  - Fix assertion panic occurring when managesieve service fails to
    open INBOX while saving a Sieve script. This was caused by a
    lack of cleanup after failure.
  - Fix specific messages causing an assert panic with actions that
    compose a reply (e.g. vacation). With some rather weird input
    from the original message, the header folding algorithm (as
    used for composing the References header for the reply) got
    confused, causing the panic.
  - IMAP FILTER=SIEVE capability: Fix FILTER SIEVE SCRIPT command
    parsing.  After finishing reading the Sieve script, the command
    parsing sometimes didn't continue with the search arguments.
    This is a time- critical bug that likely only occurs when the
    Sieve script is sent in the next TCP frame.</changelog>
  <changelog author="varkoly@suse.com" date="1569326400">- bsc#1145559 VUL-0: CVE-2019-11500: dovecot22, dovecot23:
  IMAP and ManageSieve protocol parsers do not properly handle NUL byte
  applyed upstream patches:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch</changelog>
  <changelog author="varkoly@suse.com" date="1569412800">- bsc#1133625 - (CVE-2019-11499) VUL-0: CVE-2019-11499: dovecot23:
  Submission-login crashes over TLS authentication
- bsc#1133624 VUL-0: CVE-2019-11494: dovecot23: Submission-login
  crashes over aborted/disconected authentication
  applyed upstream patches:
  dovecot-CVE-2019-11499-fix-pending-starttls.patch
  dovecot-CVE-2019-11494-fix-disconnects.patch
  dovecot-CVE-2019-11494-fix-error-handling.patch</changelog>
  <changelog author="varkoly@suse.com" date="1589544000">- update pigeonhole to 0.5.10
  * imap_sieve_filter: Change result action logging to include IMAP UID
  - vacation: Addresses were compared case-sensitively.
  + Added events for Sieve and ManageSieve, see
    https://doc.dovecot.org/admin_manual/list_of_events/#pigeonhole
  + Pigeonhole: Implement the Sieve "special-use" extension described in
    RFC 8579.
  - duplicate: Test only compared the handles which would cause
    different values to be cached as the same duplicate test. Fix to also
    compare the actual hashes.
  - imap_sieve_filter: IMAP FILTER Command had various bugs in error
    handling. Errors may have been duplicated for each email, errors
    may have been missing entirely, command tag and ERRORS/WARNINGS
    parameters were swapped.
  - Sieve may leak resources in rare cases when a redirect, vacation or
    report action fails to send the message. This mainly applies when
    Sieve is executed in IMAP context; i.e., for the IMAPSIEVE or
    FILTER=SIEVE capabilities.
  - dsync: Sieve script syncing failed if mailbox attributes weren't
    enabled.
  + vacation: Made the subject for the automatic response message produced
    by the Sieve vacation action configurable. Both the default subject
    (if the script defines none) and the subject template (e.g. used to
    add a subject prefix) can be configured.
  - dsync: dsync-replication does not synchronize Sieve scripts.
  - imap_sieve_filter: Reduce FILTER=SIEVE verbosity over IMAP connection.
  - testsuite: Pigeonhole testsuite segfaulted if it was compiled with
    GCC 9
  + sieve: Redirect loop prevention is sometimes ineffective. Improve
    existing loop detection by also recognizing the
    X-Sieve-Redirected-From header in incoming messages and dropping
    redirect actions when it points to the sending account. This header
    is already added by the redirect action, so this improvement only
    adds an additional use of this header.
  - sieve: Prevent execution of implicit keep upon temporary failure
    occurring at runtime.
  + IMAPSieve: Add new plugin/imapsieve_expunge_discarded setting which
    causes messages discarded by an IMAPSieve script to be expunged
    immediately, rather than only being marked as "\Deleted" (which is
    still the default behavior).
  - IMAPSieve: Fix panic crash occurring when a COPY command copies
    messages from a virtual mailbox where the source messages originate
    from more than a single real mailbox.
  - imap4flags extension: Fix deleting all keywords. When the action
    resulted in all keywords being removed, no changes were actually
    applied.
  - variables extension: Fix truncation of UTF-8 variable content. The
    maximum size of Sieve variables was enforced by truncating the
    variable string content bluntly at the limit, but this does not
    consider UTF-8 code point boundaries. This resulted in broken UTF-8
    strings. This problem also surfaced for variable modifiers, such as
    the ":encodeurl" modifier provided by the Sieve "enotify" extension.
    In that case, the resulting URI escaping could also be truncated
    inappropriately.
  - IMAPSieve, IMAP FILTER=SIEVE: Fix replacing a modified message. Sieve
    scripts running in IMAPSIEVE or IMAP FILTER=SIEVE context that
    modify the message, stored the message a second time, rather than
    replacing the originally stored unmodified message.
  - Fix segmentation fault occurring when both the sieve_extprograms
    plugin (for the Sieve interpreter) and the imap_filter_sieve plugin
    (for IMAP) are loaded at the same time. A symbol was defined by both
    plugins, causing a clash when both were loaded.
  * Adjustments to several changes in Dovecot v2.3.4 make this Pigeonhole
    release dependent on that Dovecot release; it will not compile against
    older Dovecot versions. And, conversely, you need to upgrade
    Pigeonhole when upgrading Dovecot to v2.3.4.
  * The changes regarding the default postmaster_address in Dovecot v2.3.4
    mainly apply to Pigeonhole. The new default should work for all
    existing installations, thereby fixing several reported v2.3/v0.5
    migration problems.
  - IMAP FILTER=SIEVE capability: Fix assert crash occurring when running
    UID FILTER on a Sieve script with errors.
- update to 2.3.10
  * Disable retpoline migitations by default. These can cause severe
    performance regressions, so they should be only enabled when
    applicable.
  * IMAP MOVE now commits transactions in batches of 1000 mails. This
    helps especially with lazy_expunge when moving a lot of mails. It
    mainly avoids situations where multiple IMAP sessions are running the
    same MOVE command and duplicating the mails in the lazy_expunge folder.
    With this change there can still be some duplication, but the MOVE
    always progresses forward. Also if the MOVE fails at some point, the
    changes up to the last 1000 mails are still committed instead of
    rolled back. Note that the COPY command behavior hasn't changed,
    because it is required by IMAP standard to be an atomic operation.
  * IMAP EXPUNGE and CLOSE now expunges mails in batches of 1000 mails.
    This helps especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  * Autoexpunging now expunges mails in batches of 1000 mails. This helps
    especially with lazy_expunge when expunging a lot of mails
    (e.g. millions) to make sure that the progress always moves forward
    even if the process is killed.
  + Add tool for generating sysreport called dovecot-sysreport.
    This generates a bundle of information usually needed for support
    requests.
  + Add support for the new IMAP \Important SPECIAL-USE flag (RFC 8457).
  + Add metric { group_by } setting. This allows automatically creating
    new metrics based on the fields you want to group statistics by.
    NOTE: This feature is considered experimental and syntax is subject
    to change in future release.
  + auth: Support SCRAM-SHA-256 authentication mechanism.
  + imap: Support the new IMAP STATUS=SIZE extension.
  + Use TCP_QUICKACK to reduce latency for some TCP connections.
  + quota-status: Made the service more robust against erroneous use with
    Postfix ACL policies other than smtpd_recipient_restrictions.
  + Add "revision" field support to imap_id_send setting. Using
    "revision *" will send in IMAP ID command response the short commit
    hash of the Dovecot git source tree HEAD (same as in dovecot --version).
  + IMAP ENVELOPE includes now all addresses when there are multiple
    headers (From, To, Cc, etc.) The standard way of having multiple
    addresses is to just list them all in a single header. It's
    non-standard to have multiple headers. However, since MTAs allow these
    mails to pass through and different software may handle them in
    different ways, it's better from security point of view to show all
    the addresses.
  + Event filters now support using "field_name=" to match a field that
    doesn't exist or has an empty value. For example use "error=" to match
    only events that didn't fail.
  - acl: INBOX ACLs shouldn't apply for IMAP GETMETADATA/SETMETADATA
    commands.
  - cassandra: CASS_ERROR_SERVER_WRITE_FAILURE error should also be
    treated as "uncertain write failure".
  - dict-redis: Using quota_clone configured with dict-redis could have
    crashed when Redis responded slowly.
  - imap-hibernate: Communication trouble with imap-master leads to
    segfault.
  - imap-hibernate: Unhibernation retrying wasn't working.
  - imap: Fixed auth lookup privilege problem when imap process was reused
    and user was being un-hibernated.
  - Fix potential crash when copying/moving mails within the same folder.
    This happened only when there were a lot of fields in dovecot.index.cache.
  - lib-index: Recreating dovecot.index.cache file could have crashed when
    merging bitmask fields.
  - lib-index: Using public/shared folders with INDEXPVT configured to use
    private \Seen flags, trying to search seen/unseen in an empty folder
    crashes with segfault.
  - lib-mail: Large base64-encoded mails weren't decoded properly.
    This could have affected searching/indexing mails and message snippet
    generation.
  - lib-mail: Message with only quoted text could have caused message
    snippet to ignore its 200 character limit and return the entire
    message. This was added also to dovecot.index.cache file, which
    increased disk space and memory usage unnecessarily.
    v2.3.9.2 regression (previous versions cached the quoted snippet as
    empty). In a large mail quoted text could have become wrongly added
    to the snippet, possibly mixed together with non-quoted text.
  - lib-smtp: client could have assert-crashed if STARTTLS handshake
    finished earlier than usually.
  - lib-ssl-iostream: remove -static flag for lib-ssl-iostream linking to
    prevent a compile issue.
  - lib-storage: Mailbox synchronization may have assert-crashed in some
    rare situations.
  - lib-storage: mdbox didn't preserve date.saved with dsync.
  - lib: Don't require EAI_{ADDRFAMILY,NODATA}, breaks FreeBSD
  - master: Some services could respawn unthrottled if they crash during
    startup.
  - push-notification: Do not send push_notification_finished event if
    nothing was done. This happens when mail transaction is started and
    ended with no changes.
  - quota-status: Addresses with special characters in the local part caused
    problems in the interaction between Postfix and Dovecot. Postfix sent
    its own internal representation in the recipient field, while Dovecot
    expected a valid RFC5321 mailbox address.
  - submission-login: SESSION was not correctly encoded field for the
    XCLIENT command. Particularly, a '+' character introduced by the
    session ID's Base64 encoding causes problems.
  - submission: Fix submission_max_mail_size to work correctly on 32-bit
    systems.
  - submission: Trusted connections crashed in second connection's EHLO
    if submission-login { service_count } is something else than 1 (which
    is the default).
  - submission: XCLIENT command was never used in the protocol exchange
    with the relay MTA when submission_backend_capabilities is configured,
    even when the relay MTA was properly configured to accept the XCLIENT
    command.
  * CVE-2020-7046: Truncated UTF-8 can be used to DoS
    submission-login and lmtp processes.
  * CVE-2020-7957: Specially crafted mail can crash snippet generation.
  - Mails with empty From/To headers can also cause crash
    in push notification drivers.
  * CVE-2019-19722: Mails with group addresses in From or To fields
    caused crash in push notification drivers.
  * Changed several event field names for consistency and to avoid
    conflicts in parent-child event relationships:
  * SMTP server command events: Renamed "name" to "cmd_name"
  * Events inheriting from a mailbox: Renamed "name" to "mailbox"
  * Server connection events have only "remote_ip", "remote_port",
    "local_ip" and "local_port".
  * Removed duplicate "client_ip", "ip" and "port".
  * Mail storage events: Removed "service" field.
    Use "service:&lt;name&gt;" category instead.
  * HTTP client connection events: Renamed "host" to "dest_host" and
    "port" to "dest_port"
  * auth: Drop Postfix socketmap support. It hasn't been working
    with recent Postfix versions for a while now.
  * push-notification-lua: The "subject" field is now decoded to UTF8
    instead of kept as MIME-encoded.
  + push-notification-lua: Added new "from_address", "from_display_name",
    "to_address" and "to_display_name" fields. The display names are
    decoded to UTF8.
  + Added various new fields to existing events.
    See http://doc.dovecot.net/admin_manual/list_of_events.html
  + Add lmtp_add_received_header setting. It can be used to prevent LMTP
    from adding "Received:" headers.
  + doveadm: Support SSL/STARTTLS for proxied doveadm connections based on
    doveadm_ssl setting and proxy ssl/tls settings.
  + Log filters support now "service:&lt;name&gt;", which matches all events for
    the given service. It can also be used as a category.
  + lib: Use libunwind to get abort backtraces with function names
    where available.
  + lmtp: When the LMTP proxy changes the username (from passdb lookup)
    add an appropriate ORCPT parameter.
  - lmtp: Add lmtp_client_workarounds setting to implement workarounds for
    clients that send MAIL and RCPT commands with additional spaces before
    the path and for clients that omit &lt;&gt; brackets around the path.
    See example-config/conf.d/20-lmtp.conf.
  - lda/lmtp: Invalid MAIL FROM addresses were rejcted too aggressively.
    Now mails from addresses with unicode characters are delivered, but
    their Return-Path header will be &lt;&gt; instead of the given MAIL FROM
    address.
  - lmtp: The lmtp_hdr_delivery_address setting is ignored.
  - imap: imap_command_finished event's "args" and "human_args" parameters
    were always empty.
  - mbox: Seeking in zlib and bzip2 compressed input streams didn't work
    correctly.
  - imap-hibernate: Process crashed when client got destroyed while it was
    attempted to be unhibernated, and the unhibernation fails.
  - *-login: Proxying may have crashed if SSL handshake to the backend
    failed immediately. This was unlikely to happen in normal operation.
  - *-login: If TLS handshake to upstream server failed during proxying,
    login process could crash due to invalid memory access.
  - *-login: v2.3 regression: Using SASL authentication without initial
    response may have caused SSL connections to hang. This happened often
    at least with PHP's IMAP library.
  - *-login: When login processes are flooded with authentication attempts
    it starts logging errors about "Authentication server sent unknown id".
    This is still expected. However, it also caused the login process to
    disconnect from auth server and potentially log some user's password
    in the error message.
  - dict-sql: SQL prepared statements were not shared between sessions.
    This resulted in creating a lot of prepared statements, which was
    especially inefficient when using Cassandra backend with a lot of
    Cassandra nodes.
  - auth: auth_request_finished event didn't have success=yes parameter
    set for successful authentications.
  - auth: userdb dict - Trying to list users crashed.
  - submission: Service could be configured to allow anonymous
    authentication mechanism and anonymous user access.
  - LAYOUT=index: Corrupted dovecot.list.index caused folder creation to
    panic.
  - doveadm: HTTP server crashes if request target starts with double "/".
  - dsync: Remote dsync started hanging if the initial doveadm
    "dsync-server" command was sent in the same TCP packet as the
    following dsync handshake. v2.3.8 regression.
  - lib: Several "input streams" had a bug that in some rare situations
    might cause it to access freed memory. This could lead to crashes or
    corruption.
    The only currently known effect of this is that using zlib plugin with
    external mail attachments (mail_attachment_dir) could cause fetching
    the mail to return a few bytes of garbage data at the beginning of the
    header. Note that the mail wasn't saved corrupted, but fetching it
    caused corrupted mail to be sent to the client.
  - lib-storage: If a mail only has quoted content, use the quoted text
    for generating message snippet (IMAP PREVIEW) instead of returning
    empty snippet.
  - lib-storage: When vsize header was rebuilt, newly calculated message
    sizes were added to dovecot.index.cache instead of being directly
    saved into vsize records in dovecot.index.
  - lib: JSON generator was escaping UTF-8 characters unnecessarily.
  + Added mail_delivery_started and mail_delivery_finished events, see
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + dsync-replication: Don't replicate users who have "noreplicate" extra
    field in userdb.
  + doveadm service status: Show total number of processes created.
  + When logging to syslog, use instance_name setting's value for the
    ident. This commonly is added as a log prefix.
  + Base64 encoding/decoding code was rewritten with additional features.
    It shouldn't cause any user visible changes.
  - v2.3.7 regression: If a folder only receives new mails without any
    other mail access, dovecot.index.log keeps growing forever and
    dovecot.index keeps being rewritten for every mail delivery.
  - dsync-replication may lose keywords after syncing mails restored from
    another replica. This only happened if the mail only had keywords and
    no system flags.
  - event filters: Non-textual event fields could not be filtered using
    wildcards.
  - auth: Scope parameter was missing from OAuth password grant
    request.
  - doveadm client-server communication may hang in some situations.
    It is also using unnecessarily small TCP/IP packet sizes.
  - doveadm who and kick did not flush protocol output correctly.
  - imap: SETMETADATA with literal value would delete the metadata value
    instead of updating it.
  - imap: When client issues FETCH PREVIEW (LAZY=FUZZY) command, the
    caching decisions should be updated so that newly saved mails will
    have the preview cached.
  - With mail_nfs_index=yes and/or mail_nfs_storage=yes setuid/setgid
    permission bits in some files may have become dropped with some NFS
    servers. Changed NFS flushing to now use chmod() instead of chown().
  - quota: warnings did not work if quota root was noenforcing
  - acl: Global ACL file ignored the last line if it didn't end with LF.
  - doveadm stats dump: With JSON formatter output numbers using the
    number type instead of as strings
  - lmtp_proxy: Ensure that real_* variables are correctly set when using
    lmtp_proxy.
  - event exporter: http-post driver had hardcoded timeout and did not
    support DNS lookups or TLS connections.
  - auth: Fix user iteration to work with userdb passwd with glibc v2.28.
  - auth: auth service can crash if auth-policy JSON response is invalid
    or returned too fast.
  - In some rare situations "ps" output could have shown a lot of "?"
    characters after Dovecot process titles.
  - When dovecot.index.pvt is empty, an unnecessary error is logged:
    Error: .../dovecot.index.pvt reset, view is now inconsistent
  - SMTP address encoder duplicated initial double quote character when
    the localpart of an address ended in '..'. For example
    "user+..@example.com" became ""user+.."@example.com in a
    sieve redirect.
  - Fix TCP_NODELAY errors being logged on non-Linux OSes
  - lmtp proxy: Fix assert-crash when client uses BODY=8BITMIME
  - Remove wrongly added checks in namespace prefix checking
  * fts-solr: Removed break-imap-search parameter
  + Added more events for the new statistics, see
    https://doc.dovecot.org/admin_manual/list_of_events/
  + mail-lua: Add IMAP metadata accessors, see
    https://doc.dovecot.org/admin_manual/lua/
  + Add event exporters that allow exporting raw events to log files and
    external systems, see
    https://doc.dovecot.org/configuration_manual/event_export/
  + SNIPPET is now PREVIEW and size has been increased to 200 characters.
  + Add body option to fts_enforced. This triggers building FTS index only
    on body search, and an error using FTS index fails the search rather
    than reads through all the mails.
  - Submission/LMTP: Fixed crash when domain argument is invalid in a
    second EHLO/LHLO command.
  - Copying/moving mails using Maildir format loses IMAP keywords in the
    destination if the mail also has no system flags.
  - mail_attachment_detection_options=add-flags-on-save caused email body
    to be unnecessarily opened when FETCHing mail headers that were
    already cached.
  - mail attachment detection keywords not saved with maildir.
  - dovecot.index.cache may have grown excessively large in some
    situations. This happened especially when using autoexpunging with
    lazy_expunge folders. Also with mdbox format in general the cache file
    wasn't recreated as often as it should have.
  - Autoexpunged mails weren't immediately deleted from the disk. Instead,
    the deletion from disk happened the next time the folder was opened.
    This could have caused unnecessary delays if the opening was done by
    an interactive IMAP session.
  - Dovecot's TCP connections sometimes add extra 40ms latency due to not
    enabling TCP_NODELAY. HTTP and SMTP/LMTP connections weren't
    affected, but everything else was. This delay wasn't always visible -
    only in some situations with some message/packet sizes.
  - imapc: Fix various crash conditions
  - Dovecot builds were not always reproducible.
  - login-proxy: With shutdown_clients=no after config reload the
    existing connections could no longer be listed or kicked with doveadm.
  - "doveadm proxy kick" with -f parameter caused a crash in some
    situations.
  - Auth policy can cause segmentation fault crash during auth process
    shutdown if all auth requests have not been finished.
  - Fix various minor bugs leading into incorrect behaviour in mailbox
    list index handling. These rarely caused noticeable problems.
  - LDAP auth: Iteration accesses freed memory, possibly crashing
    auth-worker
  - local_name { .. } filter in dovecot.conf does not correctly support
    multiple names and wildcards were matched incorrectly.
  - replicator: dsync assert-crashes if it can't connect to remote TCP
    server.
  - config: Memory leak in config process when ssl_dh setting wasn't
    set and there was no ssl-parameters.dat file.
    This caused config process to die once in a while
    with "out of memory".
  * auth: Support password grant with passdb oauth2.
  + Use system default CAs for outbound TLS connections.
  + Simplify array handling with new helper macros.
  + fts_solr: Enable configuring batch_size and soft_commit features.
  - lmtp/submission: Fixed various bugs in XCLIENT handling, including a
    hang when XCLIENT commands were sent infinitely to the remote server.
  - lmtp/submission: Forwarded multi-line replies were erroneously sent
    as two replies to the client.
  - lib-smtp: client: Message was not guaranteed to contain CRLF
    consistently when CHUNKING was used.
  - fts_solr: Plugin was no longer compatible with Solr 7.
  - Make it possible to disable certificate checking without
    setting ssl_client_ca_* settings.
  - pop3c: SSL support was broken.
  - mysql: Closing connection twice lead to crash on some systems.
  - auth: Multiple oauth2 passdbs crashed auth process on deinit.
  - HTTP client connection errors infrequently triggered a segmentation
    fault when the connection was idle and not used for a particular
    client instance.
  + Lua push notification driver: mail keywords and flags are provided
    in MessageNew and MessageAppend events.
  + submission: Implement support for plugins.
  + auth: When auth_policy_log_only=yes, only log what the policy server
    response would do without actually doing it.
  + auth: Always log policy server decisions with auth_verbose=yes
  - v2.3.[34]: doveadm log errors: Output was missing user/session
  - lda: Debug log lines could have shown slightly corrupted
  - login proxy: Login processes may have crashed in various ways when
    login_proxy_max_disconnect_delay was set.
  - imap: Fix crash with Maildir+zlib if client disconnects during APPEND
  - lmtp proxy: Fix potential assert-crash
  - lmtp/submission: Fix crash when SMTP client transaction times out
  - submission: Split large XCLIENT commands to 512 bytes per command,
    so Postfix accepts them.
  - submission: Fix crash when client sends invalid BURL command
  - submission: relay backend: VRFY command: Avoid forwarding 500 and
    502 replies back to client.
  - lib-http: Fix potential assert-crash when DNS lookup fails
  - lib-fts: Fix search query generation when one language ignores a
    token (e.g. via stopwords).
  * The default postmaster_address is now "postmaster@&lt;user domain or
    server hostname&gt;". If username contains the @domain part, that's
    used. If not, then the server's hostname is used.
  * "doveadm stats dump" now returns two decimals for the "avg" field.
  + Added push notification driver that uses a Lua script
  + Added new SQL, DNS and connection events.
    See https://wiki2.dovecot.org/Events
  + Added "doveadm mailbox cache purge" command.
  + Added events API support for Lua scripts
  + doveadm force-resync -f parameter performs "index fsck" while opening
    the index. This may be useful to fix some types of broken index files.
    This may become the default behavior in a later version.
  - director: Kicking a user crashes if login process is very slow
  - pop3_no_flag_updates=no: Don't expunge DELEted and RETRed messages
    unless QUIT is sent.
  - auth: Fix crypt() segfault with glibc-2.28+
  - imap: Running UID FILTER script with errors assert-crashes
  - dsync, pop3-migration: POP3 UIDLs weren't added to
    dovecot.index.cache while mails were saved.
  - dict clients may have been using 100% CPU while waiting for dict
    server to finish commands.
  - doveadm user: Fixed user listing via HTTP API
  - All levels of Cassandra log messages were logged as Dovecot errors.
  - http/smtp client may have crashed after SSL handshake
  - Lua auth converted strings that looked like numbers into numbers.
- CVE-2020-10967: dovecot23: Sending mail with empty quoted localpart
  causes submission or lmtp componentto crash. (bsc#1171456)
- CVE-2020-10957: dovecot23: Sending malformed NOOP command causesi
  crash in submission, submission-login orlmtp service. (bsc#1171457)
- CVE-2020-10958: dovecot23: use-after-free with too many newlines
  (bsc#1171458)
  applyed upstream patches:
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch
    0015-lib-smtp-smtp-address-Only-produce-a-address-in-smtp.patch
    0016-lmtp-lmtp-commands-Explicity-prohibit-empty-RCPT-pat.patch
- Removed patches containing by the updates:
    0001-lib-managesieve-Don-t-accept-strings-with-NULs.patch
    0002-lib-managesieve-Make-sure-str_unescape-won-t-be-writ.patch
    0001-lib-imap-Don-t-accept-strings-with-NULs.patch
    0002-lib-imap-Make-sure-str_unescape-won-t-be-writing-pas.patch
    dovecot-CVE-2019-11494-fix-disconnects.patch
    dovecot-CVE-2019-11494-fix-error-handling.patch
    dovecot-CVE-2019-11499-fix-pending-starttls.patch</changelog>
  <changelog author="varkoly@suse.com" date="1609588800">- Update pigeonhole to version 0.5.11
  * managesieve: managesieve_max_line_length setting is now a "size" type
    instead of just number of bytes. This allows using e.g. "64k" as the
    value.
  - lib-sieve: When folding white space is used in the Message-ID header,
    it is not stripped away correctly before the message ID value is used,
    causing e.g. garbled log lines at delivery.
- Update to version 2.3.11.3
  - pop3-login: Login didn't handle commands in multiple IP packets properly.
    This mainly affected large XCLIENT commands or a large SASL initial
    response parameter in the AUTH command.
  - pop3: pop3_deleted_flag setting was broken, causing:
    Panic: file seq-range-array.c: line 472 (seq_range_array_invert):
    assertion failed: (range[count-1].seq2 &lt;= max_seq)
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - lib-mail: v2.3.11 regression: MIME parts not returned correctly by
    Dovecot MIME parser.
  - pop3-login: Login would fail with "Input buffer full" if the initial
    response for SASL was too long.
  * CVE-2020-12100: Parsing mails with a large number of MIME parts could
    have resulted in excessive CPU usage or a crash due to running out of
    stack memory.
    nested MIME parts leads to resource exhaustion (bsc#1174920)
  * CVE-2020-12673: Dovecot's NTLM implementation does not correctly check
    message buffer size, which leads to reading past allocation which can
    lead to crash. (bsc#1174922)
  * CVE-2020-10967: lmtp/submission: Issuing the RCPT command with an
    address that has the empty quoted string as local-part causes the lmtp
    service to crash.
  * CVE-2020-12674: Dovecot's RPA mechanism implementation accepts
    zero-length message, which leads to assert-crash later on.
    (bsc#1174923)
  * Events: Fix inconsistency in events. See event documentation in
    https://doc.dovecot.org.
  * imap_command_finished event's cmd_name field now contains "unknown"
    for unknown commands. A new "cmd_input_name" field contains the
    command name exactly as it was sent.
  * lib-index: Renamed mail_cache_compress_* settings to mail_cache_purge_*.
    Note that these settings are mainly intended for testing and usually
    shouldn't be changed.
  * events: Renamed "index" event category to "mail-index".
  * events: service:&lt;name&gt; category is now using the name from
    configuration file.
  * dns-client: service dns_client was renamed to dns-client.
  * log: Prefixes generally use the service name from configuration file.
    For example dict-async service will now use
    "dict-async(pid): " log prefix instead of "dict(pid): "
  * *-login: Changed logging done by proxying to use a consistent prefix
    containing the IP address and port.
  * *-login: Changed disconnection log messages to be slightly clearer.
  + dict: Add events for dictionaries.
  + lib-index: Finish logging with events.
  + oauth2: Support local validation of JWT tokens.
  + stats: Add support for dynamic histograms and grouping. See
    https://doc.dovecot.org/configuration_manual/stats/.
  + imap: Implement RFC 8514: IMAP SAVEDATE
  + lib-index: If a long-running transaction (e.g. SORT/FETCH on a huge
    folder) adds a lot of data to dovecot.index.cache file, commit those
    changes periodically to make them visible to other concurrent sessions
    as well.
  + stats: Add OpenMetrics exporter for statistics. See
    https://doc.dovecot.org/configuration_manual/stats/openmetrics/.
  + stats: Support disabling stats-writer socket by setting
    stats_writer_socket_path="".
  - auth-worker: Process keeps slowly increasing its memory usage and
    eventually dies with "out of memory" due to reaching vsz_limit.
  - auth: Prevent potential timing attacks in authentication secret
    comparisons: OAUTH2 JWT-token HMAC, imap-urlauth token, crypt() result.
  - auth: Several auth-mechanisms allowed input to be truncated by NUL
    which can potentially lead to unintentional issues or even successful
    logins which should have failed.
  - auth: When auth policy returned a delay, auth_request_finished event
    had policy_result=ok field instead of policy_result=delayed.
  - auth: auth process crash when auth_policy_server_url is set to an
    invalid URL.
  - dict-ldap: Crash occurs if var_expand template expansion fails.
  - dict: If dict client disconnected while iteration was still running,
    dict process could have started using 100% CPU, although it was still
    handling clients.
  - doveadm: Running doveadm commands via proxying may hang, especially
    when doveadm is printing a lot of output.
  - imap: "MOVE * destfolder" goes to a loop copying the last mail to the
    destination until the imap process dies due to running out of memory.
  - imap: Running "UID MOVE 1:* Trash" on an empty folder goes to infinite
    loop.
  - imap: SEARCH doesn't support $.
  - lib-compress: Buffer over-read in zlib stream read.
  - lib-dns: If DNS lookup times out, lib-dns can cause crash in calling
    process.
  - lib-index: Fixed several bugs in dovecot.index.cache handling that
    could have caused cached data to be lost.
  - lib-index: Writing to &gt;=1 GB dovecot.index.cache files may cause
    assert-crashes:
    Panic: file mail-index-util.c: line 37 (mail_index_uint32_to_offset):
    assertion failed: (offset &lt; 0x40000000)
  - lib-ssl-iostream: Fix buggy OpenSSL error handling without
    assert-crashing. If there is no error available, log it as an error
  instead of crashing:
    Panic: file iostream-openssl.c: line 599 (openssl_iostream_handle_error):
    assertion failed: (errno != 0)
  - lib-ssl-iostream: ssl_key_password setting did not work.
  - submission: A segfault crash may occur when the client or server
    disconnects while a non-transaction command like NOOP or VRFY is still
    being processed.
  - virtual: Copying/moving mails with IMAP into a virtual folder assert-crashes:
    Panic: file cmd-copy.c: line 152 (fetch_and_copy): assertion failed:
    (copy_ctx-&gt;copy_count == seq_range_count(&amp;copy_ctx-&gt;saved_uids))
- VUL-1: CVE-2020-25275: dovecot22,dovecot23: Mail delivery / parsing
  crashed when the 10 000th MIME part was message/rfc822
  (bsc#1180406)
- apply upstream patches:
- CVE-2020-24386: dovecot: IMAP hibernation allows users to access
  other users' emails (bsc#1180405)
- apply upstream patches:
    0002-imap-Add-unit-test-for-imap-client-hibernate.patch
    0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
    0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
    0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
- remove paches containing by update:
    0001-auth-mech-rpa-Fail-on-zero-len-buffer.patch
    0001-lib-smtp-smtp-server-cmd-vrfy-Restructure-parameter-.patch
    0002-lib-ntlm-Check-buffer-length-on-responses.patch
    0002-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0003-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0004-lib-smtp-smtp-syntax-Do-not-allow-NULL-return-parame.patch
    0005-lib-smtp-smtp-syntax-Return-0-for-smtp_string_parse-.patch
    0006-lib-smtp-Add-tests-for-smtp_string_parse-and-smtp_st.patch
    0007-lib-smtp-test-smtp-server-errors-Add-tests-for-VRFY-.patch
    0008-lib-smtp-smtp-server-command-Guarantee-that-non-dest.patch
    0009-lib-smtp-smtp-server-command-Assign-cmd-reg-immediat.patch
    0010-lib-smtp-smtp-server-command-Perform-initial-command.patch
    0011-lib-smtp-smtp-server-connection-Hold-a-command-refer.patch
    0012-lib-smtp-test-smtp-server-errors-Add-tests-for-large.patch
    0013-lib-smtp-smtp-address-Don-t-return-NULL-from-smtp_ad.patch
    0014-lib-smtp-smtp-address-Don-t-recognize-an-address-wit.patch</changelog>
  <changelog author="varkoly@suse.com" date="1623931200">- CVE-2021-29157: Local attacker can login as any user and access their emails
  (bsc#1187418)
- CVE-2021-33515: Attacker can potentially steal user credentials and mails
  (bsc#1187419)
  Add upstream patches:
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
  <changelog author="varkoly@suse.com" date="1624363200">- Update to version 2.3.15
  - CVE-2021-29157: Dovecot does not correctly escape kid and azp fields in
    JWT tokens. This may be used to supply attacker controlled keys to
    validate tokens, if attacker has local access.
    Local attacker can login as any user and access their emails
  - CVE-2021-33515:  On-path attacker could have injected plaintext commands
    before STARTTLS negotiation that would be executed after STARTTLS
    finished with the client.
    Attacker can potentially steal user credentials and mails
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * Dovecot now depends on libsystemd for systemd integration.
  * Removed support for Lua 5.2. Use version 5.1 or 5.3 instead.
  * config: Some settings are now marked as "hidden". It's discouraged to
    change these settings. They will no longer be visible in doveconf
    output, except if they have been changed or if doveconf -s parameter
    is used. See https://doc.dovecot.org/settings/advanced/ for details.
  * imap-compress: Compression level is now algorithm specific.
    See https://doc.dovecot.org/settings/plugin/compress-plugin/
  * indexer-worker: Convert "Indexed" info logs to an event named
    "indexer_worker_indexing_finished". See
    https://doc.dovecot.org/admin_manual/list_of_events/#indexer-worker-indexing-finished
  + Add TSLv1.3 support to min_protocols.
  + Allow configuring ssl_cipher_suites. (for TLSv1.3+)
  + acl: Add acl_ignore_namespace setting which allows to entirely ignore
    ACLs for the listed namespaces.
  + imap: Support official RFC8970 preview/snippet syntax. Old methods of
    retrieving preview information via IMAP commands ("SNIPPET and PREVIEW
    with explicit algorithm selection") have been deprecated.
  + imapc: Support INDEXPVT for imapc storage to enable private
    message flags for cluster wide shared mailboxes.
  + lib-storage: Add new events: mail_opened, mail_expunge_requested,
    mail_expunged, mail_cache_lookup_finished. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail
  + zlib, imap-compression, fs-compress: Support compression levels that
    the algorithm supports. Before, we would allow hardcoded value between
    1 to 9 and would default to 6. Now we allow using per-algorithm value
    range and default to whatever default the algorithm specifies.
  - *-login: Commands pipelined together with and just after the authenticate
    command cause these commands to be executed twice. This applies to all
    protocols that involve user login, which currently comprises of imap,
    pop3, submisision and managesieve.
  - *-login: Processes are supposed to disconnect the oldest non-logged in
    connection when process_limit was reached. This didn't actually happen
    with the default "high-security mode" (with service_count=1) where each
    connection is handled by a separate process.
  - *-login: When login process reaches client/process limits, oldest
    client connections are disconnected. If one of these was still doing
    anvil lookup, this caused a crash. This could happen only if the login
    process limits were very low or if the server was overloaded.
  - Fixed building with link time optimizations (-flto).
  - auth: Userdb iteration with passwd driver does not always return all
    users with some nss drivers.
  - dsync: Shared INBOX not synced when "mail_shared_explicit_inbox" was
    disabled. If a user has a shared mailbox which is another user's INBOX,
    dsync didn't include the mailbox in syncing unless explicit naming is
    enabled with "mail_shared_explicit_inbox" set to "yes".
  - dsync: Shared namespaces were not synced with "-n" flag.
  - dsync: Syncing shared INBOX failed if mail_attribute_dict was not set.
    If a user has a shared mailbox that is another user's INBOX, dsync
    failed to export the mailbox if mail attributes are disabled.
  - fts-solr, fts-tika: Using both Solr FTS and Tika may have caused HTTP
    requests to assert-crash: Panic: file http-client-request.c: line 1232
    (http_client_request_send_more): assertion failed: (req-&gt;payload_input != NULL)
  - fts-tika: 5xx errors returned by Tika server as indexing failures.
    However, Tika can return 5xx for some attachments every time.
    So the 5xx error should be retried once, but treated as success if it
    happens on the retry as well. v2.3 regression.
  - fts-tika: v2.3.11 regression: Indexing messages with fts-tika may have
    resulted in Panic: file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - imap: SETMETADATA could not be used to unset metadata values.
    Instead NIL was handled as a "NIL" string. v2.3.14 regression.
  - imap: IMAP BINARY FETCH crashes at least on empty base64 body:
    Panic: file index-mail-binary.c: line 358 (blocks_count_lines):
    assertion failed: (block_count == 0 || block_idx+1 == block_count)
  - imap: If IMAP client using the NOTIFY command was disconnected while
    sending FETCH notifications to the client, imap could crash with
    Panic: Trying to close mailbox INBOX with open transactions.
  - imap: Using IMAP COMPRESS extension can cause IMAP connection to hang
    when IMAP commands are &gt;8 kB long.
  - imapc: If remote server sent BYE but didn't immediately disconnect, it
    could cause infinite busy-loop.
  - lib-index: Corrupted cache record size in dovecot.index.cache file
    could have caused a crash (segfault) when accessing it.
  - lib-oauth2: JWT token time validation now works correctly with
    32-bit systems.
  - lib-ssl-iostream: Checking hostnames against an SSL certificate was
    case-sensitive.
  - lib-storage: Corrupted mime.parts in dovecot.index.cache may have
    resulted in Panic: file imap-bodystructure.c: line 206 (part_write_body):
    assertion failed: (text == ((part-&gt;flags &amp; MESSAGE_PART_FLAG_TEXT) != 0))
  - lib-storage: Index rebuilding (e.g. via doveadm force-resync) didn't
    preserve the "hdr-pop3-uidl" header. Because of this, the next pop3
    session could have accessed all of the emails' metadata to read their
    POP3 UIDL (opening dbox files).
  - listescape: When using the listescape plugin and a shared namespace
    the plugin didn't work properly anymore resulting in errors like:
    "Invalid mailbox name: Name must not have '/' character."
  - lmtp: Connection crashes if connection gets disconnected due to
    multiple bad commands and the last bad command is BDAT.
  - lmtp: The Dovecot-specific LMTP parameter XRCPTFORWARD was blindly
    forwarded by LMTP proxy without checking that the backend has support.
    This caused a command parameter error from the backend if it was
    running an older Dovecot release. This could only occur in more complex
    setups where the message was proxied twice; when the proxy generated
    the XRCPTFORWARD parameter itself the problem did not occur, so this
    only happened when it was forwarded.
  - lmtp: The LMTP proxy crashes with a panic when the remote server
    replies with an error while the mail is still being forwarded through
    a DATA/BDAT command.
  - lmtp: Username may have been missing from lmtp log line prefixes when
    it was performing autoexpunging.
  - master: Dovecot would incorrectly fail with haproxy 2.0.14 service
    checks.
  - master: Systemd service: Dovecot announces readiness for accepting
    connections earlier than it should. The following environment variables
    are now imported automatically and can be omitted from
    import_environment setting: NOTIFY_SOCKET LISTEN_FDS LISTEN_PID.
  - master: service { process_min_avail } was launching processes too
    slowly when master was forking a lot of processes.
  - util: Make the health-check.sh example script POSIX shell compatible.
  * Added new aliases for some variables. Usage of the old ones is possible,
    but discouraged. (These were partially added already to v2.3.13.)
    See https://doc.dovecot.org/configuration_manual/config_file/config_variables/
    for more information.
  * Optimize imap/pop3/submission/managesieve proxies to use less CPU at
    the cost of extra memory usage.
  * Remove autocreate, expire, snarf and mail-filter plugins.
  * Remove cydir storage driver.
  * Remove XZ/LZMA write support. Read support will be removed in future release.
  * doveadm -D: Add timestamps to debug output even when LOG_STDERR_TIMESTAMP
    environment variable is not set. Timestamp format is taken from
    log_timestamp setting.
  * If BROKENCHAR or listescape plugin is used, the escaped folder names
    may be slightly different from before in some situations. This is
    unlikely to cause issues, although caching clients may redownload the
    folders.
  * imapc: It now enables BROKENCHAR=~ by default to escape remote folder
    names if necessary. This also means that if there are any '~'
    characters in the remote folder names, they will be visible as "~7e".
  * imapc: When using local index files folder names were escaped on
    filesystem a bit differently. This affects only if there are folder
    names that actually require escaping, which isn't so common. The old
    style folders will be automatically deleted from filesystem.
  * stats: Update exported metrics to be compliant with OpenMetrics standard.
  + doveadm: Add an optional '-p' parameter to metadata list command. If
    enabled, "/private", and "/shared" metadata prefixes will be prepended
    to the keys in the list output.
  + doveconf: Support environment variables in config files. See
    https://doc.dovecot.org/configuration_manual/config_file/config_file_syntax/#environment-variables
    for more details.
  + indexer-worker: Change indexer to disconnect from indexer-worker
    after each request. This allows service indexer-worker's service_count &amp;
    idle_kill settings to work. These can be used to restart indexer-worker
    processes once in a while to reduce their memory usage.
  - auth: "nodelay" with various authentication mechanisms such as apop
    and digest-md5 crashed AUTH process if authentication failed.
  - auth: Auth lua script generating an error triggered an assertion
    failure: Panic: file db-lua.c: line 630 (auth_lua_call_password_verify):
    assertion failed: (lua_gettop(script-&gt;L) == 0).
  - configure: Fix libunwind detection to work on other than x86_64 systems.
  - doveadm-server: Process could crash if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or Panic:
    file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - dsync: Folder name escaping with BROKENCHAR didn't work completely
    correctly. This especially caused problems with dsync-migrations using
    imapc where some of the remote folder names may not have been accessible.
  - dsync: doveadm sync + imapc doesn't always sync all mails when doing
    an incremental sync (-1), which could lead to mail loss when it's used
    for migration. This happens only when GUIDs aren't used (i.e.
    imapc without imapc_features=guid-forced).
  - fts-tika: When tika server returns error, some mails cause Panic:
    file message-parser.c: line 802 (message_parser_deinit_from_parts):
    assertion failed: (ctx-&gt;nested_parts_count == 0 || i_stream_have_bytes_left(ctx-&gt;input))
  - lib-imap: imapc parsing illegal BODYSTRUCTUREs with NILs could have
    resulted in crashes. This exposed that Dovecot was wrongly accepting
    atoms in "nstring" handling. Changed the IMAP parsing to be more
    strict about this now.
  - lib-index: If dovecot.index.cache has corrupted message size, fetching
    BODY/BODYSTRUCTURE may cause assert-crash:
    Panic: file index-mail.c: line 1140 (index_mail_parse_body_finish):
    assertion failed: (mail-&gt;data.parts != NULL).
  - lib-index: Minor error handling and race condition fixes related to
    rotating dovecot.index.log. These didn't usually cause problems,
    unless the log files were rotated rapidly.
  - lib-lua: Lua scripts using coroutines or lua libraries using coroutines
    (e.g., cqueues) panicked.
  - Message PREVIEW handled whitespace wrong so first space would get
    eaten from between words.
  - FTS and message PREVIEW (snippet) parsed HTML &amp;entities case-sensitively.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for IMAP clients
    and also Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-oauth2: HS512 and HS384 JWT token algorithms crash when you try to
    use them: Panic: file hmac.c: line 26 (hmac_init): assertion failed:
    (meth-&gt;context_size &lt;= MAC_MAX_CONTEXT_SIZE).
  - event filters: NOT keyword did not have the correct associativity.
  - Ignore ECONNRESET when closing socket. This avoids logging useless
    errors on systems like FreeBSD.
  - event filters: event filter syntax error may lead to Panic:
    file event-filter.c: line 137 (event_filter_parse): assertion failed:
    (state.output == NULL)
  - lib: timeval_cmp_margin() was broken on 32-bit systems. This could
    potentially have caused HTTP timeouts to be handled incorrectly.
  - log: instance_name wasn't used as syslog ident by the log process.
  - master: After a service reached process_limit and client_limit, it
    could have taken up to 1 second to realize that more client connections
    became available. During this time client connections could have been
    unnecessarily rejected and a warning logged:
    Warning: service(...): process_limit (...) reached, client connections are being dropped
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
  - stats: Event filters comparing against empty strings crash the stats
    process.
  * CVE-2020-24386: Specially crafted command can cause IMAP hibernate to
    allow logged in user to access other people's emails and filesystem
    information.
  * Metric filter and global event filter variable syntax changed to a
    SQL-like format. See https://doc.dovecot.org/configuration_manual/event_filter/
  * auth: Added new aliases for %{variables}. Usage of the old ones is
    possible, but discouraged.
  * auth: Removed RPA auth mechanism, SKEY auth mechanism, NTLM auth
    mechanism and related password schemes.
  * auth: Removed passdb-sia, passdb-vpopmail and userdb-vpopmail.
  * auth: Removed postfix postmap socket
  + auth: Added new fields for auth server events. These fields are now
    also available for all auth events. See
    https://doc.dovecot.org/admin_manual/list_of_events/#authentication-server
    for details.
  + imap-hibernate: Added imap_client_hibernated, imap_client_unhibernated
    and imap_client_unhibernate_retried events. See
    https://doc.dovecot.org/admin_manual/list_of_events/ for details.
  + lib-index: Added new mail_index_recreated event. See
    https://doc.dovecot.org/admin_manual/list_of_events/#mail-index-recreated
  + lib-sql: Support TLS options for cassandra driver. This requires
    cpp-driver v2.15 (or later) to work reliably.
  + lib-storage: Missing $HasAttachment / $HasNoAttachment flags are now
    added to existing mails if mail_attachment_detection_option=add-flags
    and it can be done inexpensively.
  + login proxy: Added login_proxy_max_reconnects setting (default 3) to
    control how many reconnections are attempted.
  + login proxy: imap/pop3/submission/managesieve proxying now supports
    reconnection retrying on more than just connect() failure. Any error
    except a non-temporary authentication failure will result in reconnect
    attempts.
  - auth: Lua passdb/userdb leaks stack elements per call, eventually
    causing the stack to become too deep and crashing the auth or
    auth-worker process.
  - auth: SASL authentication PLAIN mechanism could be used to trigger
    read buffer overflow. However, this doesn't seem to be exploitable in
    any way.
  - auth: v2.3.11 regression: GSSAPI authentication fails because dovecot
    disallows NUL bytes for it.
  - dict: Process used too much CPU when iterating keys, because each key
    used a separate write() syscall.
  - doveadm-server: Crash could occur if logging was done outside command
    handling. For example http-client could have done debug logging
    afterwards, resulting in either segfault or
    Panic: file http-client.c: line 642 (http_client_context_close):
    assertion failed: (cctx-&gt;clients_list == NULL).
  - doveadm-server: v2.3.11 regression: Trying to connect to doveadm server
    process via starttls assert-crashed if there were no ssl=yes listeners:
    Panic: file master-service-ssl.c: line 22 (master_service_ssl_init):
    assertion failed: (service-&gt;ssl_ctx_initialized).
  - fts-solr: HTTP requests may have assert-crashed:
    Panic: file http-client-request.c: line 1232 (http_client_request_send_more):
    assertion failed: (req-&gt;payload_input != NULL)
  - imap: IMAP NOTIFY could crash with a segmentation fault due to a bad
    configuration that causes errors. Sending the error responses to the
    client can cause the segmentation fault. This can for example happen
    when several namespaces use the same mail storage location.
  - imap: IMAP NOTIFY used on a shared namespace that doesn't actually
    exist (e.g. public namespace for a nonexistent user) can crash with a panic:
    Panic: Leaked view for index /tmp/home/asdf/mdbox/dovecot.list.index: Opened in (null):0
  - imap: IMAP session can crash with QRESYNC extension if many changes
    are done before asking for expunged mails since last sync.
  - imap: Process might hang indefinitely if client disconnects after
    sending some long-running commands pipelined, for example FETCH+LOGOUT.
  - lib-compress: Mitigate crashes when configuring a not compiled in
    compression. Errors with compression configuration now distinguish
    between not supported and unknown.
  - lib-compression: Using xz/lzma compression in v2.3.11 could have
    written truncated output in some situations. This would result in
    "Broken pipe" read errors when trying to read it back.
  - lib-compression: zstd compression could have crashed in some situations:
    Panic: file ostream.c: line 287 (o_stream_sendv_int): assertion failed: (!stream-&gt;blocking)
  - lib-dict: dict client could have crashed in some rare situations when
    iterating keys.
  - lib-http: Fix several assert-crashes in HTTP client.
  - lib-index: v2.3.11 regression: When mails were expunged at the same
    time as lots of new content was being saved to the cache (e.g. cache
    file was lost and is being re-filled) a deadlock could occur with
    dovecot.index.cache / dovecot.index.log.
  - lib-index: v2.3.11 regression: dovecot.index.cache file was being
    purged (rewritten) too often when it had a field that hadn't been
    accessed for over 1 month, but less than 2 months. Every cache file
    change caused a purging in this situation.
  - lib-mail: MIME parts were not returned correctly by Dovecot MIME parser.
    Regression caused by fixing CVE-2020-12100.
  - lib-mail: When max nested MIME parts were reached, IMAP BODYSTRUCTURE
    was written in a way that may have caused confusion for both IMAP
    clients and Dovecot itself when parsing it. The truncated part is now
    written out using application/octet-stream MIME type.
  - lib-mail: v2.3.11 regression: Mail delivery / parsing crashed when the
    10000th MIME part was message/rfc822 (or if parent was multipart/digest):
    Panic: file message-parser.c: line 167 (message_part_append):
    assertion failed: (ctx-&gt;total_parts_count &lt;= ctx-&gt;max_total_mime_parts).
  - lib-oauth2: Dovecot incorrectly required oauth2 server introspection
    reply to contain username with invalid token.
  - lib-ssl-iostream, lib-dcrypt: Fix building with OpenSSL that has
    deprecated APIs disabled.
  - lib-storage: When mail's size is different from the cached one (in
    dovecot.index.cache or Maildir S=size in the filename), this is
    handled by logging "Cached message size smaller/larger than expected"
    error. However, in some situations this also ended up crashing with:
    Panic: file istream.c: line 315 (i_stream_read_memarea):
    assertion failed: (old_size &lt;= _stream-&gt;pos - _stream-&gt;skip).
  - lib-storage: v2.3 regression: Copying/moving mails was taking much more
    memory than before. This was mainly visible when copying/moving
    thousands of mails in a single transaction.
  - lib-storage: v2.3.11 regression: Searching messages assert-crashed
    (without FTS): Panic: file message-parser.c: line 174 (message_part_finish):
    assertion failed: (ctx-&gt;nested_parts_count &gt; 0).
  - lib: Dovecot v2.3 moved signal handlers around in ioloops,
    causing more CPU usage than in v2.2.
  - lib: Fixed JSON parsing: '\' escape sequence may have wrongly resulted
    in error if it happened to be at read boundary. Any NUL characters and
    '\u0000' will now result in parsing error instead of silently
    truncating the data.
  - lmtp, submission: Server may hang if SSL client connection disconnects
    during the delivery. If this happened repeated, it could have ended
    up reaching process_limit and preventing any further lmtp/submission
    deliveries.
  - lmtp: Proxy does not always properly log TLS connection problems as
    errors; in some cases, only a debug message is logged if enabled.
  - lmtp: The LMTP service can hang when commands are pipelined. This can
    particularly occur when one command in the middle of the pipeline fails.
    One example of this occurs for proxied LMTP transactions in which the
    final DATA or BDAT command is pipelined after a failing RCPT command.
  - login-proxy: The login_source_ips setting has no effect, and therefore
    the proxy source IPs are not cycled through as they should be.
  - master: Process was using 100% CPU in some situations when a broken
    service was being throttled.
  - pop3-login: POP3 login would fail with "Input buffer full" if the
    initial response for SASL was too long.
  - stats: Crash would occur when generating openmetrics data for metrics
    using aggregating functions.
- Update pigeonhole to version 0.5.15
  * CVE-2020-28200: Sieve interpreter is not protected against abusive
    scripts that claim excessive resource usage. Fixed by limiting the
    user CPU time per single script execution and cumulatively over
    several script runs within a configurable timeout period. Sufficiently
    large CPU time usage is summed in the Sieve script binary and execution
    is blocked when the sum exceeds the limit within that time. The block
    is lifted when the script is updated after the resource usage times out.
    (bsc#1187420) Attacker can DoS the mail delivery system
    (jsc#PM-2746) ECO: Dovecot 2.3.15 version upgrade
  * Disconnection log messages are now more standardized across services.
    They also always now start with "Disconnected" prefix.
  * managesieve: Commands pipelined together with and just after the
    authenticate command cause these commands to be executed twice.
  * duplicate: The test was handled badly in a multiscript (sieve_before,
    sieve_after) scenario in which an earlier script in the sequence with
    a duplicate test succeeded, while a later script caused a runtime
    failure. In that case, the message is recorded for duplicate tracking,
    while the message may not actually have been delivered in the end.
  * editheader: Sieve interpreter entered infinite loop at startup when
    the "editheader" configuration listed an invalid header name. This
    problem can only be triggered by the administrator.
  * relational: The Sieve relational extension can cause a segfault at
    compile time. This is triggered by invalid script syntax. The segfault
    happens when this match type is the last argument of the test command.
    This situation is not possible in a valid script; positional arguments
    are normally present after that, which would prevent the segfault.
  * sieve: For some Sieve commands the provided mailbox name is not
    properly checked for UTF-8 validity, which can cause assert crashes at
    runtime when an invalid mailbox name is encountered. This can be
    caused by the user by writing a bad Sieve script involving the
    affected commands ("mailboxexists", "specialuse_exists").
    This can be triggered by the remote sender only when the user has
    written a Sieve script that passes message content to one of the
    affected commands.
  * sieve: Large sequences of 8-bit octets passed to certain Sieve
    commands that create or modify message headers that allow UTF-8 text
    (vacation, notify and addheader) can cause the delivery or IMAP
    process (when IMAPSieve is used) to enter a memory-consuming
    semi-infinite loop that ends when the process exceeds its memory
    limits. Logged in users can cause these hangs only for their own
    processes.
- Remove upstream applied pathces:
  0001-imap-Escape-tag-when-sending-it-to-imap-hibernate-pr.patch
  0001-lib-mail-message-parser-Fix-assert-crash-when-enforc.patch
  0002-imap-Add-unit-test-for-imap-client-hibernate.patch
  0002-lib-imap-Don-t-generate-invalid-BODYSTRUCTURE-when-r.patch
  CVE-2021-29157.patch
  CVE-2021-33515.patch</changelog>
</package>
<package pkgid="8f749e651ca5358eac09dd390357cba69a093d9bbcad18da66804edb426bde6c" name="doxygen" arch="aarch64">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Split documentation to separate package
- Do not bundle pdf documentation
- Generate html documentation</changelog>
  <changelog author="pgajdos@suse.com" date="1425297600">- remove doxygen-html.sh</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10
  * Change the build system to use cmake.
  * Add support for basic XML syntax highlighting
  * Added documentation for ``` style fenced code block and more
    robust parsing
  * Added function arguments to the LaTeX toc
  * Added support for language codes
  * etc. see http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- removed unneded patches:
  - doxygen-1.5.9-64archs.patch
  - doxygen-1.5.9-man.patch
  - doxygen-1.7.0-modify_footer.patch renamed to doxygen-modify_footer.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="pgajdos@suse.com" date="1444046400">- work around Power8 double free or corruption [bnc#921577]
  + doxygen-dot-one-thread.patch</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Do not link with -pie if we are not compiling with -fPIE</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1461240000">- same work around ppc64 as already done for ppc64le [boo#921577]</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- update patch doxygen-dot-one-thread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1480507200">- Fix: Add missing jquery.js, dynsections.js &amp; optional
  svgpan.js to QCH file [bsc#1011331]
  + doxygen-fix-QCH-files.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1485259200">- Added res2cc_sort_resources.diff, sort template files in
  generated resources.cpp for reproducible build, fixes bgo#777672</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13
- dropped doxygen-fix-QCH-files.patch, it is part of the release</changelog>
  <changelog author="dimstar@opensuse.org" date="1487592000">- Add doxygen-guard-null-variable.patch: Protected against NULL
  pointer of variable al, upstream commit 0f02761.</changelog>
  <changelog author="meissner@suse.com" date="1496404800">- remove CFLAGS CXXFLAGS overrides to block PIE enablement.</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Remove upstream merged doxygen-guard-null-variable.patch
- Refresh patch vhdlparser-no-return.patch
- Kill doxygen-doc subpackages the latex deps keep growing while
  it is really easy to download the generated pdfs from upstream</changelog>
</package>
<package pkgid="23d4e2be9d4a492969b789dd09d6802d74baa72739724a7fed8d1e889fa843e3" name="doxygen" arch="ppc64le">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Split documentation to separate package
- Do not bundle pdf documentation
- Generate html documentation</changelog>
  <changelog author="pgajdos@suse.com" date="1425297600">- remove doxygen-html.sh</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10
  * Change the build system to use cmake.
  * Add support for basic XML syntax highlighting
  * Added documentation for ``` style fenced code block and more
    robust parsing
  * Added function arguments to the LaTeX toc
  * Added support for language codes
  * etc. see http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- removed unneded patches:
  - doxygen-1.5.9-64archs.patch
  - doxygen-1.5.9-man.patch
  - doxygen-1.7.0-modify_footer.patch renamed to doxygen-modify_footer.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="pgajdos@suse.com" date="1444046400">- work around Power8 double free or corruption [bnc#921577]
  + doxygen-dot-one-thread.patch</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Do not link with -pie if we are not compiling with -fPIE</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1461240000">- same work around ppc64 as already done for ppc64le [boo#921577]</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- update patch doxygen-dot-one-thread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1480507200">- Fix: Add missing jquery.js, dynsections.js &amp; optional
  svgpan.js to QCH file [bsc#1011331]
  + doxygen-fix-QCH-files.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1485259200">- Added res2cc_sort_resources.diff, sort template files in
  generated resources.cpp for reproducible build, fixes bgo#777672</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13
- dropped doxygen-fix-QCH-files.patch, it is part of the release</changelog>
  <changelog author="dimstar@opensuse.org" date="1487592000">- Add doxygen-guard-null-variable.patch: Protected against NULL
  pointer of variable al, upstream commit 0f02761.</changelog>
  <changelog author="meissner@suse.com" date="1496404800">- remove CFLAGS CXXFLAGS overrides to block PIE enablement.</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Remove upstream merged doxygen-guard-null-variable.patch
- Refresh patch vhdlparser-no-return.patch
- Kill doxygen-doc subpackages the latex deps keep growing while
  it is really easy to download the generated pdfs from upstream</changelog>
</package>
<package pkgid="d5b85b57d662c03d5fe763cddc83c4d717b8114c37a5e8b0cf69fe108bcc7a1b" name="doxygen" arch="s390x">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Split documentation to separate package
- Do not bundle pdf documentation
- Generate html documentation</changelog>
  <changelog author="pgajdos@suse.com" date="1425297600">- remove doxygen-html.sh</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10
  * Change the build system to use cmake.
  * Add support for basic XML syntax highlighting
  * Added documentation for ``` style fenced code block and more
    robust parsing
  * Added function arguments to the LaTeX toc
  * Added support for language codes
  * etc. see http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- removed unneded patches:
  - doxygen-1.5.9-64archs.patch
  - doxygen-1.5.9-man.patch
  - doxygen-1.7.0-modify_footer.patch renamed to doxygen-modify_footer.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="pgajdos@suse.com" date="1444046400">- work around Power8 double free or corruption [bnc#921577]
  + doxygen-dot-one-thread.patch</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Do not link with -pie if we are not compiling with -fPIE</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1461240000">- same work around ppc64 as already done for ppc64le [boo#921577]</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- update patch doxygen-dot-one-thread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1480507200">- Fix: Add missing jquery.js, dynsections.js &amp; optional
  svgpan.js to QCH file [bsc#1011331]
  + doxygen-fix-QCH-files.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1485259200">- Added res2cc_sort_resources.diff, sort template files in
  generated resources.cpp for reproducible build, fixes bgo#777672</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13
- dropped doxygen-fix-QCH-files.patch, it is part of the release</changelog>
  <changelog author="dimstar@opensuse.org" date="1487592000">- Add doxygen-guard-null-variable.patch: Protected against NULL
  pointer of variable al, upstream commit 0f02761.</changelog>
  <changelog author="meissner@suse.com" date="1496404800">- remove CFLAGS CXXFLAGS overrides to block PIE enablement.</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Remove upstream merged doxygen-guard-null-variable.patch
- Refresh patch vhdlparser-no-return.patch
- Kill doxygen-doc subpackages the latex deps keep growing while
  it is really easy to download the generated pdfs from upstream</changelog>
</package>
<package pkgid="7bc52392652afa208ab07f72f53cbae3616f177f001c5c203654d016645c57cc" name="doxygen" arch="src">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="andreas.stieger@gmx.de" date="1409227200">- Doxygen 1.8.8
- New features:
  * Support for PlantUML
  * Add BREAD_CRUMB_TRAIL
- A selection of bug fixes and updates as listed in
  http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_8</changelog>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Split documentation to separate package
- Do not bundle pdf documentation
- Generate html documentation</changelog>
  <changelog author="pgajdos@suse.com" date="1425297600">- remove doxygen-html.sh</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10
  * Change the build system to use cmake.
  * Add support for basic XML syntax highlighting
  * Added documentation for ``` style fenced code block and more
    robust parsing
  * Added function arguments to the LaTeX toc
  * Added support for language codes
  * etc. see http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- removed unneded patches:
  - doxygen-1.5.9-64archs.patch
  - doxygen-1.5.9-man.patch
  - doxygen-1.7.0-modify_footer.patch renamed to doxygen-modify_footer.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="pgajdos@suse.com" date="1444046400">- work around Power8 double free or corruption [bnc#921577]
  + doxygen-dot-one-thread.patch</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Do not link with -pie if we are not compiling with -fPIE</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1461240000">- same work around ppc64 as already done for ppc64le [boo#921577]</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- update patch doxygen-dot-one-thread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1480507200">- Fix: Add missing jquery.js, dynsections.js &amp; optional
  svgpan.js to QCH file [bsc#1011331]
  + doxygen-fix-QCH-files.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1485259200">- Added res2cc_sort_resources.diff, sort template files in
  generated resources.cpp for reproducible build, fixes bgo#777672</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13
- dropped doxygen-fix-QCH-files.patch, it is part of the release</changelog>
  <changelog author="dimstar@opensuse.org" date="1487592000">- Add doxygen-guard-null-variable.patch: Protected against NULL
  pointer of variable al, upstream commit 0f02761.</changelog>
  <changelog author="meissner@suse.com" date="1496404800">- remove CFLAGS CXXFLAGS overrides to block PIE enablement.</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Remove upstream merged doxygen-guard-null-variable.patch
- Refresh patch vhdlparser-no-return.patch
- Kill doxygen-doc subpackages the latex deps keep growing while
  it is really easy to download the generated pdfs from upstream</changelog>
</package>
<package pkgid="6d0721ee0fda2ae183658fa53459bd1cf0e475c9ecdb5939218bd251d49ca016" name="doxygen" arch="x86_64">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Split documentation to separate package
- Do not bundle pdf documentation
- Generate html documentation</changelog>
  <changelog author="pgajdos@suse.com" date="1425297600">- remove doxygen-html.sh</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10
  * Change the build system to use cmake.
  * Add support for basic XML syntax highlighting
  * Added documentation for ``` style fenced code block and more
    robust parsing
  * Added function arguments to the LaTeX toc
  * Added support for language codes
  * etc. see http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- removed unneded patches:
  - doxygen-1.5.9-64archs.patch
  - doxygen-1.5.9-man.patch
  - doxygen-1.7.0-modify_footer.patch renamed to doxygen-modify_footer.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="pgajdos@suse.com" date="1444046400">- work around Power8 double free or corruption [bnc#921577]
  + doxygen-dot-one-thread.patch</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Do not link with -pie if we are not compiling with -fPIE</changelog>
  <changelog author="normand@linux.vnet.ibm.com" date="1461240000">- same work around ppc64 as already done for ppc64le [boo#921577]</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- update patch doxygen-dot-one-thread.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1480507200">- Fix: Add missing jquery.js, dynsections.js &amp; optional
  svgpan.js to QCH file [bsc#1011331]
  + doxygen-fix-QCH-files.patch</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1485259200">- Added res2cc_sort_resources.diff, sort template files in
  generated resources.cpp for reproducible build, fixes bgo#777672</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13
- dropped doxygen-fix-QCH-files.patch, it is part of the release</changelog>
  <changelog author="dimstar@opensuse.org" date="1487592000">- Add doxygen-guard-null-variable.patch: Protected against NULL
  pointer of variable al, upstream commit 0f02761.</changelog>
  <changelog author="meissner@suse.com" date="1496404800">- remove CFLAGS CXXFLAGS overrides to block PIE enablement.</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Remove upstream merged doxygen-guard-null-variable.patch
- Refresh patch vhdlparser-no-return.patch
- Kill doxygen-doc subpackages the latex deps keep growing while
  it is really easy to download the generated pdfs from upstream</changelog>
</package>
<package pkgid="2d69bbd789e169066b40d0db19296e1a1460715ba9666d029fa3d14fbdf265c1" name="doxywizard" arch="aarch64">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Enable tests</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10, see doxygen.changes
- move tests to doxygen.spec
- remove doxywizard-1.5.9-flex.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="pgajdos@suse.com" date="1451995201">- fix build after update</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Build against QT5 in newer products
- Do not link with -pie as we are not compiling with -fPIE</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13</changelog>
  <changelog author="foss@grueninger.de" date="1487764800">- Revert erroneous change of required CMake version</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Refresh patch vhdlparser-no-return.patch
- Use qt5 doxywizard even on leaps</changelog>
  <changelog author="dimstar@opensuse.org" date="1515153600">- Export LANG=C.UTF-8 before running the test suite. Python3 is
  kinda strict and generally expects an UTF8 terminal.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619092800">- remove explicit -fPIC from build flags, because this breaks our
  gcc-PIE compiler profile (bsc#1184122), resulting in a non-PIE
  /usr/bin/doxywizard.</changelog>
</package>
<package pkgid="0a8a0c97abc18d26d4bce92fefc7c33571a682e6f98e3601131de18bcff58114" name="doxywizard" arch="ppc64le">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Enable tests</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10, see doxygen.changes
- move tests to doxygen.spec
- remove doxywizard-1.5.9-flex.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="pgajdos@suse.com" date="1451995201">- fix build after update</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Build against QT5 in newer products
- Do not link with -pie as we are not compiling with -fPIE</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13</changelog>
  <changelog author="foss@grueninger.de" date="1487764800">- Revert erroneous change of required CMake version</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Refresh patch vhdlparser-no-return.patch
- Use qt5 doxywizard even on leaps</changelog>
  <changelog author="dimstar@opensuse.org" date="1515153600">- Export LANG=C.UTF-8 before running the test suite. Python3 is
  kinda strict and generally expects an UTF8 terminal.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619092800">- remove explicit -fPIC from build flags, because this breaks our
  gcc-PIE compiler profile (bsc#1184122), resulting in a non-PIE
  /usr/bin/doxywizard.</changelog>
</package>
<package pkgid="a1eb3ff593d46aa5160228e8ea85e8225ceea7fb92bd87792960da4a1e939211" name="doxywizard" arch="s390x">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Enable tests</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10, see doxygen.changes
- move tests to doxygen.spec
- remove doxywizard-1.5.9-flex.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="pgajdos@suse.com" date="1451995201">- fix build after update</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Build against QT5 in newer products
- Do not link with -pie as we are not compiling with -fPIE</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13</changelog>
  <changelog author="foss@grueninger.de" date="1487764800">- Revert erroneous change of required CMake version</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Refresh patch vhdlparser-no-return.patch
- Use qt5 doxywizard even on leaps</changelog>
  <changelog author="dimstar@opensuse.org" date="1515153600">- Export LANG=C.UTF-8 before running the test suite. Python3 is
  kinda strict and generally expects an UTF8 terminal.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619092800">- remove explicit -fPIC from build flags, because this breaks our
  gcc-PIE compiler profile (bsc#1184122), resulting in a non-PIE
  /usr/bin/doxywizard.</changelog>
</package>
<package pkgid="0ac315751d2edd4a0991cc13b5d0f94780269cbf9ead5c18740e603a2d2cff81" name="doxywizard" arch="src">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="pgajdos@suse.com" date="1377518400">- updated to 1.8.5:
  * Added SOURCE_TOOLTIPS option for advanced tooltip support while
    source browsing.
  * bugfixes</changelog>
  <changelog author="pgajdos@suse.com" date="1388664000">- updated to 1.8.6:
  * many bugfixes and features, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="pgajdos@suse.com" date="1399982400">- updated to 1.8.7:
  * many bugfixes and features, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1409227200">- Doxygen 1.8.8
- New features:
  * Support for PlantUML
  * Add BREAD_CRUMB_TRAIL
- A selection of bug fixes and updates as listed in
  http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_8</changelog>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Enable tests</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10, see doxygen.changes
- move tests to doxygen.spec
- remove doxywizard-1.5.9-flex.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="pgajdos@suse.com" date="1451995201">- fix build after update</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Build against QT5 in newer products
- Do not link with -pie as we are not compiling with -fPIE</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13</changelog>
  <changelog author="foss@grueninger.de" date="1487764800">- Revert erroneous change of required CMake version</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Refresh patch vhdlparser-no-return.patch
- Use qt5 doxywizard even on leaps</changelog>
  <changelog author="dimstar@opensuse.org" date="1515153600">- Export LANG=C.UTF-8 before running the test suite. Python3 is
  kinda strict and generally expects an UTF8 terminal.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619092800">- remove explicit -fPIC from build flags, because this breaks our
  gcc-PIE compiler profile (bsc#1184122), resulting in a non-PIE
  /usr/bin/doxywizard.</changelog>
</package>
<package pkgid="76af6032606f042312836f2e325c374b92024f7c1cad2552cada92c2bc32453c" name="doxywizard" arch="x86_64">
  <version epoch="0" ver="1.8.14" rel="3.3.1"/>
  <changelog author="mpluskal@suse.com" date="1423224000">- Update to 1.8.9.1:
  * bugfix releas, see
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
    for details</changelog>
  <changelog author="mpluskal@suse.com" date="1424433600">- Cleanup spec file with spec-cleaner
- Enable tests</changelog>
  <changelog author="pgajdos@suse.com" date="1439812800">- updated to 1.8.10, see doxygen.changes
- move tests to doxygen.spec
- remove doxywizard-1.5.9-flex.patch</changelog>
  <changelog author="tchvatal@suse.com" date="1440158400">- Set proper minimal cmake version required
- Use system stack for cmake params and obey cflags
- Add patch to build required static libs:
  * doxygen-no-shared-libs.patch
- Refresh patch:
  * doxygen-no-lowercase-man-names.patch
- Add patch to avoid no-return-in-nonvoid function error:
  * vhdlparser-no-return.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1440676800">- Move checks to doxywizard package to avoid build cycle</changelog>
  <changelog author="foss@grueninger.de" date="1451995200">- Update to 1.8.11
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html
- Update patch vhdlparser-no-return.patch
- Remove patch doxygen-no-shared-libs.patch which is included
  in upstream</changelog>
  <changelog author="pgajdos@suse.com" date="1451995201">- fix build after update</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1456056000">- Build against QT5 in newer products
- Do not link with -pie as we are not compiling with -fPIE</changelog>
  <changelog author="foss@grueninger.de" date="1473163200">- Update to 1.8.12
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html</changelog>
  <changelog author="foss@grueninger.de" date="1487073600">- Update to 1.8.13
  See changelog at http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_13</changelog>
  <changelog author="foss@grueninger.de" date="1487764800">- Revert erroneous change of required CMake version</changelog>
  <changelog author="mpluskal@suse.com" date="1510056000">- Explicitly require python2 for building
- Use more cmake macros
- Run spec-cleaner</changelog>
  <changelog author="mpluskal@suse.com" date="1510315200">- Update licensing information</changelog>
  <changelog author="tchvatal@suse.com" date="1514980800">- Update to 1.8.14:
  * Many fixes during the one year development cycle:
    http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_14
- Switch to python3 instead of python2
- Refresh patch vhdlparser-no-return.patch
- Use qt5 doxywizard even on leaps</changelog>
  <changelog author="dimstar@opensuse.org" date="1515153600">- Export LANG=C.UTF-8 before running the test suite. Python3 is
  kinda strict and generally expects an UTF8 terminal.</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619092800">- remove explicit -fPIC from build flags, because this breaks our
  gcc-PIE compiler profile (bsc#1184122), resulting in a non-PIE
  /usr/bin/doxywizard.</changelog>
</package>
<package pkgid="c60dc3ce4108218d5c8b0d87d33171a466b4e8839960b5de0aceb5d7ac77c19e" name="dpdk" arch="aarch64">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="ac6890fcd400cb43c5e5d3eec8bfc75a496c2d5bf59932077edb42bf243ce6ba" name="dpdk" arch="ppc64le">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="42f552b4128529a5aa0fbc6cbc023ef8432ad5219c5331610a6c484cccf033fe" name="dpdk" arch="src">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="bfd140369f495e8a6c109914033f1bb8078d88812ee7faad9c51373deddd3d19" name="dpdk" arch="x86_64">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="8be395896c063865debf77c0509153920fe7c15ada66106ec0032454268daf81" name="dpdk-devel" arch="aarch64">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="f7798319623eb0fba80ea5873c6df1e22125b226678d40c946d30086bebaeec3" name="dpdk-devel" arch="ppc64le">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="0dbbec2b2739fb132375dc7d11584413bb448bd586047d50cd8f450a08d93580" name="dpdk-devel" arch="x86_64">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="c3e89492837b5bce702b2684db0dcf9aedfb6070062625f6b6683c5b22c330a5" name="dpdk-doc" arch="noarch">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="1db1ab63f70c747ee5bab0bcd26bdab148e9433ae68df62ed1ef3a8ca963bfcd" name="dpdk-examples" arch="aarch64">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="1043fdb55a610d4303ab734b1c37b8068c20f117999eec6bfc79e1eee16ec212" name="dpdk-examples" arch="ppc64le">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="7514c65c13a7e5676a8a255d8e2b50d0de168c4b31196225cb6cfee10af9d9dd" name="dpdk-examples" arch="x86_64">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="429fe84b70fba80e680e638e280eece0abeeb99d9c1fe2b87c64cbded2e18d18" name="dpdk-kmp-default" arch="aarch64">
  <version epoch="0" ver="19.11.4_k5.3.18_59.5" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="dddf63c1e3f34825facd3f8b15366f9ddc2f3e90aaabb52bd452bfbe108a4e03" name="dpdk-kmp-default" arch="ppc64le">
  <version epoch="0" ver="19.11.4_k5.3.18_59.5" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="8d463386bb52d15c337483d77b1056c7b965768c2bca0adf834b3cbb6656f4e9" name="dpdk-kmp-default" arch="x86_64">
  <version epoch="0" ver="19.11.4_k5.3.18_59.5" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="e69537a1de62fe8a49e763d1d114f74c514cf049048de8b1e0d727c42572cba4" name="dpdk-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="19.11.4_k5.3.18_59.5" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="ff1948817d9a98da462a5865f8b98a0c3d709f9be1fc7a1880bdc064a1668482" name="dpdk-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="19.11.4_k5.3.18_59.5" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="3d1d173c1c1674fbace9674fc72080aebee0a756b956ca09a00920f34aed8e5c" name="dpdk-tools" arch="aarch64">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="071bcc0a27cc8755411178dea236aaa8e3235f4e502d5ace40573b78603587f7" name="dpdk-tools" arch="ppc64le">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="7545875b31704aebc404c14a2502ee24f1e4e7f8de0a3093126a6c6dfebf0c9c" name="dpdk-tools" arch="x86_64">
  <version epoch="0" ver="19.11.4" rel="6.1"/>
  <changelog author="marco.varlese@suse.de" date="1520337600">- Removed 0002-kni-fix-build-on-SLE12-SP3.patch since no longer referenced in .spec files
- Added 0002-dpdk-eal-ppc-rte_smp_mb.patch to fix an issue on ppc64le platforms with v18.02
- Updated to version 18.02; some of the changes include:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx5 driver
  * Updated mlx4 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added Wireless Base Band Device (bbdev) abstraction
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added new pipeline use case for dpdk-test-eventdev application
  * Updated Eventdev sample application to support event devices based on capability
  * Added Rawdev, a generic device support library
  * Added new multi-process communication channel
  * Added GRO support for VxLAN-tunneled packets
  * Increased default Rx and Tx ring size in sample applications
  * Added new DPDK build system using the tools ?meson? and ?ninja? [EXPERIMENTAL]</changelog>
  <changelog author="ndas@suse.de" date="1524225600">- Enable MLX4/5 PMD only in Factory and &gt;= SLES15
  It needs rdma-core &gt;= v16.</changelog>
  <changelog author="marco.varlese@suse.com" date="1524484800">- Update to 18.02.1
- Restrict untrusted guest to misuse virtio to corrupt
  host application(ovs-dpdk) memory which can lead all VM to lose
  connectivity(CVE-2018-1059,bsc#1089638).
  Changes:
  * Add deprecation notice for rte_vhost_gpa_to_vva()
  * Patch vhost-net and vhost-scsi examples
  * Fixes checkpatch warnings
  * Take VIRTIO_RING_F_EVENT_IDX into account when ring size (Tiwei)
  * Fix next chuncks translation access rights in Rx paths (Tiwei)
  * vhost: fix indirect descriptors table translation size
  * vhost: check all range is mapped when translating GPAs
  * vhost: introduce safe API for GPA translation
  * vhost: ensure all range is mapped when translating QVAs
  * vhost: add support for non-contiguous indirect descs tables
  * vhost: handle virtually non-contiguous buffers in Tx
  * vhost: handle virtually non-contiguous buffers in Rx
  * vhost: handle virtually non-contiguous buffers in Rx-mrg
  * examples/vhost: move to safe GPA translation API
  * examples/vhost_scsi: move to safe GPA translation API
  * vhost/crypto: move to safe GPA translation API
  * vhost: deprecate unsafe GPA translation API</changelog>
  <changelog author="marco.varlese@suse.com" date="1529323200">- Update to 18.02.2; some of the changes are:
  * Added function to allow releasing internal EAL resources on exit
  * Added igb, ixgbe and i40e ethernet driver to support RSS with flow API
  * Updated i40e driver to support PPPoE/PPPoL2TP
  * Added MAC loopback support for i40e
  * Added support of run time determination of number of queues per i40e VF
  * Updated mlx4/mlx5 driver
  * Added NVGRE and UDP tunnels support in Solarflare network PMD
  * Added AVF (Adaptive Virtual Function) net PMD
  * Added feature supports for live migration from vhost-net to vhost-user
  * Updated the AESNI-MB PMD
  * Updated the DPAA_SEC crypto driver to support rte_security
  * Added New eventdev Ordered Packet Distribution Library (OPDL) PMD
  * Added GRO support for VxLAN-tunneled packets
- Removed 0002-dpdk-eal-ppc-rte_smp_mb.patch since incorporated
  upstream</changelog>
  <changelog author="marco.varlese@suse.com" date="1535544000">- Fixed a syntax error affecting csh environment configuration(bsc#1102310)</changelog>
  <changelog author="marco.varlese@suse.com" date="1537790400">- Fixed a problem with ABI compatibility; API/ABI compatibility is
  guaranteed by DPDK upstream community across subsequent bug-fix
  releases. However, the .spec file broke it by defining the wrong
  version which included also the bug-fix release number.
- Fixed a naming issue with library: did not reflect soname</changelog>
  <changelog author="ndas@suse.de" date="1540468800">- Enable missed MLX PMDs for SLE12SP4 (bsc#1112307)</changelog>
  <changelog author="ndas@suse.de" date="1548331200">- Update to 18.11; some of the changes are(fate#325916, fate#325951 fate#326025, fate#326992, bsc#1134968, jira#SLE-4715) :
  * Added support for using externally allocated memory in DPDK.
  * Added check for ensuring allocated memory is addressable by devices.
  * Updated the C11 memory model version of the ring library.
  * Added NXP CAAM JR PMD.
  * Added support for GEN3 devices to Intel QAT driver.
  * Added Distributed Software Eventdev PMD.
  * Updated KNI kernel module, rte_kni library, and KNI sample application.
  * Add a new sample application for vDPA.
  * Updated mlx5 driver.
  * * Improved security of PMD to prevent the NIC from getting stuck when the application misbehaves.
  * * Reworked flow engine to supported e-switch flow rules (transfer attribute).
  * * Added support for header re-write(L2-L4), VXLAN encap/decap, count, match on TCP flags and multiple flow groups with e-switch flow rules.
  * * Added support for match on metadata, VXLAN and MPLS encap/decap with flow rules.
  * * Added support for RTE_ETH_DEV_CLOSE_REMOVE flag to provide better support for representors.
  * * Added support for meson build.
  * * Fixed build issue with PPC.
  * * Added support for BlueField VF.
  * * Added support for externally allocated static memory for DMA.
  all the changes can be viwed in http://doc.dpdk.org/guides/rel_notes/release_18_11.html
  [- 0001-enic-fix-Type-punning-and-strict-aliasing-warning.patch]</changelog>
  <changelog author="ndas@suse.de" date="1550836800">- Add  0002-fix-cpu-compatibility.patch to address issue with older
  CPUs (bsc#1125961, bsc#1099474)
  [+ 0002-fix-cpu-compatibility.patch]</changelog>
  <changelog author="ndas@suse.de" date="1552046400">- remove -Wno-error=array-bounds as its no longer needed
- disable i586 build because lack of sse support</changelog>
  <changelog author="ndas@suse.de" date="1556539200">- Add missing libmnl-devel</changelog>
  <changelog author="ndas@suse.de" date="1560772800">- Minor Update to 18.11.2
  * List of fixes can be found in
    https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes</changelog>
  <changelog author="jcaamano@suse.com" date="1569844800">- Changed to multibuild (bsc#1151455).
- Added dpdk-fix-implicit-fallthrough-warning.patch to address build error with
  recent kernels (bsc#1144704).</changelog>
  <changelog author="jcaamano@suse.com" date="1574164800">- Add version to the PMD driver directory to avoid loading previous
  version drivers (bsc#1157179).
- Update to 18.11.3 (bsc#1156146). For a list of fixes check:
  * https://doc.dpdk.org/guides-18.11/rel_notes/release_18_11.html#fixes
- Add patches to fix vulnerability where malicious container can trigger
  a denial of service (CVE-2019-14818, bsc#1156146)
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
- Removed patrches already included upstream:
  * dpdk-fix-implicit-fallthrough-warning.patch</changelog>
  <changelog author="sweiberg@suse.com" date="1583150400">- Change constraint to ssse3 to fix build issues on x86_64 and i586</changelog>
  <changelog author="jcaamano@suse.com" date="1588161600">- Update to v19.11.1. For a list of changes, check:
  * https://doc.dpdk.org/guides/rel_notes/release_19_11.html#new-features
- Removed patches no longer applying to the code base:
  * 0001-vhost-fix-possible-denial-of-service-on-SET_VRING_NU.patch
  * 0002-vhost-fix-possible-denial-of-service-by-leaking-FDs.patch
  * 0002-fix-cpu-compatibility.patch
- Rebased patches:
  * 0001-fix-cpu-compatibility.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1589889600">- Add patches to fix vulnerability where malicious guest/container can
  cause resource leak resulting a Denial-of-Service, or memory corruption
  and crash, or information leak in vhost-user backend application
  (bsc#1171477, CVE-2020-10722, CVE-2020-10723, CVE-2020-10724,
  CVE-2020-10725, CVE-2020-10726).
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="dmueller@suse.com" date="1597147200">- update to v19.11.3:
    app/crypto-perf: fix display of sample test vector
    app/eventdev: check Tx adapter service ID
    app: fix usage help of options separated by dashes
    app/pipeline: fix build with gcc 10
    app: remove extra new line after link duplex
    app/testpmd: add parsing for QinQ VLAN headers
    app/testpmd: fix DCB set
    app/testpmd: fix memory failure handling for i40e DDP
    app/testpmd: fix PPPoE flow command
    app/testpmd: fix statistics after reset
    baseband/turbo_sw: fix exposed LLR decimals assumption
    bbdev: fix doxygen comments
    build: disable gcc 10 zero-length-bounds warning
    build: fix linker warnings with clang on Windows
    build: support MinGW-w64 with Meson
    buildtools: get static mlx dependencies for meson
    bus/fslmc: fix dereferencing null pointer
    bus/fslmc: fix size of qman fq descriptor
    bus/pci: fix devargs on probing again
    bus/pci: fix UIO resource access from secondary process
    bus/vmbus: fix comment spelling
    ci: fix telemetry dependency in Travis
    common/iavf: update copyright
    common/mlx5: fix build with -fno-common
    common/mlx5: fix build with rdma-core 21
    common/mlx5: fix netlink buffer allocation from stack
    common/mlx5: fix umem buffer alignment
    common/octeontx: fix gcc 9.1 ABI break
    common/qat: fix GEN3 marketing name
    contigmem: cleanup properly when load fails
    crypto/caam_jr: fix check of file descriptors
    crypto/caam_jr: fix IRQ functions return type
    crypto/ccp: fix fd leak on probe failure
    cryptodev: add asymmetric session-less feature name
    cryptodev: fix missing device id range checking
    cryptodev: fix SHA-1 digest enum comment
    crypto/kasumi: fix extern declaration
    crypto/nitrox: fix CSR register address generation
    crypto/nitrox: fix oversized device name
    crypto/octeontx2: fix build with gcc 10
    crypto/openssl: fix out-of-place encryption
    crypto/qat: fix cipher descriptor for ZUC and SNOW
    crypto/qat: support plain SHA1..SHA512 hashes
    devtools: fix symbol map change check
    doc: add i40e limitation for flow director
    doc: add NASM installation steps
    doc: fix API index
    doc: fix build issue in ABI guide
    doc: fix build with doxygen 1.8.18
    doc: fix default symbol binding in ABI guide
    doc: fix log level example in Linux guide
    doc: fix LTO config option
    doc: fix matrix CSS for recent sphinx
    doc: fix multicast filter feature announcement
    doc: fix number of failsafe sub-devices
    doc: fix reference in ABI guide
    doc: fix sphinx compatibility
    doc: fix typo in contributors guide
    doc: fix typo in contributors guide
    doc: fix typos in ABI policy
    doc: prefer https when pointing to dpdk.org
    drivers: add crypto as dependency for event drivers
    drivers/crypto: disable gcc 10 no-common errors
    drivers/crypto: fix build with make 4.3
    drivers/crypto: fix log type variables for -fno-common
    drivers: fix log type variables for -fno-common
    eal/arm64: fix precise TSC
    eal: fix C++17 compilation
    eal: fix comments spelling
    eal: fix log message print for regex
    eal: fix PRNG init with HPET enabled
    eal: fix typo in endian conversion macros
    eal/freebsd: fix queuing duplicate alarm callbacks
    eal/ppc: fix bool type after altivec include
    eal/ppc: fix build with gcc 9.3
    eal/x86: ignore gcc 10 stringop-overflow warnings
    ethdev: fix build when vtune profiling is on
    ethdev: fix spelling
    eventdev: fix probe and remove for secondary process
    event/dsw: avoid reusing previously recorded events
    event/dsw: fix enqueue burst return value
    event/dsw: remove redundant control ring poll
    event/dsw: remove unnecessary read barrier
    event/octeontx2: fix build for O1 optimization
    event/octeontx2: fix queue removal from Rx adapter
    examples/eventdev: fix build with gcc 10
    examples/eventdev: fix crash on exit
    examples/fips_validation: fix parsing of algorithms
    examples/ip_pipeline: remove check of null response
    examples/ipsec-gw: fix gcc 10 maybe-uninitialized warning
    examples/kni: fix crash during MTU set
    examples/kni: fix MTU change to setup Tx queue
    examples/l2fwd-keepalive: fix mbuf pool size
    examples/qos_sched: fix build with gcc 10
    examples: remove extra new line after link duplex
    examples/vhost_blk: fix build with gcc 10
    examples/vmdq: fix output of pools/queues
    examples/vmdq: fix RSS configuration
    examples/vm_power: drop Unix path limit redefinition
    examples/vm_power: fix build with -fno-common
    fib: fix headers for C++ support
    fix same typo in multiple places
    fix various typos found by Lintian
    ipsec: check SAD lookup error
    ipsec: fix build dependency on hash lib
    kvargs: fix buffer overflow when parsing list
    kvargs: fix invalid token parsing on FreeBSD
    kvargs: fix strcmp helper documentation
    log: fix level picked with globbing on type register
    lpm6: fix comments spelling
    lpm6: fix size of tbl8 group
    mem: fix overflow on allocation
    mem: mark pages as not accessed when freeing memory
    mem: mark pages as not accessed when reserving VA
    mempool/dpaa2: install missing header with meson
    mempool/octeontx2: fix build for gcc O1 optimization
    mempool: remove inline functions from export list
    mem: preallocate VA space in no-huge mode
    mk: fix static linkage of mlx dependency
    net/avp: fix gcc 10 maybe-uninitialized warning
    net/bnxt: do not use PMD log type
    net/bnxt: fix error log for command timeout
    net/bnxt: fix FW version query
    net/bnxt: fix HWRM command during FW reset
    net/bnxt: fix max ring count
    net/bnxt: fix memory leak during queue restart
    net/bnxt: fix number of TQM ring
    net/bnxt: fix port start failure handling
    net/bnxt: fix possible stack smashing
    net/bnxt: fix Rx ring producer index
    net/bnxt: fix storing MAC address twice
    net/bnxt: fix TQM ring context memory size
    net/bnxt: fix using RSS config struct
    net/bnxt: fix VLAN add when port is stopped
    net/bnxt: fix VNIC Rx queue count on VNIC free
    net/bnxt: use true/false for bool types
    net/dpaa2: fix 10G port negotiation
    net/dpaa2: fix congestion ID for multiple traffic classes
    net/dpaa: use dynamic log type
    net/e1000: fix port hotplug for multi-process
    net/ena/base: fix documentation of functions
    net/ena/base: fix indentation in CQ polling
    net/ena/base: fix indentation of multiple defines
    net/ena/base: fix testing for supported hash function
    net/ena/base: make allocation macros thread-safe
    net/ena/base: prevent allocation of zero sized memory
    net/ena: fix build for O1 optimization
    net/ena: set IO ring size to valid value
    net/enetc: fix Rx lock-up
    net/enic: fix flow action reordering
    net/failsafe: fix fd leak
    net/hinic: allocate IO memory with socket id
    net/hinic/base: fix PF firmware hot-active problem
    net/hinic/base: fix port start during FW hot update
    net/hinic: fix LRO
    net/hinic: fix queues resource free
    net/hinic: fix repeating cable log and length check
    net/hinic: fix snprintf length of cable info
    net/hinic: fix TSO
    net/hinic: fix Tx mbuf length while copying
    net/hns3: add free threshold in Rx
    net/hns3: add RSS hash offload to capabilities
    net/hns3: clear residual flow rules on init
    net/hns3: fix configuring illegal VLAN PVID
    net/hns3: fix configuring RSS hash when rules are flushed
    net/hns3: fix crash when flushing RSS flow rules with FLR
    net/hns3: fix default error code of command interface
    net/hns3: fix default VLAN filter configuration for PF
    net/hns3: fix mailbox opcode data type
    net/hns3: fix MSI-X interrupt during initialization
    net/hns3: fix packets offload features flags in Rx
    net/hns3: fix promiscuous mode for PF
    net/hns3: fix return value of setting VLAN offload
    net/hns3: fix return value when clearing statistics
    net/hns3: fix RSS indirection table configuration
    net/hns3: fix RSS key length
    net/hns3: fix Rx interrupt after reset
    net/hns3: fix status after repeated resets
    net/hns3: fix Tx interrupt when enabling Rx interrupt
    net/hns3: fix VLAN filter when setting promisucous mode
    net/hns3: fix VLAN PVID when configuring device
    net/hns3: reduce judgements of free Tx ring space
    net/hns3: remove one IO barrier in Rx
    net/hns3: remove unnecessary assignments in Tx
    net/hns3: replace memory barrier with data dependency order
    net/hns3: support different numbers of Rx and Tx queues
    net/hns3: support Rx interrupt
    net/i40e/base: update copyright
    net/i40e: fix flow director enabling
    net/i40e: fix flow director for ARP packets
    net/i40e: fix flow director initialisation
    net/i40e: fix flush of flow director filter
    net/i40e: fix queue region in RSS flow
    net/i40e: fix queue related exception handling
    net/i40e: fix setting L2TAG
    net/i40e: fix wild pointer
    net/i40e: fix X722 performance
    net/i40e: relax barrier in Tx
    net/i40e: relax barrier in Tx for NEON
    net/iavf: fix link speed
    net/iavf: fix setting L2TAG
    net/iavf: fix stats query error code
    net/ice: add action number check for switch
    net/ice/base: check memory pointer before copying
    net/ice/base: fix binary order for GTPU filter
    net/ice/base: fix MAC write command
    net/ice/base: fix uninitialized stack variables
    net/ice/base: minor fixes
    net/ice/base: read PSM clock frequency from register
    net/ice/base: remove unused code in switch rule
    net/ice/base: update copyright
    net/ice: change default tunnel type
    net/ice: fix crash in switch filter
    net/ice: fix hash flow crash
    net/ice: fix input set of VLAN item
    net/ice: fix RSS advanced rule
    net/ice: fix RSS for GTPU
    net/ice: fix setting L2TAG
    net/ice: fix variable initialization
    net/ice: remove bulk alloc option
    net/ice: remove unnecessary variable
    net/ice: support mark only action for flow director
    net/ipn3ke: use control thread to check link status
    net/ixgbe/base: update copyright
    net/ixgbe: check driver type in MACsec API
    net/ixgbe: fix link state timing on fiber ports
    net/ixgbe: fix link status after port reset
    net/ixgbe: fix link status inconsistencies
    net/ixgbe: fix link status synchronization on BSD
    net/ixgbe: fix resource leak after thread exits normally
    net/ixgbe: fix statistics in flow control mode
    net/memif: fix init when already connected
    net/memif: fix resource leak
    net/mlx4: fix build with -fno-common
    net/mlx4: fix drop queue error handling
    net/mlx5: add device parameter for MPRQ stride size
    net/mlx5: add multi-segment packets in MPRQ mode
    net/mlx5: enable MPRQ multi-stride operations
    net/mlx5: fix actions validation on root table
    net/mlx5: fix assert in doorbell lookup
    net/mlx5: fix assert in dynamic metadata handling
    net/mlx5: fix assert in modify converting
    net/mlx5: fix build with separate glue lib for dlopen
    net/mlx5: fix call to modify action without init item
    net/mlx5: fix counter container usage
    net/mlx5: fix crash when releasing meter table
    net/mlx5: fix CVLAN tag set in IP item translation
    net/mlx5: fix doorbell bitmap management offsets
    net/mlx5: fix gcc 10 enum-conversion warning
    net/mlx5: fix header modify action validation
    net/mlx5: fix imissed counter overflow
    net/mlx5: fix jump table leak
    net/mlx5: fix mask used for IPv6 item validation
    net/mlx5: fix matching for UDP tunnels with Verbs
    net/mlx5: fix match on empty VLAN item in DV mode
    net/mlx5: fix metadata for compressed Rx CQEs
    net/mlx5: fix meter color register consideration
    net/mlx5: fix meter suffix table leak
    net/mlx5: fix packet length assert in MPRQ
    net/mlx5: fix push VLAN action to use item info
    net/mlx5: fix RSS enablement
    net/mlx5: fix RSS key copy to TIR context
    net/mlx5: fix Tx queue release debug log timing
    net/mlx5: fix validation of push VLAN without full mask
    net/mlx5: fix validation of VXLAN/VXLAN-GPE specs
    net/mlx5: fix VLAN flow action with wildcard VLAN item
    net/mlx5: fix VLAN ID check
    net/mlx5: fix VLAN PCP item calculation
    net/mlx5: fix zero metadata action
    net/mlx5: fix zero value validation for metadata
    net/mlx5: improve logging of MPRQ selection
    net/mlx5: reduce Tx completion index memory loads
    net/mlx5: set dynamic flow metadata in Rx queues
    net/mlx5: update VLAN and encap actions validation
    net/mlx5: use open/read/close for ib stats query
    net/mvneta: do not use PMD log type
    net/mvpp2: fix build with gcc 10
    net/netvsc: avoid possible live lock
    net/netvsc: do not configure RSS if disabled
    net/netvsc: do RSS across Rx queue only
    net/netvsc: fix comment spelling
    net/netvsc: fix memory free on device close
    net/netvsc: handle Rx packets during multi-channel setup
    net/netvsc: handle Tx completions based on burst size
    net/netvsc: propagate descriptor limits from VF
    net/netvsc: remove process event optimization
    net/netvsc: split send buffers from Tx descriptors
    net/nfp: fix dangling pointer on probe failure
    net/nfp: fix log format specifiers
    net/null: fix secondary burst function selection
    net/null: remove redundant check
    net/octeontx2: disable unnecessary error interrupts
    net/octeontx2: enable error and RAS interrupt in configure
    net/octeontx2: fix buffer size assignment
    net/octeontx2: fix device configuration sequence
    net/octeontx2: fix link information for loopback port
    net/octeontx: fix dangling pointer on init failure
    net/octeontx: fix meson build for disabled drivers
    net/pfe: do not use PMD log type
    net/pfe: fix double free of MAC address
    net/qede: fix link state configuration
    net/qede: fix port reconfiguration
    net/ring: fix device pointer on allocation
    net/sfc/base: fix build when EVB is enabled
    net/sfc/base: fix manual filter delete in EF10
    net/sfc/base: handle manual and auto filter clashes in EF10
    net/sfc/base: reduce filter priorities to implemented only
    net/sfc/base: refactor filter lookup loop in EF10
    net/sfc/base: reject automatic filter creation by users
    net/sfc/base: use simpler EF10 family conditional check
    net/sfc/base: use simpler EF10 family run-time checks
    net/sfc: fix initialization error path
    net/sfc: fix promiscuous and allmulticast toggles errors
    net/sfc: fix reported promiscuous/multicast mode
    net/sfc: fix Rx queue start failure path
    net/sfc: set priority of created filters to manual
    net/softnic: fix memory leak for thread
    net/softnic: fix resource leak for pipeline
    net/tap: do not use PMD log type
    net/tap: fix check for mbuf number of segment
    net/tap: fix crash in flow destroy
    net/tap: fix fd leak on creation failure
    net/tap: fix file close on remove
    net/tap: fix mbuf and mem leak during queue release
    net/tap: fix mbuf double free when writev fails
    net/tap: fix queues fd check before close
    net/tap: fix unexpected link handler
    net/tap: remove unused assert
    net/thunderx: use dynamic log type
    net/vhost: fix potential memory leak on close
    net/virtio: do not use PMD log type
    net/virtio: fix crash when device reconnecting
    net/virtio: fix outdated comment
    net/virtio: fix unexpected event after reconnect
    net/virtio-user: fix devargs parsing
    net/vmxnet3: fix RSS setting on v4
    net/vmxnet3: handle bad host framing
    pci: accept 32-bit domain numbers
    pci: fix build on FreeBSD
    pci: fix build on ppc
    pci: reject negative values in PCI id
    pci: remove unneeded includes in public header file
    remove references to private PCI probe function
    Revert ?common/qat: fix GEN3 marketing name?
    Revert ?net/bnxt: fix number of TQM ring?
    Revert ?net/bnxt: fix TQM ring context memory size?
    security: fix crash at accessing non-implemented ops
    security: fix return types in documentation
    security: fix session counter
    security: fix verification of parameters
    service: fix crash on exit
    service: fix identification of service running on other lcore
    service: fix race condition for MT unsafe service
    service: remove rte prefix from static functions
    telemetry: fix port stats retrieval
    test/crypto: fix flag check
    test/crypto: fix statistics case
    test: fix build with gcc 10
    test/flow_classify: enable multi-sockets system
    test/ipsec: fix crash in session destroy
    test/kvargs: fix invalid cases check
    test/kvargs: fix to consider empty elements as valid
    test: load drivers when required
    test: remove redundant macro
    test: skip some subtests in no-huge mode
    timer: protect initialization with lock
    usertools: check for pci.ids in /usr/share/misc
    vfio: fix race condition with sysfs
    vfio: fix use after free with multiprocess
    vhost/crypto: add missing user protocol flag
    vhost: fix packed ring zero-copy
    vhost: fix peer close check
    vhost: fix shadowed descriptors not flushed
    vhost: fix shadow update
    vhost: fix zero-copy server mode
    vhost: handle mbuf allocation failure
    vhost: make IOTLB cache name unique among processes
    vhost: prevent zero-copy with incompatible client mode
    vhost: remove unused variable
- remove the security backport patches as they're already included
  upstream:
  * 0001-vhost-check-log-mmap-offset-and-size-overflow.patch
  * 0002-vhost-fix-vring-index-check.patch
  * 0003-vhost-crypto-validate-keys-lengths.patch
  * 0004-vhost-fix-translated-address-not-checked.patch
  * 0005-vhost-fix-potential-memory-space-leak.patch
  * 0006-vhost-fix-potential-fd-leak.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1600776000">- Update to 19.11.4. For a list of fixes check:
  https://doc.dpdk.org/guides-19.11/rel_notes/release_19_11.html#id8
- Add patch to resolve build error reported in Staging:E project
  where a kernel backport (jsc#SLE-13536) introduced backward
  incompatible changes to the API that break kni module build
  * 0001-SLE15-SP3-compatibility-patch-for-kni.patch</changelog>
  <changelog author="jcaamano@suse.com" date="1601380800">- Add patches to fix vulnerability where malicious guest can harm the host
  using vhost crypto, this includes executing code in host (VM Escape),
  reading host application memory space to guest and causing partially
  denial of service in the host (bsc#1176590).
  * 0001-vhost-crypto-fix-pool-allocation.patch
  * 0002-vhost-crypto-fix-incorrect-descriptor-deduction.patch
  * 0003-vhost-crypto-fix-missed-request-check-for-copy-mode.patch
  * 0004-vhost-crypto-fix-incorrect-write-back-source.patch
  * 0005-vhost-crypto-fix-data-length-check.patch
  * 0006-vhost-crypto-fix-possible-TOCTOU-attack.patch</changelog>
</package>
<package pkgid="ac15700f50cb987072975a8e872d0296faa37dfaa272a615a2999ea94958d786" name="dracut" arch="aarch64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="78ed39286846ec3688487b74f582e64735322f04095ef0880ee335318972086b" name="dracut" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="231657911a01de1253c35272a15050be2fd0717376078ba21e90ddccf4dc1c2d" name="dracut" arch="s390x">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="ef51970b43644d81f51ca5f40ba04ada1f39f015be05f07c114609b4524472de" name="dracut" arch="src">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="faff5dbc76d9f0b999795ae07120468620709fdef316740d6a61fe8cd0756e27" name="dracut" arch="x86_64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="c778b07c36475bce23209dfc5dd688057cf7850931a3c4125a5d46e171292902" name="dracut" arch="aarch64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="94095a3b2a7c527853bc15a4fd03206df6c3ffa4909811088c994536129f349f" name="dracut" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="b6adc5dc01751f1a6c40fbc83bfad269387fd256bce22b7ce51a39335c94ec14" name="dracut" arch="s390x">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="cc40fe7aea5dbdad0b2b88c7a1bf64135f58a70bb5fdb2a24611ab3235802acb" name="dracut" arch="src">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="2bc6f84cee104b0e09671480b7fbcd4de4376780d64614067de88451e1113739" name="dracut" arch="x86_64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="052be74af6e5a977788fe05c1dac2623da998ae6d936d89489bccf7abb3c0594" name="dracut-extra" arch="aarch64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="67520171134a32f6541e8654f08e7b4bde7da20cc99cee747caf35cc6ceeded3" name="dracut-extra" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="67fbdaf808426126313c221bfc4f4da4efd2d1f2e6b7e0b9e2dbfaf2992d6114" name="dracut-extra" arch="s390x">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="9b014e8665c6a0da47ae29fb77d7c7d997a9139086c272cc905eadf3a1e6e465" name="dracut-extra" arch="x86_64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="37d7d28357ac5ebbcb377a87054c7eb8f1381ecb46079af70ede6a8861ca0c73" name="dracut-extra" arch="aarch64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="08233699fe4b8c4443291f626f01ff166568ec604134c5156e33d198b311a017" name="dracut-extra" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="8b0518c4beec5a6cefd78957e1bcc32c00e6f12cd4afbc123a3ed27be8fdc687" name="dracut-extra" arch="s390x">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="9807e9709130b1f82ef57a343c6ddfbd0c4016b8630b87a0df18ae24a49f579a" name="dracut-extra" arch="x86_64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="7de52bff8b1b59f9d82f551aebd331198b203a92971f1494552259cfec174a4e" name="dracut-fips" arch="aarch64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="4c265f93648387176cca143f33f5b57385307063eebb8cefde75f1108dc18326" name="dracut-fips" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="8e92b5848fd22ecd91a7904ee8f0c92226702b4244def4299df992d514c8f966" name="dracut-fips" arch="s390x">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="7668e8d747fc3546a5827f4b9bb0bc5dacdbd665b4c80482013f4781ebf61d7f" name="dracut-fips" arch="x86_64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="b7c2959c09bb7dd856a372adffc7833979e2e59c1862f806a0a02808105bbf8c" name="dracut-fips" arch="aarch64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="1f4949b178e971b01d97c76bbf60a8bab9aad956c3e6b045468da959283f1a67" name="dracut-fips" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="7cfb2282d4ddc152b352109b53e07acf41a579ce1257c6e2fd7e20725ed0697e" name="dracut-fips" arch="s390x">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="20873914c8e44f33d6439bf1aea127581b8eeb3525a2b5f72ed22fd8b4b22290" name="dracut-fips" arch="x86_64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="319b6afda531097d3f6e434c3059fcdf7dc4d9b7450e6da61d6b60446d49006a" name="dracut-ima" arch="aarch64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="862925a01d92d7f9cd69d8a2162cdef45229bdab3faf4a5bc4d487cb219e36e8" name="dracut-ima" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="249d64215a28f49bb59c5e8fa2a7073f6f9bdaade51d8b1bb9d11411bad0f40f" name="dracut-ima" arch="s390x">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="4f208fa63c9b04f8a9f59cf8de6c8bfe34c7bc3b2b2390b3150787b3c0bdf120" name="dracut-ima" arch="x86_64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="738aa45ec608df12e12fa7c433756a22b87d17fb8e391ad0ebdcc22f75281fd3" name="dracut-ima" arch="aarch64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="b6ed1ba03b59dd90d9deda92ba5b9f06327087f76a483f71ceaa8d819d6adc59" name="dracut-ima" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="3219317bfa98e291ea76881aa746d5d67535c5321c5b80c7ea9b989913bb44d2" name="dracut-ima" arch="s390x">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="6e3d11ff7e27be276b751455af166926c9369eb63c2a79b46be9cbfa122cfa1f" name="dracut-ima" arch="x86_64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="3725b8267fa6692442172fde29f3d390b12144f3596a79387163b40914c6ec1f" name="dracut-kiwi-lib" arch="aarch64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="b752e64cad7941c0d10f229b98b67fc0fad9ba81e35afcf1004912594b76362b" name="dracut-kiwi-lib" arch="ppc64le">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="0dfb21df8e9dcc72d69309f2fbaa855e536d037e17e582e710a81c7a1182f0db" name="dracut-kiwi-lib" arch="s390x">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="cf3b38573fbfa2de4f231afe46f7ad1498d4d2bde7876556c79f9673faaf9a92" name="dracut-kiwi-lib" arch="x86_64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="3649f5d8a8b27e618bbace48ab77e9d72e0e34da6cb4c12be97251efb28a296f" name="dracut-kiwi-live" arch="aarch64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="2dab1daf0989c3c3313021edb1c3d231a14bf6a057b6a6f90c76e3d0534119bc" name="dracut-kiwi-live" arch="ppc64le">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="e3a112e7902e5f54bbc313c074cb355265d6f509b78e3f0509bab11257140861" name="dracut-kiwi-live" arch="s390x">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="5992b938ca7d86c6fb467e7aeddb477790d3dedc6640a5c2f10c2dda20df8e94" name="dracut-kiwi-live" arch="x86_64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="72f5c03e5b018ca20af7d0055d979a8b1308a69786dd603f1f49dcd808d2ab87" name="dracut-kiwi-oem-dump" arch="aarch64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="44e3c25539b9d0373da7e37a444c036064f4531a0dde5a354765da24c165e778" name="dracut-kiwi-oem-dump" arch="ppc64le">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="345f091d90490716df3f3d44dcbb297f6202a35f895e6a1317cb089b846293d8" name="dracut-kiwi-oem-dump" arch="s390x">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="ac0329a686d117bc963777edaaac93d271d998995ee831a3d395ad1f1aa75c8d" name="dracut-kiwi-oem-dump" arch="x86_64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="38582fd48897fc49f4e6a6f5e7fb9c6f246316b40593f7d9965a8091f2287e47" name="dracut-kiwi-oem-repart" arch="aarch64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="e967ddb427fc8e84744918035f1dd49a1a5bf750bc6449c5631465982c6b3cae" name="dracut-kiwi-oem-repart" arch="ppc64le">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="994294c911e5cfb24ad80fa902376004871bc7bf9f170364318425f03549aa98" name="dracut-kiwi-oem-repart" arch="s390x">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="129ad604b52c1e712cd5116a13521ad972fcd714979814827ef65f28b11869a6" name="dracut-kiwi-oem-repart" arch="x86_64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="d7724568b5951537cc0fb7f5054197609f1ffda9e532e22640134019302ebe2d" name="dracut-kiwi-overlay" arch="aarch64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="b6f6462bb63856e58bb85b9c5036d40c9625c295533b7890284134d99b88bbce" name="dracut-kiwi-overlay" arch="ppc64le">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="d62c1aa0ed33553d4fc16a2b2a7a2e9aa9f58f99f101380a14c4af013939d466" name="dracut-kiwi-overlay" arch="s390x">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="aa945e606d685d602127eaecaaa72bf10cf81778335447ad7064420f4847de2a" name="dracut-kiwi-overlay" arch="x86_64">
  <version epoch="0" ver="9.23.20" rel="3.40.1"/>
  <changelog author="dcassany@suse.com" date="1586952000">- Make CommandCapabilities.check_version take the longest match
  This commit ensures that when trying to parse the version of a tool
  the comparison is done with the longest match for the given regular
  expression. This solves cases such in `grub2` where the tool name
  already provides some digit that could be seen as a version.</changelog>
  <changelog author="ms@suse.de" date="1587038400">- Fixed return value from _get_grub2_mkconfig_tool
  The method returned the basename of the tool if it could
  be found by Path.which(). But the method's scope has been
  changed in a way that the return value of the method must
  be the result from Path.which() to allow working on the
  full path name.</changelog>
  <changelog author="ms@suse.de" date="1587038401">- Increase spare space on disk repart
  The sizing of the virtual cylinders in parted seems to be unfavorable,
  as with some disks and SD cards here the device size is not a multiple
  of the cylinder size, so the last incomplete cylinder is wasted.
  If this wasted space is more than 5MiB, kiwi tries to resize indefinitely.
  Therefore min_additional_mbytes gets increased to prevent running
  into this situation. This Fixes bsc#1165823</changelog>
  <changelog author="ms@suse.de" date="1587124800">- Fixed _get_grub2_mkconfig_tool
  Last patch on this method breaks the search for alternative
  mkconfig names. It returns always on the first lookup which
  could be none. This breaks on systems that uses a different
  name than grub2-mkconfig, like on Ubuntu.</changelog>
  <changelog author="dcassany@suse.com" date="1589284800">- Fix string formatting
  After a flake8 upgrade to v3.8.0 these changes were required to pass
  the `tox -e check` validation.
  (cherry picked from commit 7e43b86cd9e56de48a63943f671cd047dede7521)</changelog>
  <changelog author="ms@suse.de" date="1589457600">- Fixed spec file
  This patch is two fold. First the py2 version of kiwi was
  dropped since py2 is EOL. To indicate that correctly on the
  package level python3-kiwi has to obsolete python2-kiwi.
  The other part of the change is a file conflict of the
  files:
  etc/bash_completion.d/kiwi-ng.sh
  /usr/share/doc/packages/python-kiwi/README
  which were provided by the kiwi-man-pages sub-package but
  were moved to be provided by the main python3-kiwi package
  now. On update of the package with an older version of
  kiwi that maintains this files to belong to kiwi-man-pages
  a file conflict at install time appears. To solve this
  python3-kiwi now conflicts with kiwi-man-pages &lt; %{version}
  This Fixes #1413 and Fixes bsc#1168973 and bsc#1156677
  (cherry picked from commit aba2505524850557e03a3f315b05fe58b28bc07d)</changelog>
  <changelog author="ms@suse.de" date="1591963200">- Fixed check for root device in grub config
  There is a code path that fixes the grub2-mkconfig used root device
  when building in an environment that does not allow to resolve the
  by-X path names, e.g an obs build worker without udev. For images
  that explicitly defines a root=... value in the kernelcmdline
  attribute the root device check was not called because the
  _get_root_cmdline_parameter method returns None. This commit fixes
  the method to return the expected root device in any case such that
  the grub2-mkconfig root device check has a chance to fix what
  grub2-mkconfig has created. This fixes bsc#1172928
  (cherry picked from commit 0ae7bbe74e2d2dddccddda40db6c2f8a04b53543)</changelog>
  <changelog author="dcassany@suse.com" date="1595592000">- Bump version up to 9.21.23
  This version upgrade includes several fixes:
  * Do not exclude filesystem folders in OCI images
    This commit does not exclude filesystem folders during the rsync call
    in OCI images. It has been noted that including an empty /dev folder does
    not hurt and it can eventually help to work around some limitations of
    container related tools such as buildah.
    Fixes bsc#1176129
    (cherry picked from commit 44c0029ce5893bd4c68b21df14bda5bf32a5c869)
  * Fix/Refactor s390 support
    This changes the s390 support on several stages:
    1) On s390 the boot process is based on zipl which boots into an
    initrd from which a userspace grub process is started to support
    the grub capabilities. The implementation of this concept is
    provided via the grub2-s390x-emu package. Once installed the
    setup of the bootloader is done via the grub2-mkconfig and
    grub2-install commands and therefore from a caller perspective
    the same as with any other grub2 setup process. For kiwi this
    means no extra zipl bootloader target code is needed. Therefore
    this commit deletes the zipl setup from kiwi and puts on
    the standard grub2 process. This Fixes bsc#1170863
    2) To support different targettypes the grub2-s390x-emu provided
    zipl template must be adapted. Parts of the former zipl bootloader
    setup therefore now applies to an update of the zipl2grub
    template file
    3) Support for CDL/LDL DASD targets has been disabled in the schema
    When testing 4k devices and a respective zipl2grub template
    setup for CDL/LDL targettype it has turned out that grub2-install
    is not able to run on such a device. My assumption is that
    the device code in grub2-install does not work for 4k devices
    with an fdasd created partition table. As this needs further
    investigations and most probably adaptions on the grub toolchain
    for s390, we disabled the setup of these modes for now.
    emulated DASD (FBA) and SCSI targets stays supported.
    (cherry picked from commit 836633c7b2b9b4aa31c1501c2e9817dc00af290d)
  * Fix compat link for rpmdb location
    This commit fixes the symlink creation for `/var/lib/rpm`. More specific
    for derived container images in which the base root tree already
    included the `/var/lib/rpm` the link, the `ln` command was creating a
    symlink inside the `/var/lib/rpm` folder givent that it was following
    the already existing symlink. Adding the `--no-target-directory` force
    `ln` command to treat `/var/lib/rpm` path as the fully qualified symlink name.
    Fixes bsc#1176977
    (cherry picked from commit a6f56179b7879d160f0aab985ebda20bc49a83be)
  * Fixed s390/sle15 Virtual disk integration test
    The integration test used FBA mode as target. As the target
    is expected to be KVM this is the wrong setting. SCSI should
    be used instead. This Fixes bsc#1170863
    (cherry picked from commit 33c5780d5a8f4e6b41d51bce6bb3e838ac7ded4b)
  * Support dynamic linux/linuxefi in any case
    Instead of restricting the dynamic linux vs. linuxefi setup
    to a specific grub version, support this setup for any version
    of grub. This Fixes bsc#1175729 and bsc#1176134
    (cherry picked from commit 988404ff9f04384c3efb53644e69d520c022c03c)</changelog>
  <changelog author="ms@suse.de" date="1597233600">- Bump version up to 9.21.7
  This version upgrade includes several fixes:
  * Skip filesystem check for XFS prior xfs_grow
    running xfs_repair check isn't strictly necessary before resizing,
    and in some cases it may even prevent resizing by giving an error
    that would be cleared through mounting the fs (e.g. when the fs
    wasn't cleanly umounted, and thus letting xfs recover and replay
    its journal). Given that xfs can only grow online (while being mounted),
    this is sufficient to ensure that the fs is in a state where it
    can be resized. This is related to bsc#1174009
  * Fixed grub setup in EFI/BOOT directory
    kiwi copied the same grub.cfg file as it exists in boot/grub2
    to the efi path. This is wrong as the setup in the efi boot
    directory is used to enable normal grub loading and not providing
    the user grub configuration. In addition the changes here makes
    sure that the early grub boot code is placed into the system
    in any EFI case except for secure boot when shim-install is
    present. If shim-install is present it also creates the early
    grub boot setup such that kiwi doesn't have to do it.
    This Fixes #1491 and Fixes bsc#1172908
  * Use rsync in inplace transfer mode
    Using the --inplace option in rsync helps to save space on
    syncing the rootfs data and prevents e.g OBS workers from
    running out of VM space when transfering root filesystem
    data. Also using --inplace allows to keep hardlinks intact.
    This is related to bsc#1096738
  * Don't keep copy of grub2-install in the system
    To prevent shim-install from calling grub2-install in uefi mode
    kiwi temporary replaces the tool by a noop. This acts as a
    workaround for an issue in shim-install. However the workaround
    left a file copy of grub2-install in the system which should
    not happen. This commit Fixes bsc#1173226 and Fixes #1490
  * Fixes live ISOs
    This commit fixes iso images. Due to a change introduced in c7ed1cf
    live ISOs were no longer booting as the rootfs.img filesystem was
    copied to the squashfs container while being still mounted. Because of
    that, at boot time, it refused to mount.
    This commit adds umount method for the filesystem base class, so it
    can be umounted before deleting the instance.
    Fixes #1489 and bsc#1173356
  * Support grub timeout_style parameter
    Grub supports a style setting that influences the display of
    the menu depending on the configured timeout value. With this
    patch kiwi allows to specify the style via a new bootloader
    parameter named timeout_style="hidden|countdown". If not set
    the grub default applies which shows the menu in any case.
    This Fixes bsc#1165730 and Fixes #1404
  * Use auto video mode as default for grub
    An explicit video mode 800x600 was used for grub if no
    video mode setup exists in the XML description. For grub
    this should better result in the auto mode. Related to
    bsc#1165730</changelog>
  <changelog author="ms@suse.de" date="1606910400">- Fixed multipath disk device assignment in kiwi lib
  The former lookup of the multipath mapped disk device contained
  a race condition. If the lookup of the device mapper files happened
  before multipathd has finished the initialization, kiwi continues
  with the unix node name and fails when the device mapper keeps
  a busy state on it. This commit changes the code such that in case
  of an explicit request to use multipath the lookup of the mapped
  device becomes a mandatory process that runs until the
  DEVICE_TIMEOUT is reached. Default timeout is set to 60 sec.
  This references Issue SUSE-Enceladus/azure-li-services#255</changelog>
  <changelog author="ms@suse.de" date="1606996800">- Omit multipath module by default
  The plain installation of the multipath toolkit activates the
  dracut multipath code. The setup if the target image runs in a
  multipath environment or not should however be decided explicitly
  in the image description via &lt;oem-multipath-scan&gt; and not
  implicitly by the presence of tools</changelog>
  <changelog author="ms@suse.de" date="1606996801">- Reference commit for SUSE maintenance
  This commit adds a reference to Issue SUSE-Enceladus/azure-li-services#255
  and the report in bugzilla bsc#1179562</changelog>
  <changelog author="ms@suse.de" date="1607428800">- Fixed validation of bool value in dracut module
  The oem-multipath-scan setup results in a bool variable inside
  of the initrd code. The variable kiwi_oemmultipath_scan is
  therefore either set to "true" or "false". A check in code
  of the form [ -n ... ] is stupid since the variable always
  contains text. This commit fixes the validation to make use
  of the bool() method provided for these type of variables</changelog>
  <changelog author="ms@suse.de" date="1610452800">- Reference commit for SUSE maintenance
  This commit adds a reference to bsc#1180781</changelog>
  <changelog author="dcassany@suse.com" date="1615464000">- Bump version: 9.23.19 ? 9.23.20
  This version upgrade includes several fixes:
  * Refactor grub2 installation
    This commit refactors grub2 installation method to split it in two
    parts. Former grub2.install method was meant to run the grub2-install
    tool, however, in addition it was also running the secure boot
    installation shim-install. The install method in KIWI is skipped for
    those architectures and firmware combinations for which bios support
    doesn't exist. This was leading to skip the secure boot installation.
    The current approach strips the secure boot installation logic from the
    grub2.install method, so skipping the install method does not
    automatically result in skipping the secure boot installation.
    Fixes bsc#1182211
  * Fix lsblk flags to get sorted output
    This commit modifies the lsblk command flags to get a sorted output
    according to the disk layout.
    This is related to 176c7eab commita and it fixes bsc#1182264,
    bsc#1182963 and bsc#1183059
  * Avoid using generators in pre-mount hooks
    This commit deletes the generator that was creating the sysroot.mount
    unit for ramdisk deployments. Generators, specially the sysroot.mount is
    expected to be created on very early stages of the boot procedure as
    this has impact on relevant targets such as initrd-root-fs.target, which
    does not depend on sysroot.mount if the unit is not there.
    In ramdisk deployments some data is known on pre-mount stage as
    as it is downloaded from the PXE server. At this stage it is not safe to
    generate a sysroot.mount unit that depends on initrd-root-fs.target as
    the target is close to finalize or even finalized already and could
    potentially skip sysroot.mount exection.
    Instead we include a mount hook which is only executed on ramdisk
    deployments that simply runs the mount command to mount /sysroot.
    This fixes bsc#1178670</changelog>
  <changelog author="dcassany@suse.com" date="1615464001">- Turn fb-util-for-appx requirement into a recommendation
  This commit relaxes the requirement for `fb-util-for-appx` since
  the utiliy is not part of all SLE-15 service packs.</changelog>
  <changelog author="dcassany@suse.com" date="1615464002">- Add a requirement for kiwi-systemdeps-iso-media on disk images
  This commit adds a requirement for `kiwi-systemdeps-iso-media` in
  `kiwi-systemdeps-disk-images`. This is to ensure that installing
  `kiwi-systemdeps-disk-images` is enough to build OEM images including
  install media.
  (cherry picked from commit 307b7e0234c01846587024c008166310e8d7d8b0)</changelog>
  <changelog author="dcassany@suse.com" date="1615464003">- Require qemu-img in any filesystem based image
  This commit moves the qemu-img requirement into the
  `kiwi-systemdeps-filesystems` to ensure ISO, OEM and PXE images include
  it in the build service. Also this is required for images that are
  simple root-trees in a filesystem (image=ext4).
  (cherry picked from commit 4e91e028eba763321a0958ff0febee107d944af8)</changelog>
  <changelog author="dcassany@suse.com" date="1618228800">- Recommend kiwi-systemdeps-containers
  This commit recommends kiwi-systemdeps-containers instead of a hard
  requirement in kiwi-systemdeps package for SLE builds. This is needed
  because the containers tool chain is spread in different SLE modules.</changelog>
  <changelog author="dcassany@suse.com" date="1618574400">- Fix appx manifest for WSL containers
  This patch is two fold
  * This commit prevents KIWI from setting Identity Name attribute and
    DisplayName and PublisherDisplayName elements.
    Fixes #1780
  * Fix WSL appx filemap relative paths not preserved
    During WSL appx image type creation step the file hierarchy under
    metadata_path is written to a temporary file for eventual use as
    argument to utility appx. The file hierarchy information is dropped
    resulting in all filemap entries appearing to be at the metadata_path
    root. The resulting image will side load and run but without icon and
    other resources. Stricter checks at Windows Store submission will
    fail due to mismatch between image manifest and contents.
    Fix by preserving relative path of filemap entries relative
    to metadata_path. Add log output showing both input absolute path
    and output relative path.
    This is related to jsc#SLE-12986</changelog>
</package>
<package pkgid="1b36761c3fcf1e537ebda9be14d31a2c0d208ddf61721191f356f4f230b56260" name="dracut-saltboot" arch="noarch">
  <version epoch="0" ver="0.1.1627546504.96a0b3e" rel="1.27.1"/>
  <changelog author="nadvornik@suse.com" date="1511179200">- new package</changelog>
  <changelog author="nadvornik@suse.com" date="1565697600">- Copy saltboot.sh from kiwi-desc-saltboot</changelog>
  <changelog author="nadvornik@suse.com" date="1566216000">- Updated for SLES15
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="oholecek@suse.com" date="1574251200">- Include swapon in saltboot initrd
- Update to version 0.1.1574263639.c30ba46</changelog>
  <changelog author="oholecek@suse.com" date="1578571200">- Source wicked network information to access IPADDR and DNSDOMAIN variables
- Replace systemException functions by log and reboot actions
- Stop waiting for devices when dracut timeout is hit
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1580299200">- Add support for FQDN as a terminal name
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="oholecek@suse.com" date="1582977600">- Use start event grains to avoid extra grains calls
- Update to version 0.1.1583842676.2fc2fa6</changelog>
  <changelog author="nadvornik@suse.com" date="1583841600">- Use more reliable progress output</changelog>
  <changelog author="nadvornik@suse.com" date="1583928000">- Force installation of raid1 kernel module</changelog>
  <changelog author="nadvornik@suse.com" date="1584360000">- Assemble existing RAIDs before searching for salt configuration
- Update to version 0.1.1585064259.12b97ef</changelog>
  <changelog author="oholecek@suse.com" date="1586433600">- Add missing terminal naming modifiers as exported veriables
- Update to version 0.1.1587051918.6bc9e88</changelog>
  <changelog author="nadvornik@suse.com" date="1587643200">- Force install crypt modules
- Update to version 0.1.1588156049.952b58d</changelog>
  <changelog author="nadvornik@suse.com" date="1589284800">- Print a list of available disk devices (bsc#1170824)
- Install wipefs to initrd
- Update to version 0.1.1590413773.a959db7</changelog>
  <changelog author="nadvornik@suse.com" date="1595332800">- Use automatic RAID assembly only in the first phase before
  start of salt
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
- Copy wicked lease xml file to prevent query for second IP address
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1599652800">- Support autosign grains in saltboot intrd
- Update to version 0.1.1602150122.f08af0a</changelog>
  <changelog author="nadvornik@suse.com" date="1612180800">- Use saltboot/defaults file
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1622203200">- Use kernel parameters from PXE formula also for local boot</changelog>
  <changelog author="nadvornik@suse.com" date="1627473600">- Force installation of libexpat.so.1 (bsc#1188846)
- Update to version 0.1.1627546504.96a0b3e</changelog>
</package>
<package pkgid="e0ae6625de714f226953ae2598e1baed459184db8ea055b6d3adb5f681ca0346" name="dracut-saltboot" arch="src">
  <version epoch="0" ver="0.1.1627546504.96a0b3e" rel="1.27.1"/>
  <changelog author="nadvornik@suse.com" date="1511179200">- new package</changelog>
  <changelog author="nadvornik@suse.com" date="1565697600">- Copy saltboot.sh from kiwi-desc-saltboot</changelog>
  <changelog author="nadvornik@suse.com" date="1566216000">- Updated for SLES15
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="oholecek@suse.com" date="1574251200">- Include swapon in saltboot initrd
- Update to version 0.1.1574263639.c30ba46</changelog>
  <changelog author="oholecek@suse.com" date="1578571200">- Source wicked network information to access IPADDR and DNSDOMAIN variables
- Replace systemException functions by log and reboot actions
- Stop waiting for devices when dracut timeout is hit
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1580299200">- Add support for FQDN as a terminal name
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="oholecek@suse.com" date="1582977600">- Use start event grains to avoid extra grains calls
- Update to version 0.1.1583842676.2fc2fa6</changelog>
  <changelog author="nadvornik@suse.com" date="1583841600">- Use more reliable progress output</changelog>
  <changelog author="nadvornik@suse.com" date="1583928000">- Force installation of raid1 kernel module</changelog>
  <changelog author="nadvornik@suse.com" date="1584360000">- Assemble existing RAIDs before searching for salt configuration
- Update to version 0.1.1585064259.12b97ef</changelog>
  <changelog author="oholecek@suse.com" date="1586433600">- Add missing terminal naming modifiers as exported veriables
- Update to version 0.1.1587051918.6bc9e88</changelog>
  <changelog author="nadvornik@suse.com" date="1587643200">- Force install crypt modules
- Update to version 0.1.1588156049.952b58d</changelog>
  <changelog author="nadvornik@suse.com" date="1589284800">- Print a list of available disk devices (bsc#1170824)
- Install wipefs to initrd
- Update to version 0.1.1590413773.a959db7</changelog>
  <changelog author="nadvornik@suse.com" date="1595332800">- Use automatic RAID assembly only in the first phase before
  start of salt
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
- Copy wicked lease xml file to prevent query for second IP address
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1599652800">- Support autosign grains in saltboot intrd
- Update to version 0.1.1602150122.f08af0a</changelog>
  <changelog author="nadvornik@suse.com" date="1612180800">- Use saltboot/defaults file
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1622203200">- Use kernel parameters from PXE formula also for local boot</changelog>
  <changelog author="nadvornik@suse.com" date="1627473600">- Force installation of libexpat.so.1 (bsc#1188846)
- Update to version 0.1.1627546504.96a0b3e</changelog>
</package>
<package pkgid="e0a48c747c83474c52fd6040afcfc7463dc8d8e14bb40eb2a0738cddb98f4e0b" name="dracut-saltboot" arch="noarch">
  <version epoch="0" ver="0.1.1628156312.dbd0dec" rel="1.30.1"/>
  <changelog author="nadvornik@suse.com" date="1511179200">- new package</changelog>
  <changelog author="nadvornik@suse.com" date="1565697600">- Copy saltboot.sh from kiwi-desc-saltboot</changelog>
  <changelog author="nadvornik@suse.com" date="1566216000">- Updated for SLES15
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="oholecek@suse.com" date="1574251200">- Include swapon in saltboot initrd
- Update to version 0.1.1574263639.c30ba46</changelog>
  <changelog author="oholecek@suse.com" date="1578571200">- Source wicked network information to access IPADDR and DNSDOMAIN variables
- Replace systemException functions by log and reboot actions
- Stop waiting for devices when dracut timeout is hit
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1580299200">- Add support for FQDN as a terminal name
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="oholecek@suse.com" date="1582977600">- Use start event grains to avoid extra grains calls
- Update to version 0.1.1583842676.2fc2fa6</changelog>
  <changelog author="nadvornik@suse.com" date="1583841600">- Use more reliable progress output</changelog>
  <changelog author="nadvornik@suse.com" date="1583928000">- Force installation of raid1 kernel module</changelog>
  <changelog author="nadvornik@suse.com" date="1584360000">- Assemble existing RAIDs before searching for salt configuration
- Update to version 0.1.1585064259.12b97ef</changelog>
  <changelog author="oholecek@suse.com" date="1586433600">- Add missing terminal naming modifiers as exported veriables
- Update to version 0.1.1587051918.6bc9e88</changelog>
  <changelog author="nadvornik@suse.com" date="1587643200">- Force install crypt modules
- Update to version 0.1.1588156049.952b58d</changelog>
  <changelog author="nadvornik@suse.com" date="1589284800">- Print a list of available disk devices (bsc#1170824)
- Install wipefs to initrd
- Update to version 0.1.1590413773.a959db7</changelog>
  <changelog author="nadvornik@suse.com" date="1595332800">- Use automatic RAID assembly only in the first phase before
  start of salt
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
- Copy wicked lease xml file to prevent query for second IP address
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1599652800">- Support autosign grains in saltboot intrd
- Update to version 0.1.1602150122.f08af0a</changelog>
  <changelog author="nadvornik@suse.com" date="1612180800">- Use saltboot/defaults file
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1622203200">- Use kernel parameters from PXE formula also for local boot</changelog>
  <changelog author="nadvornik@suse.com" date="1627473600">- Force installation of libexpat.so.1 (bsc#1188846)
- Update to version 0.1.1627546504.96a0b3e</changelog>
  <changelog author="nadvornik@suse.com" date="1628078400">- Fix dependencies of python libs (bsc#1188846)
- Update to version 0.1.1628156312.dbd0dec</changelog>
</package>
<package pkgid="735a547b3be59dd8b058a5841455659bbccb7114081d22ce4dd41ec0567cf083" name="dracut-saltboot" arch="src">
  <version epoch="0" ver="0.1.1628156312.dbd0dec" rel="1.30.1"/>
  <changelog author="nadvornik@suse.com" date="1511179200">- new package</changelog>
  <changelog author="nadvornik@suse.com" date="1565697600">- Copy saltboot.sh from kiwi-desc-saltboot</changelog>
  <changelog author="nadvornik@suse.com" date="1566216000">- Updated for SLES15
- Update to version 0.1.1573133286.06608d5</changelog>
  <changelog author="oholecek@suse.com" date="1574251200">- Include swapon in saltboot initrd
- Update to version 0.1.1574263639.c30ba46</changelog>
  <changelog author="oholecek@suse.com" date="1578571200">- Source wicked network information to access IPADDR and DNSDOMAIN variables
- Replace systemException functions by log and reboot actions
- Stop waiting for devices when dracut timeout is hit
- Update to version 0.1.1579102150.4716559</changelog>
  <changelog author="oholecek@suse.com" date="1580299200">- Add support for FQDN as a terminal name
- Update to version 0.1.1580471316.1839544</changelog>
  <changelog author="oholecek@suse.com" date="1582977600">- Use start event grains to avoid extra grains calls
- Update to version 0.1.1583842676.2fc2fa6</changelog>
  <changelog author="nadvornik@suse.com" date="1583841600">- Use more reliable progress output</changelog>
  <changelog author="nadvornik@suse.com" date="1583928000">- Force installation of raid1 kernel module</changelog>
  <changelog author="nadvornik@suse.com" date="1584360000">- Assemble existing RAIDs before searching for salt configuration
- Update to version 0.1.1585064259.12b97ef</changelog>
  <changelog author="oholecek@suse.com" date="1586433600">- Add missing terminal naming modifiers as exported veriables
- Update to version 0.1.1587051918.6bc9e88</changelog>
  <changelog author="nadvornik@suse.com" date="1587643200">- Force install crypt modules
- Update to version 0.1.1588156049.952b58d</changelog>
  <changelog author="nadvornik@suse.com" date="1589284800">- Print a list of available disk devices (bsc#1170824)
- Install wipefs to initrd
- Update to version 0.1.1590413773.a959db7</changelog>
  <changelog author="nadvornik@suse.com" date="1595332800">- Use automatic RAID assembly only in the first phase before
  start of salt
- Update to version 0.1.1595937550.0285244</changelog>
  <changelog author="oholecek@suse.com" date="1597406400">- Set wicked to use plain mac address for computing DHCP DUID
- Copy wicked lease xml file to prevent query for second IP address
  (bsc#1173268)</changelog>
  <changelog author="nadvornik@suse.com" date="1599652800">- Support autosign grains in saltboot intrd
- Update to version 0.1.1602150122.f08af0a</changelog>
  <changelog author="nadvornik@suse.com" date="1612180800">- Use saltboot/defaults file
- Update to version 0.1.1614159840.ef7cad5</changelog>
  <changelog author="nadvornik@suse.com" date="1622203200">- Use kernel parameters from PXE formula also for local boot</changelog>
  <changelog author="nadvornik@suse.com" date="1627473600">- Force installation of libexpat.so.1 (bsc#1188846)
- Update to version 0.1.1627546504.96a0b3e</changelog>
  <changelog author="nadvornik@suse.com" date="1628078400">- Fix dependencies of python libs (bsc#1188846)
- Update to version 0.1.1628156312.dbd0dec</changelog>
</package>
<package pkgid="09148c85f009ea99f0101c040305a599375fc7917544f1dc74b5aa3d116c69df" name="dracut-tools" arch="aarch64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="fd01517dea40c18ceae77893e59ad27b1d59b083ec9b6c004b43f855fabe1f17" name="dracut-tools" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="8c6008b2ab2704ac53ae41f924cdb46d0d9594548faa6c2bf3a715ceca6915a6" name="dracut-tools" arch="s390x">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="1f9335368dccf011717a91bce6c89dccdbb7d9a58fbe2944c02c86c74fa2ae93" name="dracut-tools" arch="x86_64">
  <version epoch="0" ver="049.1+suse.203.g8ee14a90" rel="3.35.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1584878400">- Update to version 049.1+git138.9068a629:
  * systemd: install systemd-tty-ask-password-agent systemd-ask-password
  * Mark interface setup after dhcp (bsc#1167161)
  * Store nameserver received from wicked dhcp lease (bsc#1167161)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591099200">- Update to version 049.1+suse.141.g7563c620:
  * network-legacy/net-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1161438)
  * 35network-legacy: call initqueue/online for DHCP, too (boo#1161438)
  * 90nvdimm: include nvdimm keys in initrd (bsc#1161343)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
</package>
<package pkgid="7697e867348d33451986796c64a2b2714eded81b8589111ed44040720be54c43" name="dracut-tools" arch="aarch64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="211dae66bddc8320de76f3e1ec4f80145cbc1017d335971321586d27559a2363" name="dracut-tools" arch="ppc64le">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="821c11d7b5c52fe391efa5ce0a9189d770fcd5a5dc4da4ff69c93d3ad143dd73" name="dracut-tools" arch="s390x">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="841d678dcd2c31a6cddd5df3d81d70d065e70ce470b0ceaea4dc8e904e7a92c1" name="dracut-tools" arch="x86_64">
  <version epoch="0" ver="049.1+suse.209.gebcf4f33" rel="3.40.1"/>
  <changelog author="daniel.molkentin@suse.com" date="1591185600">- Update to version 049.1+suse.142.gf8776da4:
  * Run format_spec_file</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591185601">- Update to version 049.1+suse.143.g368f585a:
  * modules.d: fix udev rules detection of multipath devices (bsc#1171370)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591272000">- Update to version 049.1+suse.144.ge0eaf296:
  * Add wicked specific config files (bsc#1089333)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1591790400">- Update to version 049.1+suse.145.g8ae82192:
  * 95iscsi: fix missing space when compiling cmdline args (bsc#1172816)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1592395200">- Update to version 049.1+suse.146.g6f5195cf:
  * 35network-legacy: Fix dual stack setups (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1593604800">- Update to version 049.1+suse.148.gc4a6c2dd:
  * 95fcoe: load 'libfcoe' module as a fallback (bsc#1173560)
  * 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases.
    (bsc#bsc#1161573)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1594296000">- Update to version 049.1+suse.152.g8506e86f:
  * 01fips: modprobe failures during manual module loading is not fatal (bsc#bsc#1169997)
  * 91zipl: parse-zipl.sh: honor SYSTEMD_READY (bsc#1165828)
  * 95iscsi: fix ipv6 target discovery (bsc#1172807)
  * 35network-legacy: correct conditional for creating did-setup file (bsc#1172807)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1597838400">- Update to version 049.1+suse.156.g7d852636:
  * net-lib.sh: support infiniband network mac addresses (bsc#996146)
  * 95nfs: use ip_params_for_remote_addr() (bsc#1167494)
  * 95iscsi: use ip_params_for_remote_addr() (bsc#1167494)
  * dracut-functions: add ip_params_for_remote_addr() helper (bsc#1167494)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1604923200">- Update to version 049.1+suse.171.g65b2addf:
  * dracut.sh: FIPS workaround for openssl-libs (bsc#1178217)
  * 01fips: turn info calls into fips_info calls (bsc#1164076)
  * 00systemd: add missing cryptsetup-related targets (bsc#1177811)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1608292800">- Update to version 049.1+suse.174.g150b9981:
  * make collect optional (bsc#1177870)
  * Inclusion of dracut modifications to enable nvme-fc boot support (bsc#1142248)
  * suse.spec: add nvmf module
  * 95nvmf: Implement 'fc,auto' commandline syntax
  * 95nvmf: add nvmf-autoconnect script
  * 95nvmf: Fixup FC connections
  * 95nvmf: rework parameter handling
  * 95nvmf: fix typo in the example documentation
  * 95nvmf: add NVMe over TCP support
  * 95nvmf: add module for NVMe-oF
  Adds new module 95nvmf, see jsc#ECO-3063.</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1610971200">- Update to version 049.1+suse.183.g7282fe92:
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated
    (multiple backported commits, bsc#1180119)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1613563200">- Update to version 049.1+suse.185.g9324648a:
  * 90kernel-modules: arm/arm64: Add reset controllers (bsc#1180336)
  * Prevent creating unexpected files on the host when running dracut (bsc#1176171)</changelog>
  <changelog author="thomas.blume@suse.com" date="1614686400">- Update to version 049.1+suse.186.g320cc3d1:
  * network-legacy: fix route parsing issues in ifup (bsc#1182688)
  * 90kernel-modules: arm/arm64: Add reset controllers
  * Prevent creating unexpected files on the host when running dracut
  * As of v246 of systemd "syslog" and "syslog-console" switches have been deprecated</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1618920000">- Update to version 049.1+suse.187.g63c1504f:
  * fix(shutdown): add timeout to umount calls (bsc#1178219)</changelog>
  <changelog author="daniel.molkentin@suse.com" date="1620043200">- Update to version 049.1+suse.188.gbf445638:
  * 90kernel-modules-extra: don't resolve symlinks before instmod (bsc#1185277)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623844800">- Update to version 049.1+suse.192.g00425ead:
  * fix(suse-initrd): remove references to INITRD_MODULES (bsc#1187115)
  * fix(suse-initrd) fix list of modprobe.d directories
  * fix(install): handle $LIB in ldd output parsing (bsc#1185615)</changelog>
  <changelog author="thomas.blume@suse.com" date="1623931200">- Update to version 049.1+suse.196.g8706843b:
  * fix(suse-initrd): restore INITRD_MODULES in mkinitrd script
  * fix(suse-initrd): call dracut_instmods with hostonly=</changelog>
  <changelog author="thomas.blume@suse.com" date="1626177600">- Update to version 049.1+suse.203.g8ee14a90:
  * fix(suse-initrd): use $kernel rather than $(uname -r)
  * fix(suse-initrd): exclude modules that are built-in (bsc#1185646)
  * fix(suse-initrd): inform on usage of obsolete -f parameter (bsc#1187470)
  * docs: fix reference to insmodpost module (bsc#1187774)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916800">- Update to version 049.1+suse.207.g72a93d93:
  * fcoe/fcoe-genrules.sh: use $name instead of $env{INTERFACE} (bsc#1186260)
  * fix: /var/lib/nfs/statd/sm is /var/lib/nfs/sm on SUSE (bsc#1184970)</changelog>
  <changelog author="thomas.blume@suse.com" date="1632916801">- Update to version 049.1+suse.209.gebcf4f33:
  * fix(systemd): add unit files for systemd-coredump (bsc#1190845)</changelog>
</package>
<package pkgid="d4bc061f331dec43e2e56b7263b498d3079bd035f68d23b45598333906658728" name="drbd" arch="aarch64">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="a4aa2e20ae66c8e7a4344d15bd4bc3db6e82b838a291e7421ab1918b367e833d" name="drbd" arch="ppc64le">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="63f4dd70a6ce5c9390735e00fadeb8d1a97505a1670014bd122bdeec04862d21" name="drbd" arch="s390x">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="8e1b5c41881bf48547216b3de629e449ec553fc36d9b6950d5f6656052cd0d0a" name="drbd" arch="src">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="ce9d4474730216c17871f0a2a1d6514b20c600a1bdb437ba4c99cb2d7f1b0b5c" name="drbd" arch="x86_64">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="014cef9cdac6eab20e95fe3e11a1ff80521129dd175fe8853d7dcd6a84c1e42b" name="drbd-formula" arch="noarch">
  <version epoch="0" ver="0.4.2+git.1616116365.1e3ab34" rel="3.6.1"/>
  <changelog author="nwang@suse.com" date="1557748800">- Initial version</changelog>
  <changelog author="nwang@suse.com" date="1557921600">- Version 0.2.0
  * Add description in pillar.example.
  * Support more parameters in global_common.conf
  * Fix bugs in initial sync.
  * Add promote/demote state.
  * Use grains['host'] for primary node.
- Basic manual test PASSED</changelog>
  <changelog author="nwang@suse.com" date="1559736000">- Version 0.2.1
  * Polish the README
  * Add travis file for auto package to obs
  * Change node names in example
  * Modify state ID to avoid conflict of other formulas</changelog>
  <changelog author="nwang@suse.com" date="1561377600">- Version 0.2.2
  * Support make file system after initialization
  * Support mount to specific folder
  * Add habootstrap-formula pillar/tempalte</changelog>
  <changelog author="nwang@suse.com" date="1562587200">- Version 0.3.0, jsc#SLE-6970
  * Move to SUSE org
  * Add SUSE manager support</changelog>
  <changelog author="dakechi@suse.com" date="1563796800">- Version 0.3.1
  * Change the requires to salt-formulas-configuration as this is
    the virtual "provides" shared by salt and SUMA to guarantee that
    the formula works integrated with both (not at the same time).
    (boo#1142306)
  * Change the directory permission to avoid file conflicts with
    SUMA.</changelog>
  <changelog author="nwang@suse.com" date="1564056000">- Version 0.3.2, boo#1142762
  * Restructure the deploy and examples directories
  * Add examples of using NFS formula
  * Fix the issue of mkfs and mount NFS share
  * Polish the form.yml based on SUMA4.0, change some default values.</changelog>
  <changelog author="nwang@suse.com" date="1565179200">- Version 0.3.3
  * Add prefix to ID to avoid conflicts
  * Install xfsprogs when need to format xfs</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1573041600">- Version 0.3.4
  * Remove the duplicate default value in salt state
  * Not to install package by default
  * Remove salt indent and change the order of pillar</changelog>
  <changelog author="xarbulu@suse.com" date="1573473600">- Version 0.3.5
  * Fix issue with file permissions during package installation in
    /usr/share/salt-formulas (0755, root, salt)
    (boo#1142306)</changelog>
  <changelog author="xarbulu@suse.com" date="1573646400">- Version 0.3.6
  * Remove additional_repos salt state</changelog>
  <changelog author="xarbulu@suse.com" date="1573646401">- Version 0.3.7
  * Retry the packages installation to make the code more robust</changelog>
  <changelog author="xarbulu@suse.com" date="1574942400">- Version 0.3.8
  * Add json rendering to jinja templates for old salt versions</changelog>
  <changelog author="nwang@suse.com" date="1576670400">- Version 0.3.9
  * Make file system after initial resync finished
  * Sleep longer in case sync source change state late</changelog>
  <changelog author="nwang@suse.com" date="1577102400">- Version 0.3.10
  * With the fix of salt-shaptools 0.2.9, doesn't need to
  estimate a long time for write I/O completion.
  (jsc#ECO-1965, jsc#SLE-4047)</changelog>
  <changelog author="xarbulu@suse.com" date="1611057600">- Version bump 0.4.0
  * Change salt-formulas-configuration requirement in SLE12 codestream
  to a recommendation
  (bsc#1177860)</changelog>
  <changelog author="nwang@suse.com" date="1614168000">- Version bump 0.4.1
  * Support different backing device per node
  (bsc#1179529)</changelog>
  <changelog author="nwang@suse.com" date="1615464000">- Version bump 0.4.2
  * Fix github issue#15
  * Rename examples to templates</changelog>
</package>
<package pkgid="30ab400e6d1ac5877b1efe34e8493262055b9dbc9e6e40c53e912ace790e3450" name="drbd-formula" arch="src">
  <version epoch="0" ver="0.4.2+git.1616116365.1e3ab34" rel="3.6.1"/>
  <changelog author="nwang@suse.com" date="1557748800">- Initial version</changelog>
  <changelog author="nwang@suse.com" date="1557921600">- Version 0.2.0
  * Add description in pillar.example.
  * Support more parameters in global_common.conf
  * Fix bugs in initial sync.
  * Add promote/demote state.
  * Use grains['host'] for primary node.
- Basic manual test PASSED</changelog>
  <changelog author="nwang@suse.com" date="1559736000">- Version 0.2.1
  * Polish the README
  * Add travis file for auto package to obs
  * Change node names in example
  * Modify state ID to avoid conflict of other formulas</changelog>
  <changelog author="nwang@suse.com" date="1561377600">- Version 0.2.2
  * Support make file system after initialization
  * Support mount to specific folder
  * Add habootstrap-formula pillar/tempalte</changelog>
  <changelog author="nwang@suse.com" date="1562587200">- Version 0.3.0, jsc#SLE-6970
  * Move to SUSE org
  * Add SUSE manager support</changelog>
  <changelog author="dakechi@suse.com" date="1563796800">- Version 0.3.1
  * Change the requires to salt-formulas-configuration as this is
    the virtual "provides" shared by salt and SUMA to guarantee that
    the formula works integrated with both (not at the same time).
    (boo#1142306)
  * Change the directory permission to avoid file conflicts with
    SUMA.</changelog>
  <changelog author="nwang@suse.com" date="1564056000">- Version 0.3.2, boo#1142762
  * Restructure the deploy and examples directories
  * Add examples of using NFS formula
  * Fix the issue of mkfs and mount NFS share
  * Polish the form.yml based on SUMA4.0, change some default values.</changelog>
  <changelog author="nwang@suse.com" date="1565179200">- Version 0.3.3
  * Add prefix to ID to avoid conflicts
  * Install xfsprogs when need to format xfs</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1573041600">- Version 0.3.4
  * Remove the duplicate default value in salt state
  * Not to install package by default
  * Remove salt indent and change the order of pillar</changelog>
  <changelog author="xarbulu@suse.com" date="1573473600">- Version 0.3.5
  * Fix issue with file permissions during package installation in
    /usr/share/salt-formulas (0755, root, salt)
    (boo#1142306)</changelog>
  <changelog author="xarbulu@suse.com" date="1573646400">- Version 0.3.6
  * Remove additional_repos salt state</changelog>
  <changelog author="xarbulu@suse.com" date="1573646401">- Version 0.3.7
  * Retry the packages installation to make the code more robust</changelog>
  <changelog author="xarbulu@suse.com" date="1574942400">- Version 0.3.8
  * Add json rendering to jinja templates for old salt versions</changelog>
  <changelog author="nwang@suse.com" date="1576670400">- Version 0.3.9
  * Make file system after initial resync finished
  * Sleep longer in case sync source change state late</changelog>
  <changelog author="nwang@suse.com" date="1577102400">- Version 0.3.10
  * With the fix of salt-shaptools 0.2.9, doesn't need to
  estimate a long time for write I/O completion.
  (jsc#ECO-1965, jsc#SLE-4047)</changelog>
  <changelog author="xarbulu@suse.com" date="1611057600">- Version bump 0.4.0
  * Change salt-formulas-configuration requirement in SLE12 codestream
  to a recommendation
  (bsc#1177860)</changelog>
  <changelog author="nwang@suse.com" date="1614168000">- Version bump 0.4.1
  * Support different backing device per node
  (bsc#1179529)</changelog>
  <changelog author="nwang@suse.com" date="1615464000">- Version bump 0.4.2
  * Fix github issue#15
  * Rename examples to templates</changelog>
</package>
<package pkgid="ba353899f315558d5451be19268972e1ee3761bfd545c1928a54c4ea6f3b97e7" name="drbd-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817_k5.3.18_59.19" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="328777ff9dbcc727e7de8ad1dd37d2c941caf5c46c6aed0734f88c2dd9e968e7" name="drbd-kmp-default" arch="aarch64">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817_k5.3.18_59.19" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="567e2779a3f0618f740e93021a1153c90db101a4cc3274c4f4e830704d4d4caa" name="drbd-kmp-default" arch="ppc64le">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817_k5.3.18_59.19" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="020a71a5fb014adc11a958d72f8f3332d625236a2895df58f1d507697a7dfed8" name="drbd-kmp-default" arch="s390x">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817_k5.3.18_59.19" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="6a8b888c67c0a8e8f7187cd52ae22b0a91df8af67a80e933dd207e3f872db4d0" name="drbd-kmp-default" arch="x86_64">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817_k5.3.18_59.19" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="71ee3d824f0d5d28e05dcb5595e035637228e68a4ea9ccadd99602cb62f9b5bc" name="drbd-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817_k5.3.18_59.19" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="c67e4665225db505b38241d611def67d5318bfc862da912efb9324c235ecf953" name="drbd-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817_k5.3.18_59.19" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="b1d676ea47ca7aedbe20d2fb72e62efc26d24d74b2ee0bf22b083ff099b7df51" name="drbd-kmp-rt" arch="x86_64">
  <version epoch="0" ver="9.0.29~0+git.9a7bc817_k5.3.18_8.13" rel="3.3.1"/>
  <changelog author="nwang@suse.com" date="1563537600">- Update to 9.0.19-1
  * check on CAP_SYS_ADMIN instead of CAP_NET_ADMIN for certain operations
  * fix detection of unstable resync
  * fix possible stuck resync when resync started from an other secondary
  and later continued from a primary
  * fix NULL dereference with disk-timeout enabled; was introduced in 9.0.9
  * retry connect when own current UUID changes during UUID exchange
  * fix quorum tie-breaker diskless logic for settings other than "majority"
  * disable quorum tie-breaker for 0 voters
  * fix dax_direct_access() error return check
  * fix resync stuck at near completion; bug was intorduces with 9.0.17
  * unblock IO when on-quorum-lost policy is changed (suspend -&gt; io-error)
  * introduce allow-remote-read configuration option; set it to "no" for
  DR links you only want to write, but never read
  * only complain about UUID changes during initial handshake</changelog>
  <changelog author="nwang@suse.com" date="1568030400">- bsc#1149945, update to 8e93a5d93 (drbd-9.0 branch)
  * Coccinelle support
  * compat with up to Linux-5.3
- Remove patch compat_no_bioset_initialized.patch</changelog>
  <changelog author="jengelh@inai.de" date="1568116800">- Restore higher summary specifity.
- Drop old-age %clean, %defattr.</changelog>
  <changelog author="nwang@suse.com" date="1568721600">- bsc#1146117, disallow dual primaries when not configured.
  Modify patch rely-on-sb-handles.patch</changelog>
  <changelog author="nwang@suse.com" date="1568980800">- bsc#1151579, fix collinelle default path and always trigger in obs
  Add patch suse-coccinelle.patch</changelog>
  <changelog author="nwang@suse.com" date="1570795200">- Update to drbd-9.0.20-1
  * fix a case of false split brain detection if a diskless node promotes
  multiple times, by aligning the rules for generating a new current-UUID
  on a diskless nodes with them on a node with disk
  * check if we still have quorum by exchanging a drbd-ping with peers
  before creating new current UUID after loosing one peer
  * fix after weak handling to not interfere with reconciliation resyncs
  * retry connect when one of the relevant flags changes during UUID exchange
  * fix reconciliation resync if one of the secondary got an current-UUID update
  * fix resync to make progress after it was paused by an other resync operation
  * fix false split-brains when a resync source changes current-UUID during
  resync operation
  * fix restore of D_OUTDATED when the resource first only attached and
  then the peer objects are created (in contrast to the usual, new-peer,
  attach, connect)
  * abort creating new current-UUID when writing to meta-data fails in
  the moment where the new-current-UUID should be written
  * removed DRBD marking itself as read-only when secondary; this flag
  was exposed using the BLKROGET ioctl; that should be left to user-land
  use; recent KVM checks that flag, and does not dare auto-promote when
  set by DRBD
  * fix a small memory-leak when creating peer devices
  * fix a possible information leak of kernel memory that pads net-link packets
  * completing implications of "allow-remote-read=no"; i.e.  when not to
  create a new-current-UUID as read-write access to the data set was lost;
  also fail both reads and writes if reads are no longer possible
  * new option value "rr-conflict=retry-connect"; that helps in scenarios with
  quorum where stopping a service takes longer than a temporarily network
  outage and DRBD's reconnect
  * code cleanups, introduced enums for remaining magic numbers
  * new kernel-backward-compatibility framework based on spatch/coccinelle,
  replacing an unmaintainable moloch of C preprocessor hell; Merged the
  complete kernel-compat submodule
  * ships with pre-computed compat-patches for main distros' kernels; in case
  an other kernel is found it tries to use local spatch, if that is not
  installed the build process tries to use a LINBIT hosted web service
  to create the compat patch ("spatch-as-a-service").
  * compat with up to Linux-5.3-rc2
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="rbrown@suse.com" date="1571313600">- Remove obsolete Groups tag (fate#326485)</changelog>
  <changelog author="nwang@suse.com" date="1576497600">- bsc#1158446, fix metadata limit due to 64k page size of ppc64le.
  add patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch</changelog>
  <changelog author="nwang@suse.com" date="1577361600">- bsc#1159333, back port patch for duplicate resync.
  add patch drbd-update-resync-target-s-dagtag.patch</changelog>
  <changelog author="nwang@suse.com" date="1578052800">- bsc#1159786, fix build issue against v5.5
  add patch without_pr_warning.patch</changelog>
  <changelog author="nwang@suse.com" date="1582632000">- Update to drbd-9.0.21-1, require coccinelle &gt;= 1.0.8
  * fix compat for write same on linux 4.9 and the Debian users
  * fix kernel compat for linux 4.8 and 4.9; this mainly affected Debian
  users; The symptoms where slow resync and resync getting stuck always at
  the same point
  * enable resync of lost and re-created backing devices (think lost node) when
  the backing device was thinly provisioned and its current uuid is pre-set
  to a 'day0 UUID' (by LINSTOR); that works by copying a unused bitmap slot
  which tracks all changes since day 0
  * fix attach when bitmap is on PMEM; before it was set to
  'all blocks out-of-sync' upon attach
  * avoid doing reconciliation resync multiple times by updating the
  resync target's dagtag after if completed successfully
  * return disk-state from Outdated to UpToDate when it loses connection
  while in WFBitMapT and we have a stable and UpToDate peer
  * new option --force-resync flag can be passed to new-current-uuid, that
  can be used to trigger initial resync without touching the role
- Remove upstream drbd-update-resync-target-s-dagtag.patch
- Modify patch suse-coccinelle.patch to adopt spaas</changelog>
  <changelog author="nwang@suse.com" date="1583841600">- bsc#1166298, Update to drbd-9.0.22-1
  * introduce locking to avoid connection retries when UUIDs or
  relevant flags change during the exchange of this data
  * improve serialization of events after loosing a primary
  * fix a constraint in sanitize state that can caused a promote to be
  deliced by some other node
  * fix a case of a false positive detection of a split brain condition
  * allow a resync target to switch to the resync source with less
  bits out of sync
  * fix bitmap UUID after resync to use current UUID from self rather
  than sync source
  * fix pushing bitmap UUID into history when changed
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a reconciliation resync
  * fix regression introduced with 9.0.20, that can cause a missed
  resync after a promote on a diskless node
  * fix UUID handling in case a node promotes during (a short)
  reconciliation resync
  * fix removing of a diskless node when quorum is enabled</changelog>
  <changelog author="nwang@suse.com" date="1591790400">- jsc#11801, enable buildrt for Leap15.2 but Tumbleweed.</changelog>
  <changelog author="nwang@suse.com" date="1591790401">- bsc#1172761, Update to drbd-9.0.23-1
  * fix a deadlock (regression introduced in 9.0.22) that can happen when
  new current UUID is generated while a connection gets established
  * Do not create a new data generation if the node has
  'allow-remote-read = no' set, is primary, and the local disk fails
  (because it has no access to good data anyome)
  * fix a deadlock (regression introduced in 9.0.22) that can be
  triggered if a minor is added into a resource with an established
  connection
  * generate new UUID immediately if a primary loses a disk due to an IO
  error
  * fix read requests on diskless nodes that hit a read error on a
  diskful node; the retry on another diskful node works, but a bug
  could lead to a log-storm on the diskless node
  * fix removal of diskless nodes from clusters with quorum enabled
  (initiated from the diskless itself)
  * fix wrongly declined state changes if connections are established
  concurrently
  * fix continuation of initial resync; before that the initial resync
  always started from the beginning if it was interrupted
  * use rwsem _non_owner() operations to avoid false positives of
  lock-dep when running on a debug kernel
  * fix a sometimes missed resync if only a diskless node was primary
  since the day0 UUID
  * fix a corner case where a SyncSource node does not recognise
  that a SyncTarget node declared the resync as finished
  * update compat up to Linux 5.6
- Remove patch without_pr_warning.patch since change in 7e6a20f7</changelog>
  <changelog author="nwang@suse.com" date="1600344000">- update to 9.0.25-0rc1
  * fix a race condition between receiving UUIDs and finishing a resync
  that can lead to a false-positive split-brain detection later on
  * fix access after free of peer_req objects, that only happened when
  a resync target node is paused sync source at the same time
  * fix abortion of local state changes in case they can not proceed due
  to loss of connection
  * fix corner cases with reconciliation resync and parallel promote
  * fix an issue establishing a connection when the multipath feature is
  used to connect to a stacked resource without a dedicated service IP
  * fix sometimes a peer-disk state to another resync-target staying Outdated
  after two resyncs from the same sync source node finish
  * fix an (unlikely) deadlock while establishing a connection
  * deactivate the kref_debug code, it has performance implicatios
  * Introduce the "disconnected" hander; it receives the last connection
  state in the evnironment variable DRBD_CSTATE
- Changes of drbd-9.0.24-1
  * fix deadlock when connecting drbd-9 to drbd-8.4 and the drbd-9
  side becomes sync-source
  * fix an issue with 3 (or more) node configurations; with a diskless node
  and two storage nodes; if one of the storage nodes was hard rebooted
  and came back and the diskless got primary and did not issue write
  requests and the returning storage node established a connection with
  the surviving storage node first, DRBD failed to upgrade the disk
  state to UpToDate after the resync
  * detect split-brain situations also when both nodes are primary;
  this is how it was in drbd-8.4; up to now drbd-9 did not realize
  the split-brain since it complains about the not allowed dual
  primary first; for this change a new protocol version was necessary
  * verified it compiles with Linux 5.7
- bsc#1176749, add compatible patches to SLE15 SP3 kernel.
  block layer api backport from kernel v5.9
  Add patch blk_alloc_queue_make_request.patch
  Add patch compat_generic_make_request.patch
  Add patch remove_congested_fn_congested_data.patch</changelog>
  <changelog author="nwang@suse.com" date="1602331200">- bsc#1177417, kernel oops when submit bio
  Modify patch compat_generic_make_request.patch
  Modify patch blk_alloc_queue_make_request.patch
- jsc#11801, remove is_opensuse macro for SLE15SP3 only,
  tumbleweed not support RT yet.</changelog>
  <changelog author="nwang@suse.com" date="1604404800">- bsc#1178388, build error with -Wreturn-type
  Add patch fix-err-of-wrong-return-type.patch</changelog>
  <changelog author="nwang@suse.com" date="1607428800">- Update to 9.0.26
  * fix a case of a disk unexpectedly becoming Outdated by moving the
  exchange of the initial packets into the body of the two-phase-commit
  that happens at a connect
  * fix adding of new volumes to resources with a primary node
  * reliably detect split brain situation on both nodes
  * fix an unexpected occurrence of NetworkFailure state in a tight
  drbdsetup disconnect; drbdsetup connect sequence
  * fix online verify to return to Established from VerifyS if the VerifyT node
  was temporarily Inconsistent during the run
  * fix a corner case where a node ends up Outdated after the crash and rejoin
  of a primary node
  * implement 'blockdev --setro' in DRBD
  * following upstream changes to DRBD up to Linux 5.9 and ensure
  compatibility with Linux 5.8 and 5.9
  * fix a crash if during resync a discard operation fails on the
  resync-target node
  * fix online verify to not clamp disk states to UpToDate
  * fix promoting resync-target nodes; the problem was that it could modify
  the bitmap of an ongoing resync; which leads to alarming log messages
  * pause a resync if the sync-source node becomes inconsistent; an example
  is a cascading resync where the upstream resync aborts and leaves the
  sync-source node for the downstream resync with an inconsistent disk;
  note, the node at the end of the chain could still have an outdated disk
  (better than inconsistent)
  * allow force primary on a sync-target node by breaking the resync
  * minor fixes to the compat tests
  * fix for writes not getting mirrored over a connection while the primary
  transitions through the WFBitMapS state
  * completed missing logic of the new two-phase-commit based connect process;
  avoid connecting partitions with a primary in each; ensure consistent
  decisions if the connect attempt will be retried
- Add patch compat-test-header.patch
  Add patch submit-bio-private-date.patch
  Add patch compat_remove_kernel_setsockopt.patch
  Add patch compat_blk_queue_stack_limits.patch
- Remove patch rely-on-sb-handlers.patch (187bddac0)
  Remove patch fix-err-of-wrong-return-type.patch (969310232)
  Remove patch compat_generic_make_request.patch (8615d6837)
  Remove patch blk_alloc_queue_make_request.patch (edaa9b0f/fb59b40e)
  Remove patch remove_congested_fn_congested_data.patch (34484003/9b80d46b)</changelog>
  <changelog author="nwang@suse.com" date="1607515200">- bsc#1179708, compat to kernel v5.10
- Add patch compat_get_fs.patch
  Add patch remove_bdi_cap_stable_writes.patch</changelog>
  <changelog author="nwang@suse.com" date="1620388800">- bsc#1188472, update to 9.0.29
  * fix data corruption when DRBD's backing disk is a degraded Linux software
  raid (MD)
  * add correct thawing of IO requests after IO was frozen due to loss of quorum
  * fix timeout detection after idle periods and for configs with ko-count
  when a disk on an a secondary stops delivering IO-completion events
  * fixed an issue where UUIDs where not shifted in the history slots; that
  caused false "unrelated data" events
  * fix switching resync sources by letting resync requests drain before
  issuing resync requests to the new source; before the fix, it could happen
  that the resync does not terminate since a late reply from the previous
  caused a out-of-sync bit set after the "scan point"
  * fix a temporal deadlock you could trigger when you exercise promotion races
  and mix some read-only openers into the test case
  * fix for bitmap-copy operation in a very specific and unlikely case where
  two nodes do a bitmap-based resync due to disk-states
  * fix size negotiation when combining nodes of different CPU architectures
  that have different page sizes
  * fix a very rare race where DRBD reported wrong magic in a header
  packet right after reconnecting
  * fix a case where DRBD ends up reporting unrelated data; it affected
  thinly allocated resources with a diskless node in a recreate from day0
  event
  * speedup open() of drbd devices if promote has not chance to go through
  * new option "--reset-bitmap=no" for the invalidate and invalidate-remote
  commands; this allows to do a resync after online verify found differences
  * changes to socket buffer sizes get applied to established connections
  immediately; before it was applied after a re-connect
  * add exists events for path objects
  * forbid keyed hash algorithms for online verify, csyms and HMAC base alg
  * fix a regression introduces with 9.0.25; it failed to determine the
  right device size and the connection hangs in WFBitmapS/WFBitmapT
  repl state; to trigger this you need to do a partial resync to a
  new node with different backing device size
  * fix an issue with netlink packets processed in parallel on multiple
  CPUs; the bug caused drbdadm adjust failing in very rare cases
  * fix a very rare occurrence of a reconciliation resync getting stuck
  * fix a race condition that causes a detach operation to hang; it
  is very hard to trigger
  * fix a kernel OOPS (via a BUG()) upon adding a timer twice under very rare
  timing
  * fix a counter imbalance that could lead to assertion messages when a
  protocol A peer disconnects with a certain timing
  * fix a rare race with receiving bitmap and a state change while
  establishing a connection
  * fix UUID handling to avoid false split-brain detections; this bug got
  triggered an isolated primary that gets demoted, and temporal network
  interruptions among the remaining nodes
  * fix resync decision to obey disk states when the generation UUIDs are
  equal; the effect of this bug was that you could end up with two Outdated
  nodes after resync
  * fix concurrent disk-attach operations
  * Fix possible kernel warning regarding an inbalance of backing device
  link/unlink
  * move some amount of kernel backward compatibility code moved from the old
  method (drbd_wrappers.h) to new cocci semantic patches
  * add support renaming resources while its devices might be in use and
  process IO requests
  * Allow setting c_max_rate to 0 with the meaning that the resync controller
  has no upper limit for the resync speed
  * Fix regression: allow live migration between two diskful peers again
  * following upstream changes to DRBD up to Linux 5.12 and updated compat
  rules to support up to Linux 5.12
- Remove patch compat_blk_queue_stack_limits.patch
  Remove patch compat_get_fs.patch
  Remove patch compat_remove_kernel_setsockopt.patch
  Remove patch compat-test-header.patch
  Remove patch drbd-fix-zero-metadata-limit-by-page-size-misaligned.patch
  Remove patch remove_bdi_cap_stable_writes.patch
  Remove patch submit-bio-private-date.patch
- Modify patch suse-coccinelle.patch
- Add patch compat_genl_maxattr_in_ops.patch (48526a0f)
- Bug fixes between 9.0.29 and 9.0.30
  Add patch drbd-change-to-L_VERIFY_S-after-peer-is-L_VERIFY_T.patch
  Add patch drbd-Fix-abortion-of-a-connect-2-phase-commit.patch
  Add patch drbd-Fix-a-possible-NULL-deref-found-with-gcc-11-fan.patch
  Add patch drbd-Fix-locking-for-the-drbd_devices-idr.patch
  Add patch drbd-fix-protocol-compatibility-with-drbd-8.4-state.patch
  Add patch drbd-fix-race-condition-resetting-resync_next_bit.patch
  Add patch drbd-fix-termination-of-verify-with-stop-sector.patch
  Add patch drbd-remove-device_to_minor.patch
  Add patch drbd-use-DEFINE_MUTEX-insteadm-of-mutex_init.patch
  Add patch Revert-drbd-serialize-syncs-from-multiple-sources.patch
- cocci apply: linux-5.12.0-2
  queue_discard_zeroes_data__no_present  (48920ff2a5a9)</changelog>
</package>
<package pkgid="41edc92ad33316341255ec13fbb91ce77c6668daa76632e9c838b724ebe9ba94" name="dtb-aarch64" arch="src">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="838b23d43668812e53f87b1f7c932dcb9701e7c3ed60cfd98493142d9d7dbd1a" name="dtb-aarch64" arch="src">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="2873dec141ba565a61826ed4637594aaacfe2bcbcf177960fd58fa3802dc61e5" name="dtb-aarch64" arch="src">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="02fbb544d87b641cf8ca68f411185d57b1eac923bc4a08b5650e7f8c56a44b41" name="dtb-al" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="d53d7e39b08154028d6388c17419c5683a6d086f7cfbbafd1c4b1cfcc6fdda85" name="dtb-al" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="2d09f4ba06a129afc2a7e7753c055eacae6a5542c3628ba5a436926310cc7ba5" name="dtb-al" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="84382084333f81b298834c6ae69eb27747011fe44fe14c6b2974d241ac6d239c" name="dtb-allwinner" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="53ae385fdbea16a2c01e6f10269e4263ac3273dad95e38cd2db46d4bdd8cb149" name="dtb-allwinner" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="1ccafd5455185a4eb635c89568b3903a1b0962019c92d8d952ab11ed86a2721a" name="dtb-allwinner" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="e77e8700c997bec26b911f53ca6ad6981594d73d6c71b92eefe12647008e113e" name="dtb-altera" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="2d5c5bdd1e61e092c580aa3aad157bcf043f5d966ef569dee395b12e47ef57a3" name="dtb-altera" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="05d436082def20ed805159452574285770fbb94748eae918243dae09c606589e" name="dtb-altera" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="076279815979f4ce4a472bf2e0dd4bed9247198f43fb561cb597ad2895b05f91" name="dtb-amd" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="359355be6510cc84ffa4d7d21a86ac151b9537b9d4aedd76167fdd2e1cd142de" name="dtb-amd" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="34799daabc5bd1549c94bad76793079564341213ba98b48845e1c799d05ae0c6" name="dtb-amd" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="dcb912c4bddf83495ffc33be03304f5af05d7df13ecf2fbf19bac5ade982c709" name="dtb-amlogic" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="dcec2c9d0ef6de6724cf52540ec63187c8417031866b5e20edb69b5e14d7ffdb" name="dtb-amlogic" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="385681bcbef73428c3d4ac09ab94d22ba025f7af3ca839cc1fe789b8bafce1b8" name="dtb-amlogic" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="671b140cd6aedf3c25eb9fa73c4c6e4fc32401bba905031bfc5e2e029df44992" name="dtb-apm" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="b023d48fd4446cc91cc4c3c6cdb3a5e6a8fa04b8ae9a0867bbc730860536a957" name="dtb-apm" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="0bfc10aa7a2241a0da1ca642aa5b94892074c3620114ab4fd6d1cdae2e8a5003" name="dtb-apm" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="57467a081d5c0e8572c67448a80c3d838619508beffe6892b40191de0740cb06" name="dtb-arm" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="621dcf93662e501d5b2d7c305518000ebb24de4ed763ebfb24b524b166aff68b" name="dtb-arm" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="860c9dff5753c06238da961c20ceb050d59d5d77480c2f1aa80103f79c499e49" name="dtb-arm" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="791cfc66dda8f882586e8ec5b23862bbfa941cc4c02f1375b7cb2a88ae9debd0" name="dtb-broadcom" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="3cd3b1b2f6256c4c2824e872c113110884c17e3374ca79b424dbd345d67d00a1" name="dtb-broadcom" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="6268c87bf64f0e1d7c3852c171a470606e1536a46cc25d63bbe90d3148d850b5" name="dtb-broadcom" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="e49c1f6266593bb90e98f23557b226048fd64cb9c52ff13b289fb673d104cac7" name="dtb-cavium" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="a1a524bbafac80eef53d380abebe7833e6199006321af5d443673513fcf3050b" name="dtb-cavium" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="1bc68f4b5203ad4661d276326c4b8f909185feeb8b957068b047c9b51efa4d73" name="dtb-cavium" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="0659577144133af6d695386ae990d5b99bd14c9adca607352956828f13cc9305" name="dtb-exynos" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="7cc3ee71391bc52dedb8da97b66f8b403691197b6e82c9945ca9bf035436ad58" name="dtb-exynos" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="1f014543a4c607a2df6949b5657e3c1e130e4ea76fb014208be856cad541b26b" name="dtb-exynos" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="9ccb60b55d5feef509914a77b6b5d986fc22364ef774265348dceb98b973b134" name="dtb-freescale" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="e4a990b014bd26650e8b3bdec6b8880841d7f33f1876fac4d68ee089aa10acba" name="dtb-freescale" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="1eedef5c06b944a7820c8ed5dcf008a268ad9766acc44bb3f6c5fa8b4a1b8452" name="dtb-freescale" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="3fc91fa4342201dc8bceea736ebcedf09cfbe9b50c874e1e32d9883a5562761d" name="dtb-hisilicon" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="1494291f25472207e131e125c7a336e8c005a289ccc2ff7ad79c8090b7405317" name="dtb-hisilicon" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="8cd594f2194b7ac67f1f24c6ca97ca67bbd19973828c283a24ae070f578ed52a" name="dtb-hisilicon" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="9b0ebec87b00188c467c2c3f9495f1aad551c8e323618036c02fd0e57ee2604a" name="dtb-lg" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="2b1dd3125579b365d1c64645586723871d16a7ea4a23c274c57b1f7603b1049b" name="dtb-lg" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="8e0e13c8ee406201cbfff4bd2a0bdfaf38736cd9672b94eca33854ab5e378399" name="dtb-lg" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="c6ccec8a161670267c20d1067593cca9caa21179aa5e3b8cebcbf84923d06a5d" name="dtb-marvell" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="214c7d1e10ff39e66247a55f14fbd266a3fb34825f376e7d172a1f5f2dead987" name="dtb-marvell" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="c160a75d9c33ea1d93a35e833a67e2db8391ce3df6c4d42de1ca4f35bfccd211" name="dtb-marvell" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="906ebe84d62d9c8f04ce840517801a8379da66954c67d8270fceb5663a716d46" name="dtb-mediatek" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="9a55dfa8c03ff0e33c7d98cb71c1013adc6d44c4220170fd7607c5f573f81b55" name="dtb-mediatek" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="762ae2de683d479b70f293851ffef92b2a97513599a9d3b94e7ab678c804319b" name="dtb-mediatek" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="3fe6f5e0d28a2ab2f151f743ce00dc413118597cbf8ac4e072b13e9066fa62ce" name="dtb-nvidia" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="0330357c80d679eabcd84cd2129987e075cba22903b7e4eca0e006524b4162c6" name="dtb-nvidia" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="ed09040d5ed3c6fc835270105642eb49f0ceb16774174549b8e1f08144cdd969" name="dtb-nvidia" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="f365e695b44fc19a13e0e22e522220768b556f1d01738daf1133fb994a01a33e" name="dtb-qcom" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="98ecc2d93a981a2576885086fc9c982e0c7cb6ef3af7bd755585394b5f5d0bf9" name="dtb-qcom" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="bb5bddf83c0024462304bb91efeb205ec5bdc63c42f9bba25c3c7f25eae2ffa5" name="dtb-qcom" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="26510b23fbf6ddf506595f0c7e9c902326d1cf7cc1593d09f0a23b2ffd5b0402" name="dtb-renesas" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="018749290807d9df98862221b9e309f11e26f914c8d94aaa9d1eb79928fa998b" name="dtb-renesas" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="f1bf10b41f8de192bad99256716f6148f412308d85bdbdec7f5aa6a7104f6974" name="dtb-renesas" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="bc6c796f4e8115b5959982a1c0dae70600905ed40e714d06968f8daa96d37e01" name="dtb-rockchip" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="1e8b2e37980a909bf9a353b148c960beb4d721a7190310fb625b730245405289" name="dtb-rockchip" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="239f41acb6a0dc0ec18c03a5c9a0dd1a011b82d6510e38aaa1652789798d297d" name="dtb-rockchip" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="423cfefc7d2fb2be1793c059c6f1831749f18efa0707b36b52c8c582282986ed" name="dtb-socionext" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="4bd25ce9ba50791d8dffd64b78444fafa45d76f37fc24390dd1c7c8b31943fd4" name="dtb-socionext" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="f68f96a8ccad263ed81cd802decd05289b8bba29a3736b8170b60633f25bbdba" name="dtb-socionext" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="43cfff5ecec8824258634eec203f12de8af30c9577283dee38e502982103c7a3" name="dtb-sprd" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="0fb6281d916beb9d691b6506a25c6a9b09903ad7d79d313796a7a9870d68f0cf" name="dtb-sprd" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="ce6b230c39aacf5e222273a46c663145ae54573efd7740a920faad25e09131e2" name="dtb-sprd" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="0cf506b568ac6b42fe765f1516564fa76b065e909f028ff2e21eaa5828bbcde9" name="dtb-xilinx" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="9917b4bb8f577959bc4e407494795c6c3a3aaee3dd022f25964ddd20e895353a" name="dtb-xilinx" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="6af8bace0c4ef1c4eb4e40571bd2b6dc11b3e565b9574910ad742ccb10d441a1" name="dtb-xilinx" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="d30c99dea9daf0f45645e6c69b71209ce0c1775f47ff6364bf61ddf1d5bf923d" name="dtb-zte" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="10baeee04e92cd94bd25803b11f886acccb16fff63f29256269fa3cd812d925a" name="dtb-zte" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="35e1f8a23efde3d4183cf97192516acdac9900506269b62cc70292061f995b10" name="dtb-zte" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="2d3ea9c8ff7d8fd47d186c006b015ecb594fa8ffe5d02823cc8adeba8af1c00e" name="efibootmgr" arch="aarch64">
  <version epoch="0" ver="14" rel="4.3.2"/>
  <changelog author="glin@suse.com" date="1414584000">- Update version number to 0.11.0
- Rebase patches
  (efibootmgr-0.11.0-derhat.diff,
  efibootmgr-0.11.0-check-boot-order.diff)
- Drop efibootmgr-0.6.0-set_boot_order.diff since the data size of
  the variable is handled properly now
- Drop efibootmgr-0.6.0-fail-visibly.diff since err() and warn()
  are introduced to show more meaningful messages
- Drop upstreamed patch
  (efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)</changelog>
  <changelog author="dmueller@suse.com" date="1414756800">- efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-derhat.diff:
  pass source validator check
- switch homepage to https://github.com/vathpela/efibootmgr</changelog>
  <changelog author="mpluskal@suse.com" date="1419249600">- Enable i586 build</changelog>
  <changelog author="rw@suse.com" date="1422619200">- Introduce partition UUID as selector for delete.  [bsc#870211]
  (efibootmgr-0.6.0-delete-by-uuid.diff)</changelog>
  <changelog author="rw@suse.com" date="1426075200">- Allow disk/partition as selector for delete as well.  [bsc#870211]
  (efibootmgr-delete-multiple.diff)
- Remove version number from patches.
  (add efibootmgr-derhat.diff, efibootmgr-fail-visibly.diff,
  efibootmgr-gcc-Wall.diff, efibootmgr-set_boot_order.diff,
  efibootmgr-write-unique-id-once.diff;
  drop efibootmgr-0.6.0-check-boot-order.diff,
  efibootmgr-0.6.0-delete-by-uuid.diff, efibootmgr-0.6.0-derhat.diff,
  efibootmgr-0.6.0-fail-visibly.diff, efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-set_boot_order.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)
  Note: this entry reflects obsoleted, SLE-only changes!</changelog>
  <changelog author="mpluskal@suse.com" date="1434110400">- Update to 0.12
  * This release is mostly a maintenance release that uses
    libefivar's new library API for creating device paths and load
    options.
  * Also DHCPv4 network boot entries are now something you can
    create without knowing an awful lot about ACPI.
- Refresh patches
  efibootmgr-0.11.0-derhat.diff as efibootmgr-derhat.diff
  efibootmgr-0.11.0-check-boot-order.diff as
  efibootmgr-check-boot-order.diff
- Update project and download url</changelog>
  <changelog author="rw@suse.com" date="1437739200">- Refresh for SLE12.  [bsc#929677]
  (efibootmgr-gcc-Wall.diff, efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="rw@suse.com" date="1442318400">- Properly latch long to short option for delete.  [bsc#945705]
  (efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Add efibootmgr-fix-efivar-0.24.patch fix the compilation errors
  caused by the efivar update</changelog>
  <changelog author="rw@suse.com" date="1468497600">- Add support for Memory Address Range Mirroring.
  [fate#320999, bsc#987599]
  (add MARM-add-m-and-M-options.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-sanitize-set_mirror.diff)</changelog>
  <changelog author="arvidjaar@gmail.com" date="1471694400">- add efibootmgr-fix-usage-of-efi_loadopt_path-again.patch - fix
  efibootmgr -v with new efivar (boo#993458)</changelog>
  <changelog author="msuchanek@suse.com" date="1487246400">- Build on all archs. There is no reason not to. (boo#1025520)
- Depend on new enough efivar. Build fails otherwise.</changelog>
  <changelog author="rw@suse.com" date="1488542400">- Update to 14 plus upstream fixes.  (fate#322108)
  (0001-Don-t-use-fshort-wchar-when-building-63.patch,
  0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch,
  0003-Add-support-for-parsing-optional-data-as-ucs2.patch)
- Forward port and refresh SLE patches
  (efibootmgr-derhat.diff, MARM-sanitize-set_mirror.diff
  efibootmgr-delete-multiple.diff)
- Drop upstreamed patches
  (efibootmgr-check-boot-order.diff,
  efibootmgr-fix-efivar-0.24.patch,
  efibootmgr-fix-usage-of-efi_loadopt_path-again.patch,
  MARM-add-m-and-M-options.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff)</changelog>
  <changelog author="meissner@suse.com" date="1497096000">- forcefully enable PIE</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
</package>
<package pkgid="ed12df6cf3106c36e81cee3cad3cac7666cec66db13f3ba950a406cd9dae664e" name="efibootmgr" arch="ppc64le">
  <version epoch="0" ver="14" rel="4.3.2"/>
  <changelog author="glin@suse.com" date="1414584000">- Update version number to 0.11.0
- Rebase patches
  (efibootmgr-0.11.0-derhat.diff,
  efibootmgr-0.11.0-check-boot-order.diff)
- Drop efibootmgr-0.6.0-set_boot_order.diff since the data size of
  the variable is handled properly now
- Drop efibootmgr-0.6.0-fail-visibly.diff since err() and warn()
  are introduced to show more meaningful messages
- Drop upstreamed patch
  (efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)</changelog>
  <changelog author="dmueller@suse.com" date="1414756800">- efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-derhat.diff:
  pass source validator check
- switch homepage to https://github.com/vathpela/efibootmgr</changelog>
  <changelog author="mpluskal@suse.com" date="1419249600">- Enable i586 build</changelog>
  <changelog author="rw@suse.com" date="1422619200">- Introduce partition UUID as selector for delete.  [bsc#870211]
  (efibootmgr-0.6.0-delete-by-uuid.diff)</changelog>
  <changelog author="rw@suse.com" date="1426075200">- Allow disk/partition as selector for delete as well.  [bsc#870211]
  (efibootmgr-delete-multiple.diff)
- Remove version number from patches.
  (add efibootmgr-derhat.diff, efibootmgr-fail-visibly.diff,
  efibootmgr-gcc-Wall.diff, efibootmgr-set_boot_order.diff,
  efibootmgr-write-unique-id-once.diff;
  drop efibootmgr-0.6.0-check-boot-order.diff,
  efibootmgr-0.6.0-delete-by-uuid.diff, efibootmgr-0.6.0-derhat.diff,
  efibootmgr-0.6.0-fail-visibly.diff, efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-set_boot_order.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)
  Note: this entry reflects obsoleted, SLE-only changes!</changelog>
  <changelog author="mpluskal@suse.com" date="1434110400">- Update to 0.12
  * This release is mostly a maintenance release that uses
    libefivar's new library API for creating device paths and load
    options.
  * Also DHCPv4 network boot entries are now something you can
    create without knowing an awful lot about ACPI.
- Refresh patches
  efibootmgr-0.11.0-derhat.diff as efibootmgr-derhat.diff
  efibootmgr-0.11.0-check-boot-order.diff as
  efibootmgr-check-boot-order.diff
- Update project and download url</changelog>
  <changelog author="rw@suse.com" date="1437739200">- Refresh for SLE12.  [bsc#929677]
  (efibootmgr-gcc-Wall.diff, efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="rw@suse.com" date="1442318400">- Properly latch long to short option for delete.  [bsc#945705]
  (efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Add efibootmgr-fix-efivar-0.24.patch fix the compilation errors
  caused by the efivar update</changelog>
  <changelog author="rw@suse.com" date="1468497600">- Add support for Memory Address Range Mirroring.
  [fate#320999, bsc#987599]
  (add MARM-add-m-and-M-options.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-sanitize-set_mirror.diff)</changelog>
  <changelog author="arvidjaar@gmail.com" date="1471694400">- add efibootmgr-fix-usage-of-efi_loadopt_path-again.patch - fix
  efibootmgr -v with new efivar (boo#993458)</changelog>
  <changelog author="msuchanek@suse.com" date="1487246400">- Build on all archs. There is no reason not to. (boo#1025520)
- Depend on new enough efivar. Build fails otherwise.</changelog>
  <changelog author="rw@suse.com" date="1488542400">- Update to 14 plus upstream fixes.  (fate#322108)
  (0001-Don-t-use-fshort-wchar-when-building-63.patch,
  0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch,
  0003-Add-support-for-parsing-optional-data-as-ucs2.patch)
- Forward port and refresh SLE patches
  (efibootmgr-derhat.diff, MARM-sanitize-set_mirror.diff
  efibootmgr-delete-multiple.diff)
- Drop upstreamed patches
  (efibootmgr-check-boot-order.diff,
  efibootmgr-fix-efivar-0.24.patch,
  efibootmgr-fix-usage-of-efi_loadopt_path-again.patch,
  MARM-add-m-and-M-options.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff)</changelog>
  <changelog author="meissner@suse.com" date="1497096000">- forcefully enable PIE</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
</package>
<package pkgid="3d1759023a5b1f03441548852fbc17825f1f1d5bb39fe4241ef8093092df8251" name="efibootmgr" arch="s390x">
  <version epoch="0" ver="14" rel="4.3.2"/>
  <changelog author="glin@suse.com" date="1414584000">- Update version number to 0.11.0
- Rebase patches
  (efibootmgr-0.11.0-derhat.diff,
  efibootmgr-0.11.0-check-boot-order.diff)
- Drop efibootmgr-0.6.0-set_boot_order.diff since the data size of
  the variable is handled properly now
- Drop efibootmgr-0.6.0-fail-visibly.diff since err() and warn()
  are introduced to show more meaningful messages
- Drop upstreamed patch
  (efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)</changelog>
  <changelog author="dmueller@suse.com" date="1414756800">- efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-derhat.diff:
  pass source validator check
- switch homepage to https://github.com/vathpela/efibootmgr</changelog>
  <changelog author="mpluskal@suse.com" date="1419249600">- Enable i586 build</changelog>
  <changelog author="rw@suse.com" date="1422619200">- Introduce partition UUID as selector for delete.  [bsc#870211]
  (efibootmgr-0.6.0-delete-by-uuid.diff)</changelog>
  <changelog author="rw@suse.com" date="1426075200">- Allow disk/partition as selector for delete as well.  [bsc#870211]
  (efibootmgr-delete-multiple.diff)
- Remove version number from patches.
  (add efibootmgr-derhat.diff, efibootmgr-fail-visibly.diff,
  efibootmgr-gcc-Wall.diff, efibootmgr-set_boot_order.diff,
  efibootmgr-write-unique-id-once.diff;
  drop efibootmgr-0.6.0-check-boot-order.diff,
  efibootmgr-0.6.0-delete-by-uuid.diff, efibootmgr-0.6.0-derhat.diff,
  efibootmgr-0.6.0-fail-visibly.diff, efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-set_boot_order.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)
  Note: this entry reflects obsoleted, SLE-only changes!</changelog>
  <changelog author="mpluskal@suse.com" date="1434110400">- Update to 0.12
  * This release is mostly a maintenance release that uses
    libefivar's new library API for creating device paths and load
    options.
  * Also DHCPv4 network boot entries are now something you can
    create without knowing an awful lot about ACPI.
- Refresh patches
  efibootmgr-0.11.0-derhat.diff as efibootmgr-derhat.diff
  efibootmgr-0.11.0-check-boot-order.diff as
  efibootmgr-check-boot-order.diff
- Update project and download url</changelog>
  <changelog author="rw@suse.com" date="1437739200">- Refresh for SLE12.  [bsc#929677]
  (efibootmgr-gcc-Wall.diff, efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="rw@suse.com" date="1442318400">- Properly latch long to short option for delete.  [bsc#945705]
  (efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Add efibootmgr-fix-efivar-0.24.patch fix the compilation errors
  caused by the efivar update</changelog>
  <changelog author="rw@suse.com" date="1468497600">- Add support for Memory Address Range Mirroring.
  [fate#320999, bsc#987599]
  (add MARM-add-m-and-M-options.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-sanitize-set_mirror.diff)</changelog>
  <changelog author="arvidjaar@gmail.com" date="1471694400">- add efibootmgr-fix-usage-of-efi_loadopt_path-again.patch - fix
  efibootmgr -v with new efivar (boo#993458)</changelog>
  <changelog author="msuchanek@suse.com" date="1487246400">- Build on all archs. There is no reason not to. (boo#1025520)
- Depend on new enough efivar. Build fails otherwise.</changelog>
  <changelog author="rw@suse.com" date="1488542400">- Update to 14 plus upstream fixes.  (fate#322108)
  (0001-Don-t-use-fshort-wchar-when-building-63.patch,
  0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch,
  0003-Add-support-for-parsing-optional-data-as-ucs2.patch)
- Forward port and refresh SLE patches
  (efibootmgr-derhat.diff, MARM-sanitize-set_mirror.diff
  efibootmgr-delete-multiple.diff)
- Drop upstreamed patches
  (efibootmgr-check-boot-order.diff,
  efibootmgr-fix-efivar-0.24.patch,
  efibootmgr-fix-usage-of-efi_loadopt_path-again.patch,
  MARM-add-m-and-M-options.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff)</changelog>
  <changelog author="meissner@suse.com" date="1497096000">- forcefully enable PIE</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
</package>
<package pkgid="5d40b99357d5159ae12c72f492b7a85a6cf29deefe7e09c191ace591664465c4" name="efibootmgr" arch="src">
  <version epoch="0" ver="14" rel="4.3.2"/>
  <changelog author="rw@suse.com" date="1364385600">- Fix '--bootorder' handling.  [bnc#810899]
  (efibootmgr-0.5.4-set_boot_order.diff)
- Print EFI status in case of failure.  [bnc#811767]
  (efibootmgr-0.5.4-fail-visibly.diff)</changelog>
  <changelog author="rw@suse.com" date="1364385601">- Print EFI status for failed '--create' as well.  [bnc#811767]
  (efibootmgr-0.5.4-fail-visibly.diff)</changelog>
  <changelog author="rw@suse.com" date="1387454400">- Update version number to 0.6.0,
- Integrate SLE11 patches.  [bnc#830784]
  (efibootmgr-0.6.0-fail-visibly.diff,
  efibootmgr-0.6.0-set_boot_order.diff)
- Fix gcc warnings.
  (efibootmgr-0.6.0-gcc-Wall.diff)
- Make default '--loader' build-time configurable.
  (efibootmgr-0.6.0-derhat.diff)
- Don't let '--write-signature' overwrite unique signatures.
  (efibootmgr-0.6.0-write-unique-id-once.diff)
- Drop obsolete patches
  (efibootmgr-0.5.4.diff,
  efibootmgr-0.5.4-catchup.diff,
  efibootmgr-0.5.4-sector-size.diff)</changelog>
  <changelog author="glin@suse.com" date="1404734400">- Add efibootmgr-0.6.0-check-boot-order.diff to delete BootOrder
  if there is no more boot option. [bnc#883545]</changelog>
  <changelog author="schwab@suse.de" date="1410264000">- Enable for aarch64 (fate#318444)</changelog>
  <changelog author="glin@suse.com" date="1414584000">- Update version number to 0.11.0
- Rebase patches
  (efibootmgr-0.11.0-derhat.diff,
  efibootmgr-0.11.0-check-boot-order.diff)
- Drop efibootmgr-0.6.0-set_boot_order.diff since the data size of
  the variable is handled properly now
- Drop efibootmgr-0.6.0-fail-visibly.diff since err() and warn()
  are introduced to show more meaningful messages
- Drop upstreamed patch
  (efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)</changelog>
  <changelog author="dmueller@suse.com" date="1414756800">- efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-derhat.diff:
  pass source validator check
- switch homepage to https://github.com/vathpela/efibootmgr</changelog>
  <changelog author="mpluskal@suse.com" date="1419249600">- Enable i586 build</changelog>
  <changelog author="rw@suse.com" date="1422619200">- Introduce partition UUID as selector for delete.  [bsc#870211]
  (efibootmgr-0.6.0-delete-by-uuid.diff)</changelog>
  <changelog author="rw@suse.com" date="1426075200">- Allow disk/partition as selector for delete as well.  [bsc#870211]
  (efibootmgr-delete-multiple.diff)
- Remove version number from patches.
  (add efibootmgr-derhat.diff, efibootmgr-fail-visibly.diff,
  efibootmgr-gcc-Wall.diff, efibootmgr-set_boot_order.diff,
  efibootmgr-write-unique-id-once.diff;
  drop efibootmgr-0.6.0-check-boot-order.diff,
  efibootmgr-0.6.0-delete-by-uuid.diff, efibootmgr-0.6.0-derhat.diff,
  efibootmgr-0.6.0-fail-visibly.diff, efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-set_boot_order.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)
  Note: this entry reflects obsoleted, SLE-only changes!</changelog>
  <changelog author="mpluskal@suse.com" date="1434110400">- Update to 0.12
  * This release is mostly a maintenance release that uses
    libefivar's new library API for creating device paths and load
    options.
  * Also DHCPv4 network boot entries are now something you can
    create without knowing an awful lot about ACPI.
- Refresh patches
  efibootmgr-0.11.0-derhat.diff as efibootmgr-derhat.diff
  efibootmgr-0.11.0-check-boot-order.diff as
  efibootmgr-check-boot-order.diff
- Update project and download url</changelog>
  <changelog author="rw@suse.com" date="1437739200">- Refresh for SLE12.  [bsc#929677]
  (efibootmgr-gcc-Wall.diff, efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="rw@suse.com" date="1442318400">- Properly latch long to short option for delete.  [bsc#945705]
  (efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Add efibootmgr-fix-efivar-0.24.patch fix the compilation errors
  caused by the efivar update</changelog>
  <changelog author="rw@suse.com" date="1468497600">- Add support for Memory Address Range Mirroring.
  [fate#320999, bsc#987599]
  (add MARM-add-m-and-M-options.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-sanitize-set_mirror.diff)</changelog>
  <changelog author="arvidjaar@gmail.com" date="1471694400">- add efibootmgr-fix-usage-of-efi_loadopt_path-again.patch - fix
  efibootmgr -v with new efivar (boo#993458)</changelog>
  <changelog author="msuchanek@suse.com" date="1487246400">- Build on all archs. There is no reason not to. (boo#1025520)
- Depend on new enough efivar. Build fails otherwise.</changelog>
  <changelog author="rw@suse.com" date="1488542400">- Update to 14 plus upstream fixes.  (fate#322108)
  (0001-Don-t-use-fshort-wchar-when-building-63.patch,
  0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch,
  0003-Add-support-for-parsing-optional-data-as-ucs2.patch)
- Forward port and refresh SLE patches
  (efibootmgr-derhat.diff, MARM-sanitize-set_mirror.diff
  efibootmgr-delete-multiple.diff)
- Drop upstreamed patches
  (efibootmgr-check-boot-order.diff,
  efibootmgr-fix-efivar-0.24.patch,
  efibootmgr-fix-usage-of-efi_loadopt_path-again.patch,
  MARM-add-m-and-M-options.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff)</changelog>
  <changelog author="meissner@suse.com" date="1497096000">- forcefully enable PIE</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
</package>
<package pkgid="f114f303f29499d40420eef82596ae96e01843a48a715bcd4b3512f7b5e4b441" name="efibootmgr" arch="x86_64">
  <version epoch="0" ver="14" rel="4.3.2"/>
  <changelog author="glin@suse.com" date="1414584000">- Update version number to 0.11.0
- Rebase patches
  (efibootmgr-0.11.0-derhat.diff,
  efibootmgr-0.11.0-check-boot-order.diff)
- Drop efibootmgr-0.6.0-set_boot_order.diff since the data size of
  the variable is handled properly now
- Drop efibootmgr-0.6.0-fail-visibly.diff since err() and warn()
  are introduced to show more meaningful messages
- Drop upstreamed patch
  (efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)</changelog>
  <changelog author="dmueller@suse.com" date="1414756800">- efibootmgr-0.6.0-check-boot-order.diff, efibootmgr-0.6.0-derhat.diff:
  pass source validator check
- switch homepage to https://github.com/vathpela/efibootmgr</changelog>
  <changelog author="mpluskal@suse.com" date="1419249600">- Enable i586 build</changelog>
  <changelog author="rw@suse.com" date="1422619200">- Introduce partition UUID as selector for delete.  [bsc#870211]
  (efibootmgr-0.6.0-delete-by-uuid.diff)</changelog>
  <changelog author="rw@suse.com" date="1426075200">- Allow disk/partition as selector for delete as well.  [bsc#870211]
  (efibootmgr-delete-multiple.diff)
- Remove version number from patches.
  (add efibootmgr-derhat.diff, efibootmgr-fail-visibly.diff,
  efibootmgr-gcc-Wall.diff, efibootmgr-set_boot_order.diff,
  efibootmgr-write-unique-id-once.diff;
  drop efibootmgr-0.6.0-check-boot-order.diff,
  efibootmgr-0.6.0-delete-by-uuid.diff, efibootmgr-0.6.0-derhat.diff,
  efibootmgr-0.6.0-fail-visibly.diff, efibootmgr-0.6.0-gcc-Wall.diff,
  efibootmgr-0.6.0-set_boot_order.diff,
  efibootmgr-0.6.0-write-unique-id-once.diff)
  Note: this entry reflects obsoleted, SLE-only changes!</changelog>
  <changelog author="mpluskal@suse.com" date="1434110400">- Update to 0.12
  * This release is mostly a maintenance release that uses
    libefivar's new library API for creating device paths and load
    options.
  * Also DHCPv4 network boot entries are now something you can
    create without knowing an awful lot about ACPI.
- Refresh patches
  efibootmgr-0.11.0-derhat.diff as efibootmgr-derhat.diff
  efibootmgr-0.11.0-check-boot-order.diff as
  efibootmgr-check-boot-order.diff
- Update project and download url</changelog>
  <changelog author="rw@suse.com" date="1437739200">- Refresh for SLE12.  [bsc#929677]
  (efibootmgr-gcc-Wall.diff, efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="rw@suse.com" date="1442318400">- Properly latch long to short option for delete.  [bsc#945705]
  (efibootmgr-delete-multiple.diff)</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Add efibootmgr-fix-efivar-0.24.patch fix the compilation errors
  caused by the efivar update</changelog>
  <changelog author="rw@suse.com" date="1468497600">- Add support for Memory Address Range Mirroring.
  [fate#320999, bsc#987599]
  (add MARM-add-m-and-M-options.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-sanitize-set_mirror.diff)</changelog>
  <changelog author="arvidjaar@gmail.com" date="1471694400">- add efibootmgr-fix-usage-of-efi_loadopt_path-again.patch - fix
  efibootmgr -v with new efivar (boo#993458)</changelog>
  <changelog author="msuchanek@suse.com" date="1487246400">- Build on all archs. There is no reason not to. (boo#1025520)
- Depend on new enough efivar. Build fails otherwise.</changelog>
  <changelog author="rw@suse.com" date="1488542400">- Update to 14 plus upstream fixes.  (fate#322108)
  (0001-Don-t-use-fshort-wchar-when-building-63.patch,
  0002-Remove-extra-const-keywords-gcc-7-gripes-about.patch,
  0003-Add-support-for-parsing-optional-data-as-ucs2.patch)
- Forward port and refresh SLE patches
  (efibootmgr-derhat.diff, MARM-sanitize-set_mirror.diff
  efibootmgr-delete-multiple.diff)
- Drop upstreamed patches
  (efibootmgr-check-boot-order.diff,
  efibootmgr-fix-efivar-0.24.patch,
  efibootmgr-fix-usage-of-efi_loadopt_path-again.patch,
  MARM-add-m-and-M-options.diff,
  MARM-extend-man-for-M-option.diff,
  MARM-fix-insufficient-validation-check-of-M-option.diff,
  MARM-introduce-man-for-m-and-M-option.diff)</changelog>
  <changelog author="meissner@suse.com" date="1497096000">- forcefully enable PIE</changelog>
  <changelog author="kukuk@suse.de" date="1522756800">- Use %license instead of %doc [bsc#1082318]</changelog>
</package>
<package pkgid="00d358e0653e0f63e896b8e2f7b2803f20631904b72882ee899979d8bbe11da3" name="efivar" arch="aarch64">
  <version epoch="0" ver="37" rel="6.12.1"/>
  <changelog author="rguenther@suse.com" date="1455105600">- Add efivar-0.21-gcc6.diff to fix strict-aliasing issue.
- Build with -Wno-nonnull as efivar tests nonnull args for zero
  and that breaks with its use of -Werror.</changelog>
  <changelog author="glin@suse.com" date="1457524800">- Update to 0.23 for fwupdate (FATE#319345)
- Add efivar-nvme-rename.patch and efivar-nvme-no-kernel-header.patch
  to work around the missing kernel header.
- Add efivar-no-static.patch to remove efivar-static since it
  causes build failure and we don't really need it.
- Remove efivar-fix-initializer.patch since it's already in 0.23.
- Remove _smp_mflags since the Makefile doesn't work well with
  the flag.</changelog>
  <changelog author="glin@suse.com" date="1460462400">- Add the missing COPYING</changelog>
  <changelog author="glin@suse.com" date="1460548800">- Add efivar-relicensing.patch to update the license in some files</changelog>
  <changelog author="glin@suse.com" date="1468238400">- Add efivar-bsc988000-fix-mode-efi_set_variable.patch and
  efivar-bsc988000-remove-versioning-efi_set_variable.patch to set
  the default file mode rather than fetching a value randomly
  (bsc#988000)</changelog>
  <changelog author="schwab@suse.de" date="1468324800">- deprecated-readdir_r.patch: Remove use of deprecated readdir_r</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Update to 0.24
- Drop upstreamed patches
  + efivar-0.21-gcc6.diff
  + efivar-nvme-rename.patch
  + efivar-nvme-no-kernel-header.patch
  + efivar-relicensing.patch
  + efivar-bsc988000-fix-mode-efi_set_variable.patch</changelog>
  <changelog author="rw@suse.com" date="1486382400">- Fix building for SLE11SP4, SLE12SP2, and Tumbleweed
  (fate#322108, bnc#1012765)
- Drop obsolete patch
  efivar-bsc988000-remove-versioning-efi_set_variable.patch</changelog>
  <changelog author="glin@suse.com" date="1486641600">- Add efivar-use-sysmacros.patch to fix the Factory/Tumbleweed
  build correctly.
- Amend the spec file to specify the gcc version for SLE11SP4</changelog>
  <changelog author="rw@suse.com" date="1486728000">- Update to 31  (fate#322108)
- Drop upstreamed patches
  + efivar-no-static.patch
  + deprecated-readdir_r.patch
  + efivar-use-sysmacros.patch</changelog>
  <changelog author="rw@suse.com" date="1488542400">- libefiboot-export-disk_get_partition_info.patch:
  (bsc#870211, bsc#945705)</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- RPM group fix</changelog>
  <changelog author="oliver@getspam.de" date="1529496000">- Update to version 36
- adjust libefiboot-export-disk_get_partition_info.patch to fit
  new version</changelog>
  <changelog author="glin@suse.com" date="1531742400">- Downgrade to 35 (fate#326702)
  + 36 rewrote the linux interface parsers and caused several
    problems in efibootmgr. Downgrade the version before the change
    to avoid the failure of boot variable creation
    (boo#1100077, boo#1101023)
- Refresh libefiboot-export-disk_get_partition_info.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1532433600">- Add reproducible.patch to initialize memory (boo#1061219)</changelog>
  <changelog author="glin@suse.com" date="1550836800">- Update to 37
  + Improve ACPI device path formatting
  + Add support for SOC devices that use FDT as their PCI root node
  + Make devices we can't parse the "device" sysfs link for use
    DEV_ABBREV_ONLY
  + Handle SCSI port numbers better
  + Don't require an EUI for NVMe (boo#1100077)
  + Fix the accidental requirement on ACPI UID nodes existing
  + Add support for EMMC devices
  + Add support for PCI root nodes without a device link in sysfs
  + Add support for partitioned MD devices
  + Fix partition number detection when the number isn't provided
  + Add support for ACPI Generic Container and Embedded Controller
    root nodes (boo#1101023)
  + Add limited support for SAS/SATA port expanders
- Add upstream patches to fix boo#1120862
  + efivar-make-format_guid-handle-misaligned-guid-pointer.patch
  + efivar-Fix-all-the-places-Werror-address-of-packed-member-c.patch
- Drop upstreamed reproducible.patch
- Refresh libefiboot-export-disk_get_partition_info.patch
- Use %license for COPYING</changelog>
  <changelog author="glin@suse.com" date="1552046400">- Add efivar-bsc1127544-fix-ucs2len.patch to fix logic that checks
  for UCS-2 string termination (boo#1127544)
- Add efivar-fix-efidp_ipv4_addr-fields-assignment.patch to fix the
  casting of IPv4 address.</changelog>
  <changelog author="glin@suse.com" date="1599566400">- Add efivar-bsc1175989-handle-NULL-set-variable.patch to fix
  segfault on non-EFI systems (bsc#1175989)
- Delete unused file: reproducible.patch</changelog>
  <changelog author="glin@suse.com" date="1614686400">- Add efivar-bsc1181967-fix-nvme-parsing.patch to fix the NVME
  path parsing (bsc#1181967)</changelog>
  <changelog author="glin@suse.com" date="1623844800">- Add efivar-bsc1187386-fix-emmc-parsing.patch to fix the eMMC
  sysfs parsing (bsc#1187386)</changelog>
</package>
<package pkgid="2522f7a493c85cbb3fe1060cc899d5746d14a3d32c09c12f46a063113ba1c14f" name="efivar" arch="ppc64le">
  <version epoch="0" ver="37" rel="6.12.1"/>
  <changelog author="rguenther@suse.com" date="1455105600">- Add efivar-0.21-gcc6.diff to fix strict-aliasing issue.
- Build with -Wno-nonnull as efivar tests nonnull args for zero
  and that breaks with its use of -Werror.</changelog>
  <changelog author="glin@suse.com" date="1457524800">- Update to 0.23 for fwupdate (FATE#319345)
- Add efivar-nvme-rename.patch and efivar-nvme-no-kernel-header.patch
  to work around the missing kernel header.
- Add efivar-no-static.patch to remove efivar-static since it
  causes build failure and we don't really need it.
- Remove efivar-fix-initializer.patch since it's already in 0.23.
- Remove _smp_mflags since the Makefile doesn't work well with
  the flag.</changelog>
  <changelog author="glin@suse.com" date="1460462400">- Add the missing COPYING</changelog>
  <changelog author="glin@suse.com" date="1460548800">- Add efivar-relicensing.patch to update the license in some files</changelog>
  <changelog author="glin@suse.com" date="1468238400">- Add efivar-bsc988000-fix-mode-efi_set_variable.patch and
  efivar-bsc988000-remove-versioning-efi_set_variable.patch to set
  the default file mode rather than fetching a value randomly
  (bsc#988000)</changelog>
  <changelog author="schwab@suse.de" date="1468324800">- deprecated-readdir_r.patch: Remove use of deprecated readdir_r</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Update to 0.24
- Drop upstreamed patches
  + efivar-0.21-gcc6.diff
  + efivar-nvme-rename.patch
  + efivar-nvme-no-kernel-header.patch
  + efivar-relicensing.patch
  + efivar-bsc988000-fix-mode-efi_set_variable.patch</changelog>
  <changelog author="rw@suse.com" date="1486382400">- Fix building for SLE11SP4, SLE12SP2, and Tumbleweed
  (fate#322108, bnc#1012765)
- Drop obsolete patch
  efivar-bsc988000-remove-versioning-efi_set_variable.patch</changelog>
  <changelog author="glin@suse.com" date="1486641600">- Add efivar-use-sysmacros.patch to fix the Factory/Tumbleweed
  build correctly.
- Amend the spec file to specify the gcc version for SLE11SP4</changelog>
  <changelog author="rw@suse.com" date="1486728000">- Update to 31  (fate#322108)
- Drop upstreamed patches
  + efivar-no-static.patch
  + deprecated-readdir_r.patch
  + efivar-use-sysmacros.patch</changelog>
  <changelog author="rw@suse.com" date="1488542400">- libefiboot-export-disk_get_partition_info.patch:
  (bsc#870211, bsc#945705)</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- RPM group fix</changelog>
  <changelog author="oliver@getspam.de" date="1529496000">- Update to version 36
- adjust libefiboot-export-disk_get_partition_info.patch to fit
  new version</changelog>
  <changelog author="glin@suse.com" date="1531742400">- Downgrade to 35 (fate#326702)
  + 36 rewrote the linux interface parsers and caused several
    problems in efibootmgr. Downgrade the version before the change
    to avoid the failure of boot variable creation
    (boo#1100077, boo#1101023)
- Refresh libefiboot-export-disk_get_partition_info.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1532433600">- Add reproducible.patch to initialize memory (boo#1061219)</changelog>
  <changelog author="glin@suse.com" date="1550836800">- Update to 37
  + Improve ACPI device path formatting
  + Add support for SOC devices that use FDT as their PCI root node
  + Make devices we can't parse the "device" sysfs link for use
    DEV_ABBREV_ONLY
  + Handle SCSI port numbers better
  + Don't require an EUI for NVMe (boo#1100077)
  + Fix the accidental requirement on ACPI UID nodes existing
  + Add support for EMMC devices
  + Add support for PCI root nodes without a device link in sysfs
  + Add support for partitioned MD devices
  + Fix partition number detection when the number isn't provided
  + Add support for ACPI Generic Container and Embedded Controller
    root nodes (boo#1101023)
  + Add limited support for SAS/SATA port expanders
- Add upstream patches to fix boo#1120862
  + efivar-make-format_guid-handle-misaligned-guid-pointer.patch
  + efivar-Fix-all-the-places-Werror-address-of-packed-member-c.patch
- Drop upstreamed reproducible.patch
- Refresh libefiboot-export-disk_get_partition_info.patch
- Use %license for COPYING</changelog>
  <changelog author="glin@suse.com" date="1552046400">- Add efivar-bsc1127544-fix-ucs2len.patch to fix logic that checks
  for UCS-2 string termination (boo#1127544)
- Add efivar-fix-efidp_ipv4_addr-fields-assignment.patch to fix the
  casting of IPv4 address.</changelog>
  <changelog author="glin@suse.com" date="1599566400">- Add efivar-bsc1175989-handle-NULL-set-variable.patch to fix
  segfault on non-EFI systems (bsc#1175989)
- Delete unused file: reproducible.patch</changelog>
  <changelog author="glin@suse.com" date="1614686400">- Add efivar-bsc1181967-fix-nvme-parsing.patch to fix the NVME
  path parsing (bsc#1181967)</changelog>
  <changelog author="glin@suse.com" date="1623844800">- Add efivar-bsc1187386-fix-emmc-parsing.patch to fix the eMMC
  sysfs parsing (bsc#1187386)</changelog>
</package>
<package pkgid="e667846b3046750fc61867c2e8dd0e54dab75cb9e240fca310411610209ef0eb" name="efivar" arch="s390x">
  <version epoch="0" ver="37" rel="6.12.1"/>
  <changelog author="rguenther@suse.com" date="1455105600">- Add efivar-0.21-gcc6.diff to fix strict-aliasing issue.
- Build with -Wno-nonnull as efivar tests nonnull args for zero
  and that breaks with its use of -Werror.</changelog>
  <changelog author="glin@suse.com" date="1457524800">- Update to 0.23 for fwupdate (FATE#319345)
- Add efivar-nvme-rename.patch and efivar-nvme-no-kernel-header.patch
  to work around the missing kernel header.
- Add efivar-no-static.patch to remove efivar-static since it
  causes build failure and we don't really need it.
- Remove efivar-fix-initializer.patch since it's already in 0.23.
- Remove _smp_mflags since the Makefile doesn't work well with
  the flag.</changelog>
  <changelog author="glin@suse.com" date="1460462400">- Add the missing COPYING</changelog>
  <changelog author="glin@suse.com" date="1460548800">- Add efivar-relicensing.patch to update the license in some files</changelog>
  <changelog author="glin@suse.com" date="1468238400">- Add efivar-bsc988000-fix-mode-efi_set_variable.patch and
  efivar-bsc988000-remove-versioning-efi_set_variable.patch to set
  the default file mode rather than fetching a value randomly
  (bsc#988000)</changelog>
  <changelog author="schwab@suse.de" date="1468324800">- deprecated-readdir_r.patch: Remove use of deprecated readdir_r</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Update to 0.24
- Drop upstreamed patches
  + efivar-0.21-gcc6.diff
  + efivar-nvme-rename.patch
  + efivar-nvme-no-kernel-header.patch
  + efivar-relicensing.patch
  + efivar-bsc988000-fix-mode-efi_set_variable.patch</changelog>
  <changelog author="rw@suse.com" date="1486382400">- Fix building for SLE11SP4, SLE12SP2, and Tumbleweed
  (fate#322108, bnc#1012765)
- Drop obsolete patch
  efivar-bsc988000-remove-versioning-efi_set_variable.patch</changelog>
  <changelog author="glin@suse.com" date="1486641600">- Add efivar-use-sysmacros.patch to fix the Factory/Tumbleweed
  build correctly.
- Amend the spec file to specify the gcc version for SLE11SP4</changelog>
  <changelog author="rw@suse.com" date="1486728000">- Update to 31  (fate#322108)
- Drop upstreamed patches
  + efivar-no-static.patch
  + deprecated-readdir_r.patch
  + efivar-use-sysmacros.patch</changelog>
  <changelog author="rw@suse.com" date="1488542400">- libefiboot-export-disk_get_partition_info.patch:
  (bsc#870211, bsc#945705)</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- RPM group fix</changelog>
  <changelog author="oliver@getspam.de" date="1529496000">- Update to version 36
- adjust libefiboot-export-disk_get_partition_info.patch to fit
  new version</changelog>
  <changelog author="glin@suse.com" date="1531742400">- Downgrade to 35 (fate#326702)
  + 36 rewrote the linux interface parsers and caused several
    problems in efibootmgr. Downgrade the version before the change
    to avoid the failure of boot variable creation
    (boo#1100077, boo#1101023)
- Refresh libefiboot-export-disk_get_partition_info.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1532433600">- Add reproducible.patch to initialize memory (boo#1061219)</changelog>
  <changelog author="glin@suse.com" date="1550836800">- Update to 37
  + Improve ACPI device path formatting
  + Add support for SOC devices that use FDT as their PCI root node
  + Make devices we can't parse the "device" sysfs link for use
    DEV_ABBREV_ONLY
  + Handle SCSI port numbers better
  + Don't require an EUI for NVMe (boo#1100077)
  + Fix the accidental requirement on ACPI UID nodes existing
  + Add support for EMMC devices
  + Add support for PCI root nodes without a device link in sysfs
  + Add support for partitioned MD devices
  + Fix partition number detection when the number isn't provided
  + Add support for ACPI Generic Container and Embedded Controller
    root nodes (boo#1101023)
  + Add limited support for SAS/SATA port expanders
- Add upstream patches to fix boo#1120862
  + efivar-make-format_guid-handle-misaligned-guid-pointer.patch
  + efivar-Fix-all-the-places-Werror-address-of-packed-member-c.patch
- Drop upstreamed reproducible.patch
- Refresh libefiboot-export-disk_get_partition_info.patch
- Use %license for COPYING</changelog>
  <changelog author="glin@suse.com" date="1552046400">- Add efivar-bsc1127544-fix-ucs2len.patch to fix logic that checks
  for UCS-2 string termination (boo#1127544)
- Add efivar-fix-efidp_ipv4_addr-fields-assignment.patch to fix the
  casting of IPv4 address.</changelog>
  <changelog author="glin@suse.com" date="1599566400">- Add efivar-bsc1175989-handle-NULL-set-variable.patch to fix
  segfault on non-EFI systems (bsc#1175989)
- Delete unused file: reproducible.patch</changelog>
  <changelog author="glin@suse.com" date="1614686400">- Add efivar-bsc1181967-fix-nvme-parsing.patch to fix the NVME
  path parsing (bsc#1181967)</changelog>
  <changelog author="glin@suse.com" date="1623844800">- Add efivar-bsc1187386-fix-emmc-parsing.patch to fix the eMMC
  sysfs parsing (bsc#1187386)</changelog>
</package>
<package pkgid="cf01d46bd5cb1f3cc73897885ae0797147449d247b5d74d71d89ad6178ccfa16" name="efivar" arch="src">
  <version epoch="0" ver="37" rel="6.12.1"/>
  <changelog author="rguenther@suse.com" date="1455105600">- Add efivar-0.21-gcc6.diff to fix strict-aliasing issue.
- Build with -Wno-nonnull as efivar tests nonnull args for zero
  and that breaks with its use of -Werror.</changelog>
  <changelog author="glin@suse.com" date="1457524800">- Update to 0.23 for fwupdate (FATE#319345)
- Add efivar-nvme-rename.patch and efivar-nvme-no-kernel-header.patch
  to work around the missing kernel header.
- Add efivar-no-static.patch to remove efivar-static since it
  causes build failure and we don't really need it.
- Remove efivar-fix-initializer.patch since it's already in 0.23.
- Remove _smp_mflags since the Makefile doesn't work well with
  the flag.</changelog>
  <changelog author="glin@suse.com" date="1460462400">- Add the missing COPYING</changelog>
  <changelog author="glin@suse.com" date="1460548800">- Add efivar-relicensing.patch to update the license in some files</changelog>
  <changelog author="glin@suse.com" date="1468238400">- Add efivar-bsc988000-fix-mode-efi_set_variable.patch and
  efivar-bsc988000-remove-versioning-efi_set_variable.patch to set
  the default file mode rather than fetching a value randomly
  (bsc#988000)</changelog>
  <changelog author="schwab@suse.de" date="1468324800">- deprecated-readdir_r.patch: Remove use of deprecated readdir_r</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Update to 0.24
- Drop upstreamed patches
  + efivar-0.21-gcc6.diff
  + efivar-nvme-rename.patch
  + efivar-nvme-no-kernel-header.patch
  + efivar-relicensing.patch
  + efivar-bsc988000-fix-mode-efi_set_variable.patch</changelog>
  <changelog author="rw@suse.com" date="1486382400">- Fix building for SLE11SP4, SLE12SP2, and Tumbleweed
  (fate#322108, bnc#1012765)
- Drop obsolete patch
  efivar-bsc988000-remove-versioning-efi_set_variable.patch</changelog>
  <changelog author="glin@suse.com" date="1486641600">- Add efivar-use-sysmacros.patch to fix the Factory/Tumbleweed
  build correctly.
- Amend the spec file to specify the gcc version for SLE11SP4</changelog>
  <changelog author="rw@suse.com" date="1486728000">- Update to 31  (fate#322108)
- Drop upstreamed patches
  + efivar-no-static.patch
  + deprecated-readdir_r.patch
  + efivar-use-sysmacros.patch</changelog>
  <changelog author="rw@suse.com" date="1488542400">- libefiboot-export-disk_get_partition_info.patch:
  (bsc#870211, bsc#945705)</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- RPM group fix</changelog>
  <changelog author="oliver@getspam.de" date="1529496000">- Update to version 36
- adjust libefiboot-export-disk_get_partition_info.patch to fit
  new version</changelog>
  <changelog author="glin@suse.com" date="1531742400">- Downgrade to 35 (fate#326702)
  + 36 rewrote the linux interface parsers and caused several
    problems in efibootmgr. Downgrade the version before the change
    to avoid the failure of boot variable creation
    (boo#1100077, boo#1101023)
- Refresh libefiboot-export-disk_get_partition_info.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1532433600">- Add reproducible.patch to initialize memory (boo#1061219)</changelog>
  <changelog author="glin@suse.com" date="1550836800">- Update to 37
  + Improve ACPI device path formatting
  + Add support for SOC devices that use FDT as their PCI root node
  + Make devices we can't parse the "device" sysfs link for use
    DEV_ABBREV_ONLY
  + Handle SCSI port numbers better
  + Don't require an EUI for NVMe (boo#1100077)
  + Fix the accidental requirement on ACPI UID nodes existing
  + Add support for EMMC devices
  + Add support for PCI root nodes without a device link in sysfs
  + Add support for partitioned MD devices
  + Fix partition number detection when the number isn't provided
  + Add support for ACPI Generic Container and Embedded Controller
    root nodes (boo#1101023)
  + Add limited support for SAS/SATA port expanders
- Add upstream patches to fix boo#1120862
  + efivar-make-format_guid-handle-misaligned-guid-pointer.patch
  + efivar-Fix-all-the-places-Werror-address-of-packed-member-c.patch
- Drop upstreamed reproducible.patch
- Refresh libefiboot-export-disk_get_partition_info.patch
- Use %license for COPYING</changelog>
  <changelog author="glin@suse.com" date="1552046400">- Add efivar-bsc1127544-fix-ucs2len.patch to fix logic that checks
  for UCS-2 string termination (boo#1127544)
- Add efivar-fix-efidp_ipv4_addr-fields-assignment.patch to fix the
  casting of IPv4 address.</changelog>
  <changelog author="glin@suse.com" date="1599566400">- Add efivar-bsc1175989-handle-NULL-set-variable.patch to fix
  segfault on non-EFI systems (bsc#1175989)
- Delete unused file: reproducible.patch</changelog>
  <changelog author="glin@suse.com" date="1614686400">- Add efivar-bsc1181967-fix-nvme-parsing.patch to fix the NVME
  path parsing (bsc#1181967)</changelog>
  <changelog author="glin@suse.com" date="1623844800">- Add efivar-bsc1187386-fix-emmc-parsing.patch to fix the eMMC
  sysfs parsing (bsc#1187386)</changelog>
</package>
<package pkgid="e4282e20168b857f105a463bca34a631e98456e7b467d7c80e70c39e844d18e2" name="efivar" arch="x86_64">
  <version epoch="0" ver="37" rel="6.12.1"/>
  <changelog author="rguenther@suse.com" date="1455105600">- Add efivar-0.21-gcc6.diff to fix strict-aliasing issue.
- Build with -Wno-nonnull as efivar tests nonnull args for zero
  and that breaks with its use of -Werror.</changelog>
  <changelog author="glin@suse.com" date="1457524800">- Update to 0.23 for fwupdate (FATE#319345)
- Add efivar-nvme-rename.patch and efivar-nvme-no-kernel-header.patch
  to work around the missing kernel header.
- Add efivar-no-static.patch to remove efivar-static since it
  causes build failure and we don't really need it.
- Remove efivar-fix-initializer.patch since it's already in 0.23.
- Remove _smp_mflags since the Makefile doesn't work well with
  the flag.</changelog>
  <changelog author="glin@suse.com" date="1460462400">- Add the missing COPYING</changelog>
  <changelog author="glin@suse.com" date="1460548800">- Add efivar-relicensing.patch to update the license in some files</changelog>
  <changelog author="glin@suse.com" date="1468238400">- Add efivar-bsc988000-fix-mode-efi_set_variable.patch and
  efivar-bsc988000-remove-versioning-efi_set_variable.patch to set
  the default file mode rather than fetching a value randomly
  (bsc#988000)</changelog>
  <changelog author="schwab@suse.de" date="1468324800">- deprecated-readdir_r.patch: Remove use of deprecated readdir_r</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Update to 0.24
- Drop upstreamed patches
  + efivar-0.21-gcc6.diff
  + efivar-nvme-rename.patch
  + efivar-nvme-no-kernel-header.patch
  + efivar-relicensing.patch
  + efivar-bsc988000-fix-mode-efi_set_variable.patch</changelog>
  <changelog author="rw@suse.com" date="1486382400">- Fix building for SLE11SP4, SLE12SP2, and Tumbleweed
  (fate#322108, bnc#1012765)
- Drop obsolete patch
  efivar-bsc988000-remove-versioning-efi_set_variable.patch</changelog>
  <changelog author="glin@suse.com" date="1486641600">- Add efivar-use-sysmacros.patch to fix the Factory/Tumbleweed
  build correctly.
- Amend the spec file to specify the gcc version for SLE11SP4</changelog>
  <changelog author="rw@suse.com" date="1486728000">- Update to 31  (fate#322108)
- Drop upstreamed patches
  + efivar-no-static.patch
  + deprecated-readdir_r.patch
  + efivar-use-sysmacros.patch</changelog>
  <changelog author="rw@suse.com" date="1488542400">- libefiboot-export-disk_get_partition_info.patch:
  (bsc#870211, bsc#945705)</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- RPM group fix</changelog>
  <changelog author="oliver@getspam.de" date="1529496000">- Update to version 36
- adjust libefiboot-export-disk_get_partition_info.patch to fit
  new version</changelog>
  <changelog author="glin@suse.com" date="1531742400">- Downgrade to 35 (fate#326702)
  + 36 rewrote the linux interface parsers and caused several
    problems in efibootmgr. Downgrade the version before the change
    to avoid the failure of boot variable creation
    (boo#1100077, boo#1101023)
- Refresh libefiboot-export-disk_get_partition_info.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1532433600">- Add reproducible.patch to initialize memory (boo#1061219)</changelog>
  <changelog author="glin@suse.com" date="1550836800">- Update to 37
  + Improve ACPI device path formatting
  + Add support for SOC devices that use FDT as their PCI root node
  + Make devices we can't parse the "device" sysfs link for use
    DEV_ABBREV_ONLY
  + Handle SCSI port numbers better
  + Don't require an EUI for NVMe (boo#1100077)
  + Fix the accidental requirement on ACPI UID nodes existing
  + Add support for EMMC devices
  + Add support for PCI root nodes without a device link in sysfs
  + Add support for partitioned MD devices
  + Fix partition number detection when the number isn't provided
  + Add support for ACPI Generic Container and Embedded Controller
    root nodes (boo#1101023)
  + Add limited support for SAS/SATA port expanders
- Add upstream patches to fix boo#1120862
  + efivar-make-format_guid-handle-misaligned-guid-pointer.patch
  + efivar-Fix-all-the-places-Werror-address-of-packed-member-c.patch
- Drop upstreamed reproducible.patch
- Refresh libefiboot-export-disk_get_partition_info.patch
- Use %license for COPYING</changelog>
  <changelog author="glin@suse.com" date="1552046400">- Add efivar-bsc1127544-fix-ucs2len.patch to fix logic that checks
  for UCS-2 string termination (boo#1127544)
- Add efivar-fix-efidp_ipv4_addr-fields-assignment.patch to fix the
  casting of IPv4 address.</changelog>
  <changelog author="glin@suse.com" date="1599566400">- Add efivar-bsc1175989-handle-NULL-set-variable.patch to fix
  segfault on non-EFI systems (bsc#1175989)
- Delete unused file: reproducible.patch</changelog>
  <changelog author="glin@suse.com" date="1614686400">- Add efivar-bsc1181967-fix-nvme-parsing.patch to fix the NVME
  path parsing (bsc#1181967)</changelog>
  <changelog author="glin@suse.com" date="1623844800">- Add efivar-bsc1187386-fix-emmc-parsing.patch to fix the eMMC
  sysfs parsing (bsc#1187386)</changelog>
</package>
<package pkgid="1e7f1cb90a6b06317f7c2fb136ac9f097bdb430deb0d3e5b92d29abc00e09d4d" name="efivar-devel" arch="aarch64">
  <version epoch="0" ver="37" rel="6.12.1"/>
  <changelog author="rguenther@suse.com" date="1455105600">- Add efivar-0.21-gcc6.diff to fix strict-aliasing issue.
- Build with -Wno-nonnull as efivar tests nonnull args for zero
  and that breaks with its use of -Werror.</changelog>
  <changelog author="glin@suse.com" date="1457524800">- Update to 0.23 for fwupdate (FATE#319345)
- Add efivar-nvme-rename.patch and efivar-nvme-no-kernel-header.patch
  to work around the missing kernel header.
- Add efivar-no-static.patch to remove efivar-static since it
  causes build failure and we don't really need it.
- Remove efivar-fix-initializer.patch since it's already in 0.23.
- Remove _smp_mflags since the Makefile doesn't work well with
  the flag.</changelog>
  <changelog author="glin@suse.com" date="1460462400">- Add the missing COPYING</changelog>
  <changelog author="glin@suse.com" date="1460548800">- Add efivar-relicensing.patch to update the license in some files</changelog>
  <changelog author="glin@suse.com" date="1468238400">- Add efivar-bsc988000-fix-mode-efi_set_variable.patch and
  efivar-bsc988000-remove-versioning-efi_set_variable.patch to set
  the default file mode rather than fetching a value randomly
  (bsc#988000)</changelog>
  <changelog author="schwab@suse.de" date="1468324800">- deprecated-readdir_r.patch: Remove use of deprecated readdir_r</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Update to 0.24
- Drop upstreamed patches
  + efivar-0.21-gcc6.diff
  + efivar-nvme-rename.patch
  + efivar-nvme-no-kernel-header.patch
  + efivar-relicensing.patch
  + efivar-bsc988000-fix-mode-efi_set_variable.patch</changelog>
  <changelog author="rw@suse.com" date="1486382400">- Fix building for SLE11SP4, SLE12SP2, and Tumbleweed
  (fate#322108, bnc#1012765)
- Drop obsolete patch
  efivar-bsc988000-remove-versioning-efi_set_variable.patch</changelog>
  <changelog author="glin@suse.com" date="1486641600">- Add efivar-use-sysmacros.patch to fix the Factory/Tumbleweed
  build correctly.
- Amend the spec file to specify the gcc version for SLE11SP4</changelog>
  <changelog author="rw@suse.com" date="1486728000">- Update to 31  (fate#322108)
- Drop upstreamed patches
  + efivar-no-static.patch
  + deprecated-readdir_r.patch
  + efivar-use-sysmacros.patch</changelog>
  <changelog author="rw@suse.com" date="1488542400">- libefiboot-export-disk_get_partition_info.patch:
  (bsc#870211, bsc#945705)</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- RPM group fix</changelog>
  <changelog author="oliver@getspam.de" date="1529496000">- Update to version 36
- adjust libefiboot-export-disk_get_partition_info.patch to fit
  new version</changelog>
  <changelog author="glin@suse.com" date="1531742400">- Downgrade to 35 (fate#326702)
  + 36 rewrote the linux interface parsers and caused several
    problems in efibootmgr. Downgrade the version before the change
    to avoid the failure of boot variable creation
    (boo#1100077, boo#1101023)
- Refresh libefiboot-export-disk_get_partition_info.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1532433600">- Add reproducible.patch to initialize memory (boo#1061219)</changelog>
  <changelog author="glin@suse.com" date="1550836800">- Update to 37
  + Improve ACPI device path formatting
  + Add support for SOC devices that use FDT as their PCI root node
  + Make devices we can't parse the "device" sysfs link for use
    DEV_ABBREV_ONLY
  + Handle SCSI port numbers better
  + Don't require an EUI for NVMe (boo#1100077)
  + Fix the accidental requirement on ACPI UID nodes existing
  + Add support for EMMC devices
  + Add support for PCI root nodes without a device link in sysfs
  + Add support for partitioned MD devices
  + Fix partition number detection when the number isn't provided
  + Add support for ACPI Generic Container and Embedded Controller
    root nodes (boo#1101023)
  + Add limited support for SAS/SATA port expanders
- Add upstream patches to fix boo#1120862
  + efivar-make-format_guid-handle-misaligned-guid-pointer.patch
  + efivar-Fix-all-the-places-Werror-address-of-packed-member-c.patch
- Drop upstreamed reproducible.patch
- Refresh libefiboot-export-disk_get_partition_info.patch
- Use %license for COPYING</changelog>
  <changelog author="glin@suse.com" date="1552046400">- Add efivar-bsc1127544-fix-ucs2len.patch to fix logic that checks
  for UCS-2 string termination (boo#1127544)
- Add efivar-fix-efidp_ipv4_addr-fields-assignment.patch to fix the
  casting of IPv4 address.</changelog>
  <changelog author="glin@suse.com" date="1599566400">- Add efivar-bsc1175989-handle-NULL-set-variable.patch to fix
  segfault on non-EFI systems (bsc#1175989)
- Delete unused file: reproducible.patch</changelog>
  <changelog author="glin@suse.com" date="1614686400">- Add efivar-bsc1181967-fix-nvme-parsing.patch to fix the NVME
  path parsing (bsc#1181967)</changelog>
  <changelog author="glin@suse.com" date="1623844800">- Add efivar-bsc1187386-fix-emmc-parsing.patch to fix the eMMC
  sysfs parsing (bsc#1187386)</changelog>
</package>
<package pkgid="975448816fe1c4a71d8849c76c2fb0189729ed52dacc6cd92826bc1aabdc1e67" name="efivar-devel" arch="ppc64le">
  <version epoch="0" ver="37" rel="6.12.1"/>
  <changelog author="rguenther@suse.com" date="1455105600">- Add efivar-0.21-gcc6.diff to fix strict-aliasing issue.
- Build with -Wno-nonnull as efivar tests nonnull args for zero
  and that breaks with its use of -Werror.</changelog>
  <changelog author="glin@suse.com" date="1457524800">- Update to 0.23 for fwupdate (FATE#319345)
- Add efivar-nvme-rename.patch and efivar-nvme-no-kernel-header.patch
  to work around the missing kernel header.
- Add efivar-no-static.patch to remove efivar-static since it
  causes build failure and we don't really need it.
- Remove efivar-fix-initializer.patch since it's already in 0.23.
- Remove _smp_mflags since the Makefile doesn't work well with
  the flag.</changelog>
  <changelog author="glin@suse.com" date="1460462400">- Add the missing COPYING</changelog>
  <changelog author="glin@suse.com" date="1460548800">- Add efivar-relicensing.patch to update the license in some files</changelog>
  <changelog author="glin@suse.com" date="1468238400">- Add efivar-bsc988000-fix-mode-efi_set_variable.patch and
  efivar-bsc988000-remove-versioning-efi_set_variable.patch to set
  the default file mode rather than fetching a value randomly
  (bsc#988000)</changelog>
  <changelog author="schwab@suse.de" date="1468324800">- deprecated-readdir_r.patch: Remove use of deprecated readdir_r</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Update to 0.24
- Drop upstreamed patches
  + efivar-0.21-gcc6.diff
  + efivar-nvme-rename.patch
  + efivar-nvme-no-kernel-header.patch
  + efivar-relicensing.patch
  + efivar-bsc988000-fix-mode-efi_set_variable.patch</changelog>
  <changelog author="rw@suse.com" date="1486382400">- Fix building for SLE11SP4, SLE12SP2, and Tumbleweed
  (fate#322108, bnc#1012765)
- Drop obsolete patch
  efivar-bsc988000-remove-versioning-efi_set_variable.patch</changelog>
  <changelog author="glin@suse.com" date="1486641600">- Add efivar-use-sysmacros.patch to fix the Factory/Tumbleweed
  build correctly.
- Amend the spec file to specify the gcc version for SLE11SP4</changelog>
  <changelog author="rw@suse.com" date="1486728000">- Update to 31  (fate#322108)
- Drop upstreamed patches
  + efivar-no-static.patch
  + deprecated-readdir_r.patch
  + efivar-use-sysmacros.patch</changelog>
  <changelog author="rw@suse.com" date="1488542400">- libefiboot-export-disk_get_partition_info.patch:
  (bsc#870211, bsc#945705)</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- RPM group fix</changelog>
  <changelog author="oliver@getspam.de" date="1529496000">- Update to version 36
- adjust libefiboot-export-disk_get_partition_info.patch to fit
  new version</changelog>
  <changelog author="glin@suse.com" date="1531742400">- Downgrade to 35 (fate#326702)
  + 36 rewrote the linux interface parsers and caused several
    problems in efibootmgr. Downgrade the version before the change
    to avoid the failure of boot variable creation
    (boo#1100077, boo#1101023)
- Refresh libefiboot-export-disk_get_partition_info.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1532433600">- Add reproducible.patch to initialize memory (boo#1061219)</changelog>
  <changelog author="glin@suse.com" date="1550836800">- Update to 37
  + Improve ACPI device path formatting
  + Add support for SOC devices that use FDT as their PCI root node
  + Make devices we can't parse the "device" sysfs link for use
    DEV_ABBREV_ONLY
  + Handle SCSI port numbers better
  + Don't require an EUI for NVMe (boo#1100077)
  + Fix the accidental requirement on ACPI UID nodes existing
  + Add support for EMMC devices
  + Add support for PCI root nodes without a device link in sysfs
  + Add support for partitioned MD devices
  + Fix partition number detection when the number isn't provided
  + Add support for ACPI Generic Container and Embedded Controller
    root nodes (boo#1101023)
  + Add limited support for SAS/SATA port expanders
- Add upstream patches to fix boo#1120862
  + efivar-make-format_guid-handle-misaligned-guid-pointer.patch
  + efivar-Fix-all-the-places-Werror-address-of-packed-member-c.patch
- Drop upstreamed reproducible.patch
- Refresh libefiboot-export-disk_get_partition_info.patch
- Use %license for COPYING</changelog>
  <changelog author="glin@suse.com" date="1552046400">- Add efivar-bsc1127544-fix-ucs2len.patch to fix logic that checks
  for UCS-2 string termination (boo#1127544)
- Add efivar-fix-efidp_ipv4_addr-fields-assignment.patch to fix the
  casting of IPv4 address.</changelog>
  <changelog author="glin@suse.com" date="1599566400">- Add efivar-bsc1175989-handle-NULL-set-variable.patch to fix
  segfault on non-EFI systems (bsc#1175989)
- Delete unused file: reproducible.patch</changelog>
  <changelog author="glin@suse.com" date="1614686400">- Add efivar-bsc1181967-fix-nvme-parsing.patch to fix the NVME
  path parsing (bsc#1181967)</changelog>
  <changelog author="glin@suse.com" date="1623844800">- Add efivar-bsc1187386-fix-emmc-parsing.patch to fix the eMMC
  sysfs parsing (bsc#1187386)</changelog>
</package>
<package pkgid="7350ebd6f1f194dc31b55e5a0ba8bb5845c6454d8e67fda487db8c43b054edc7" name="efivar-devel" arch="s390x">
  <version epoch="0" ver="37" rel="6.12.1"/>
  <changelog author="rguenther@suse.com" date="1455105600">- Add efivar-0.21-gcc6.diff to fix strict-aliasing issue.
- Build with -Wno-nonnull as efivar tests nonnull args for zero
  and that breaks with its use of -Werror.</changelog>
  <changelog author="glin@suse.com" date="1457524800">- Update to 0.23 for fwupdate (FATE#319345)
- Add efivar-nvme-rename.patch and efivar-nvme-no-kernel-header.patch
  to work around the missing kernel header.
- Add efivar-no-static.patch to remove efivar-static since it
  causes build failure and we don't really need it.
- Remove efivar-fix-initializer.patch since it's already in 0.23.
- Remove _smp_mflags since the Makefile doesn't work well with
  the flag.</changelog>
  <changelog author="glin@suse.com" date="1460462400">- Add the missing COPYING</changelog>
  <changelog author="glin@suse.com" date="1460548800">- Add efivar-relicensing.patch to update the license in some files</changelog>
  <changelog author="glin@suse.com" date="1468238400">- Add efivar-bsc988000-fix-mode-efi_set_variable.patch and
  efivar-bsc988000-remove-versioning-efi_set_variable.patch to set
  the default file mode rather than fetching a value randomly
  (bsc#988000)</changelog>
  <changelog author="schwab@suse.de" date="1468324800">- deprecated-readdir_r.patch: Remove use of deprecated readdir_r</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Update to 0.24
- Drop upstreamed patches
  + efivar-0.21-gcc6.diff
  + efivar-nvme-rename.patch
  + efivar-nvme-no-kernel-header.patch
  + efivar-relicensing.patch
  + efivar-bsc988000-fix-mode-efi_set_variable.patch</changelog>
  <changelog author="rw@suse.com" date="1486382400">- Fix building for SLE11SP4, SLE12SP2, and Tumbleweed
  (fate#322108, bnc#1012765)
- Drop obsolete patch
  efivar-bsc988000-remove-versioning-efi_set_variable.patch</changelog>
  <changelog author="glin@suse.com" date="1486641600">- Add efivar-use-sysmacros.patch to fix the Factory/Tumbleweed
  build correctly.
- Amend the spec file to specify the gcc version for SLE11SP4</changelog>
  <changelog author="rw@suse.com" date="1486728000">- Update to 31  (fate#322108)
- Drop upstreamed patches
  + efivar-no-static.patch
  + deprecated-readdir_r.patch
  + efivar-use-sysmacros.patch</changelog>
  <changelog author="rw@suse.com" date="1488542400">- libefiboot-export-disk_get_partition_info.patch:
  (bsc#870211, bsc#945705)</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- RPM group fix</changelog>
  <changelog author="oliver@getspam.de" date="1529496000">- Update to version 36
- adjust libefiboot-export-disk_get_partition_info.patch to fit
  new version</changelog>
  <changelog author="glin@suse.com" date="1531742400">- Downgrade to 35 (fate#326702)
  + 36 rewrote the linux interface parsers and caused several
    problems in efibootmgr. Downgrade the version before the change
    to avoid the failure of boot variable creation
    (boo#1100077, boo#1101023)
- Refresh libefiboot-export-disk_get_partition_info.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1532433600">- Add reproducible.patch to initialize memory (boo#1061219)</changelog>
  <changelog author="glin@suse.com" date="1550836800">- Update to 37
  + Improve ACPI device path formatting
  + Add support for SOC devices that use FDT as their PCI root node
  + Make devices we can't parse the "device" sysfs link for use
    DEV_ABBREV_ONLY
  + Handle SCSI port numbers better
  + Don't require an EUI for NVMe (boo#1100077)
  + Fix the accidental requirement on ACPI UID nodes existing
  + Add support for EMMC devices
  + Add support for PCI root nodes without a device link in sysfs
  + Add support for partitioned MD devices
  + Fix partition number detection when the number isn't provided
  + Add support for ACPI Generic Container and Embedded Controller
    root nodes (boo#1101023)
  + Add limited support for SAS/SATA port expanders
- Add upstream patches to fix boo#1120862
  + efivar-make-format_guid-handle-misaligned-guid-pointer.patch
  + efivar-Fix-all-the-places-Werror-address-of-packed-member-c.patch
- Drop upstreamed reproducible.patch
- Refresh libefiboot-export-disk_get_partition_info.patch
- Use %license for COPYING</changelog>
  <changelog author="glin@suse.com" date="1552046400">- Add efivar-bsc1127544-fix-ucs2len.patch to fix logic that checks
  for UCS-2 string termination (boo#1127544)
- Add efivar-fix-efidp_ipv4_addr-fields-assignment.patch to fix the
  casting of IPv4 address.</changelog>
  <changelog author="glin@suse.com" date="1599566400">- Add efivar-bsc1175989-handle-NULL-set-variable.patch to fix
  segfault on non-EFI systems (bsc#1175989)
- Delete unused file: reproducible.patch</changelog>
  <changelog author="glin@suse.com" date="1614686400">- Add efivar-bsc1181967-fix-nvme-parsing.patch to fix the NVME
  path parsing (bsc#1181967)</changelog>
  <changelog author="glin@suse.com" date="1623844800">- Add efivar-bsc1187386-fix-emmc-parsing.patch to fix the eMMC
  sysfs parsing (bsc#1187386)</changelog>
</package>
<package pkgid="1acc674936355c9d5a7dcb3ca76474b145dfac97e0520a29af82767f339014db" name="efivar-devel" arch="x86_64">
  <version epoch="0" ver="37" rel="6.12.1"/>
  <changelog author="rguenther@suse.com" date="1455105600">- Add efivar-0.21-gcc6.diff to fix strict-aliasing issue.
- Build with -Wno-nonnull as efivar tests nonnull args for zero
  and that breaks with its use of -Werror.</changelog>
  <changelog author="glin@suse.com" date="1457524800">- Update to 0.23 for fwupdate (FATE#319345)
- Add efivar-nvme-rename.patch and efivar-nvme-no-kernel-header.patch
  to work around the missing kernel header.
- Add efivar-no-static.patch to remove efivar-static since it
  causes build failure and we don't really need it.
- Remove efivar-fix-initializer.patch since it's already in 0.23.
- Remove _smp_mflags since the Makefile doesn't work well with
  the flag.</changelog>
  <changelog author="glin@suse.com" date="1460462400">- Add the missing COPYING</changelog>
  <changelog author="glin@suse.com" date="1460548800">- Add efivar-relicensing.patch to update the license in some files</changelog>
  <changelog author="glin@suse.com" date="1468238400">- Add efivar-bsc988000-fix-mode-efi_set_variable.patch and
  efivar-bsc988000-remove-versioning-efi_set_variable.patch to set
  the default file mode rather than fetching a value randomly
  (bsc#988000)</changelog>
  <changelog author="schwab@suse.de" date="1468324800">- deprecated-readdir_r.patch: Remove use of deprecated readdir_r</changelog>
  <changelog author="glin@suse.com" date="1468411200">- Update to 0.24
- Drop upstreamed patches
  + efivar-0.21-gcc6.diff
  + efivar-nvme-rename.patch
  + efivar-nvme-no-kernel-header.patch
  + efivar-relicensing.patch
  + efivar-bsc988000-fix-mode-efi_set_variable.patch</changelog>
  <changelog author="rw@suse.com" date="1486382400">- Fix building for SLE11SP4, SLE12SP2, and Tumbleweed
  (fate#322108, bnc#1012765)
- Drop obsolete patch
  efivar-bsc988000-remove-versioning-efi_set_variable.patch</changelog>
  <changelog author="glin@suse.com" date="1486641600">- Add efivar-use-sysmacros.patch to fix the Factory/Tumbleweed
  build correctly.
- Amend the spec file to specify the gcc version for SLE11SP4</changelog>
  <changelog author="rw@suse.com" date="1486728000">- Update to 31  (fate#322108)
- Drop upstreamed patches
  + efivar-no-static.patch
  + deprecated-readdir_r.patch
  + efivar-use-sysmacros.patch</changelog>
  <changelog author="rw@suse.com" date="1488542400">- libefiboot-export-disk_get_partition_info.patch:
  (bsc#870211, bsc#945705)</changelog>
  <changelog author="jengelh@inai.de" date="1490270400">- RPM group fix</changelog>
  <changelog author="oliver@getspam.de" date="1529496000">- Update to version 36
- adjust libefiboot-export-disk_get_partition_info.patch to fit
  new version</changelog>
  <changelog author="glin@suse.com" date="1531742400">- Downgrade to 35 (fate#326702)
  + 36 rewrote the linux interface parsers and caused several
    problems in efibootmgr. Downgrade the version before the change
    to avoid the failure of boot variable creation
    (boo#1100077, boo#1101023)
- Refresh libefiboot-export-disk_get_partition_info.patch</changelog>
  <changelog author="bwiedemann@suse.com" date="1532433600">- Add reproducible.patch to initialize memory (boo#1061219)</changelog>
  <changelog author="glin@suse.com" date="1550836800">- Update to 37
  + Improve ACPI device path formatting
  + Add support for SOC devices that use FDT as their PCI root node
  + Make devices we can't parse the "device" sysfs link for use
    DEV_ABBREV_ONLY
  + Handle SCSI port numbers better
  + Don't require an EUI for NVMe (boo#1100077)
  + Fix the accidental requirement on ACPI UID nodes existing
  + Add support for EMMC devices
  + Add support for PCI root nodes without a device link in sysfs
  + Add support for partitioned MD devices
  + Fix partition number detection when the number isn't provided
  + Add support for ACPI Generic Container and Embedded Controller
    root nodes (boo#1101023)
  + Add limited support for SAS/SATA port expanders
- Add upstream patches to fix boo#1120862
  + efivar-make-format_guid-handle-misaligned-guid-pointer.patch
  + efivar-Fix-all-the-places-Werror-address-of-packed-member-c.patch
- Drop upstreamed reproducible.patch
- Refresh libefiboot-export-disk_get_partition_info.patch
- Use %license for COPYING</changelog>
  <changelog author="glin@suse.com" date="1552046400">- Add efivar-bsc1127544-fix-ucs2len.patch to fix logic that checks
  for UCS-2 string termination (boo#1127544)
- Add efivar-fix-efidp_ipv4_addr-fields-assignment.patch to fix the
  casting of IPv4 address.</changelog>
  <changelog author="glin@suse.com" date="1599566400">- Add efivar-bsc1175989-handle-NULL-set-variable.patch to fix
  segfault on non-EFI systems (bsc#1175989)
- Delete unused file: reproducible.patch</changelog>
  <changelog author="glin@suse.com" date="1614686400">- Add efivar-bsc1181967-fix-nvme-parsing.patch to fix the NVME
  path parsing (bsc#1181967)</changelog>
  <changelog author="glin@suse.com" date="1623844800">- Add efivar-bsc1187386-fix-emmc-parsing.patch to fix the eMMC
  sysfs parsing (bsc#1187386)</changelog>
</package>
<package pkgid="58d5f2bc5e9f87e5b907473b68bd15aa0a4ba64831888409ea8f8ad7bfd485b5" name="emacs" arch="aarch64">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="7ce4285af4c09270dbbeaf0b79c9cf05b03c40b4d3ff7cf39a317233352f7f24" name="emacs" arch="ppc64le">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="37cf5089ccd661fb2a7700bb62862b08f1597abfbdc564545fc08e68f1ea3d02" name="emacs" arch="s390x">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="71a3e055a4e2f4782826e8f240de22ae80e33f25517bb3b6c7ca381ef10b3d11" name="emacs" arch="src">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="33c157924e0ba059119596c18c7c570e0c71ff8b89e18c517ed43be180a3ae32" name="emacs" arch="x86_64">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="3662204109775131d4cbace9086be29749a8ad558757ddb3c87bb08c070652ca" name="emacs-el" arch="noarch">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="d371fb149ef21872eb43f804cdde726128b268eccc36122a8c7db3349f1c93bb" name="emacs-info" arch="noarch">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="1757c9203a6b93db75c151afe5490027536b67ad3daf5166cd22a2736a751cb5" name="emacs-nox" arch="aarch64">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="5ba11ba170c92138e195c2edd3c3ee3b8c08ad6d5dbab596b927c1163f11c6e6" name="emacs-nox" arch="ppc64le">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="98e7eea35a1ded18743659142c0e2a5d654a268b489a331e02a3516412e7b168" name="emacs-nox" arch="s390x">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="f7f315019718687b238aa72555121ba525429447baeb680ed3c730bb10430eb6" name="emacs-nox" arch="x86_64">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="7ec1bfbc9ee29c2a6531889b2a60ae9005e1b2af75e315b8ddf74eecbbc40a31" name="emacs-x11" arch="aarch64">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="9c7bfc7f2f991c420e9ba960ed2d1eb16c8d1f2a9ebebca86a4664995ed1a492" name="emacs-x11" arch="ppc64le">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="ed5683bf17b40d8d80545ddde905bdddcbd44226d540bda285b5e386235d8e77" name="emacs-x11" arch="s390x">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="bf83c43efa82061decd6c352fb6faf4f14932230492f5b6ee45598c9708ce024" name="emacs-x11" arch="x86_64">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="4e3415a23924c6373eadb0d03cd060f94e83df10d29bbf16c5ef188e1c2a1141" name="erlang-rabbitmq-client" arch="aarch64">
  <version epoch="0" ver="3.8.11" rel="3.3.3"/>
  <changelog author="g.santomaggio@gmail.com" date="1566216000">- Update to RabbitMQ version 3.7.17
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.17
- RabbitMQ 3.7.17 is a maintenance release. It focuses on bug fixes and upgrades
  a JavaScript dependency in the management UI to patch three CVEs in that library.</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1568721600">- Update to RabbitMQ version 3.7.18
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.18
- RabbitMQ 3.7.18 is a maintenance release. It focuses on bug fixes and internal
  API changes that refine the common plugin API with the upcoming 3.8.0 version.</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1571054400">- Update to RabbitMQ version 3.7.19
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.19
- RabbitMQ 3.7.19 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@suse.com" date="1572350400">- Update to RabbitMQ version 3.7.20
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.20
- RabbitMQ 3.7.20 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@gmail.com" date="1572868800">- Update to RabbitMQ version 3.7.21
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.21
- RabbitMQ 3.7.21 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1574856000">- Update to RabbitMQ version 3.7.22
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.22
- RabbitMQ 3.7.22 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.
- Per the new Erlang version support policy in effect starting with January 2019,
  this release no longer supports Erlang/OTP 20.3.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1575633600">- Update to RabbitMQ version 3.7.23
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.23
- RabbitMQ 3.7.23 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.
- Per the new Erlang version support policy in effect starting with January 2019,
  this release no longer supports Erlang/OTP 20.3.</changelog>
  <changelog author="g.santomaggio@suse.com" date="1578916800">- Update to 3.8.2
- RabbitMQ 3.8.2 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.2
- RabbitMQ 3.8.2 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.x series is recommended.
- RabbitMQ 3.8.2 is an RabbitMQ 3.8.0 update
- RabbitMQ 3.8.0 is a feature release. It contains several major improvements
  in areas of data safety, replication, observability, and ease of upgrades.
  Some highlight features are:
  * Quorum Queues
  * Built-in Prometheus support with a set of Grafana dashboards to complement it
  * Feature Flags
  * Single Active Consumer
  * New authentication and authorisation backend that uses OAuth 2.0 (JWT)
    tokens and scopes
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.0
- Read the upgrading guide before update: https://www.rabbitmq.com/upgrade.html</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1582545600">- jsc#SLE-10913</changelog>
  <changelog author="gsantomaggio@suse.de" date="1584014400">- Update to 3.8.3
- RabbitMQ 3.8.3 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.3
- RabbitMQ 3.8.3 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.x series is recommended.
- RabbitMQ 3.8.3 is an RabbitMQ 3.8.0 update</changelog>
  <changelog author="dmueller@suse.com" date="1587729600">- use python 3.x for building, allows dropping python 2.x</changelog>
  <changelog author="gsantomaggio@suse.de" date="1594296000">- Update to 3.8.5
- RabbitMQ 3.8.5 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.5
- RabbitMQ 3.8.5 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 series is recommended.
- RabbitMQ 3.8.5 is an RabbitMQ 3.8.0 update
- Update to 3.8.4
- RabbitMQ 3.8.4 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.4
- RabbitMQ 3.8.4 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 series is recommended.
- This is the first release to officially support Erlang 23. Compared to 3.8.3, which
  generally works as expected on Erlang 23, Prometheus monitoring plugin had to
  be adapted to support a memory allocator metric format that has changed compared to
  earlier Erlang releases.
  There is one remaining known Erlang 23 incompatibility: rabbitmq-diagnostics observer will fail on Erlang 23.
  This will be addressed in a future release.
  The root cause is the same memory allocator metric change.
  Provisioning Latest Erlang Releases explains
  what package repositories and tools can be used to provision latest patch versions of Erlang 22.3.x
- RabbitMQ 3.8.4 is an RabbitMQ 3.8.0 update</changelog>
  <changelog author="gsantomaggio@suse.de" date="1597838400">- Update to 3.8.7
- RabbitMQ 3.8.7 is a maintenance release that patches a **security** vulnerability.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.7
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 releases are recommended.
- Update to 3.8.6
- RabbitMQ 3.8.6 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.6
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 releases are recommended.
- RabbitMQ Adopts the Mozilla Public License 2.0
  Starting with this release, core RabbitMQ server and all tier 1 plugins [1]
  are relicensed[2] under the Mozilla Public License 2.0[3]
  (previously used license: the Mozilla Public License 1.1).
  The permissiveness of the MPL 2.0 is largely the same as of the MPL 1.1.
  See the MPL 2.0 FAQ[4] and MPL 2.0 Revision and Changes FAQ[5] to learn more.
  1- https://www.rabbitmq.com/plugins.html#plugin-tiers
  2- https://github.com/rabbitmq/rabbitmq-server/issues/2372
  3- https://www.mozilla.org/en-US/MPL/2.0/
  4- https://www.mozilla.org/en-US/MPL/2.0/FAQ/
  5- https://www.mozilla.org/en-US/MPL/2.0/Revision-FAQ/</changelog>
  <changelog author="dheidler@suse.de" date="1601985600">- Add requirement for rabbitmq-server-plugins (boo#1174068)</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1603195200">- Update to RabbitMQ 3.8.9
- RabbitMQ 3.8.9 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.9
- This release no longer supports Erlang 21.3.
- This release is compatible with Erlang 23
- Update to RabbitMQ 3.8.8
- RabbitMQ 3.8.8 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.8
- This is the last RabbitMQ release to support Erlang 21.3.
- This release is compatible with Erlang 23</changelog>
  <changelog author="fbui@suse.com" date="1606132800">- %insserv_prereq is only requires when !have_systemd</changelog>
  <changelog author="psimons@suse.com" date="1612180800">- Update to RabbitMQ 3.8.11
  * Quorum queues that had active consumers during a rolling
    cluster upgrade could run into an exception and restart loop.
  * Nodes that had reverse_dns_lookup set to true could not accept
    client connections.
- Update to RabbitMQ 3.8.10
  * This release deprecates boot time definition import build into
    the management plugin.
  * Repeated polling of a quorum queue with basic.get that yielded
    an empty response could result in an unbounded growth of log
    segment files on on disk.
  * RabbitMQ core plugin activation was revisited to be closer to
    that of 3.7.x. This does not any related improvements w.r.t.
    definition import, e.g. those introudced in RabbitMQ 3.8.6.
  * Syslog dependency was not started correctly. This meant no log
    messages were sent to Syslog.
  * rabbitmq-diagnostics check_if_node_is_quorum_critical returned
    a false positive for a node marked for maintenance.
  * Queues could update their internal bookkeeping state
    incorrectly in some cases, leading to a file_handle_cache
    operation exception.
  * Quorum queues now can use the reject-publish max length
    overflow strategy.
  * Quorum queues now support consumer priority.
  * Per-user connection and queue limits. This is similar to
    per-vhost limits but, as the name suggests, these limits are
    associated for a given user.
  * TLSv1.3 is no longer considered experimental (on Erlang 23) and
    excluded from TLS listener configuration.
  * When a node is put under maintenance, it will now stop all
    local quorum queue replicas after completing leadership
    transfer. This means that no quorum queue replicas on the node
    will be considered for leader elections.
  * Nodes now keep track of failed client authentication attempts
    and expose it as a metric via both the Prometheus endpoint and
    the HTTP API at GET /api/auth/attempts/{node}.
  * bypass_pem_cache is a new configuration key that makes it
    possible to disable the cache of PEM files used by the Erlang
    TLS implementation. This rotated certificates quicker to detect
    for nodes but can also increase latency for inbound TLS
    connections, e.g. under high connection churn scenarios.
  * Definition import now safely handles some missing queue object
    arguments.
  * rabbitmq.conf schema now allows for peer certificate chain
    verification depth to be set to zero. When this value is used,
    peer certificate must be signed by a trusted CA certificate
    directly in order for the verification to pass.
  * RABBITMQ_IO_THREAD_POOL_SIZE will no longer be respected by
    RabbitMQ nodes. It is no longer relevant with supported Erlang
    versions and will simplify rabbitmq-diagnostics
    runtime_thread_stats output.
  * The +K runtime parameter is no longer used by RabbitMQ nodes as
    it has no effect with supported Erlang versions.</changelog>
  <changelog author="jengelh@inai.de" date="1612440000">- Remove recipe parts for SUSE 11.x, since that does not build.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629979200">- Fix CVE-2021-32718 improper neutralization of script-related HTML tags in a
  web page (basic XSS) in management UI (CVE-2021-32718, bsc#1187818)
  * fix-CVE-2021-32718.patch
- Fix CVE-2021-32719 improper neutralization of script-related HTML tags in a
  web page (basic XSS) in federation management plugin (CVE-2021-32719, bsc#1187819)
  * fix-CVE-2021-32719.patch
- Fix CVE-2021-22116 improper input validation may lead to DoS
  (CVE-2021-22116, bsc#1186203)
  * fix-CVE-2021-22116.patch
- Use /run instead of /var/run in tmpfiles.d configuration, fix bsc#1185075</changelog>
</package>
<package pkgid="952572b0de2af3db7fc412c939d0c46fb5939ffc6dfadfcc4bdf61a0b7a9b7c9" name="erlang-rabbitmq-client" arch="ppc64le">
  <version epoch="0" ver="3.8.11" rel="3.3.3"/>
  <changelog author="g.santomaggio@gmail.com" date="1566216000">- Update to RabbitMQ version 3.7.17
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.17
- RabbitMQ 3.7.17 is a maintenance release. It focuses on bug fixes and upgrades
  a JavaScript dependency in the management UI to patch three CVEs in that library.</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1568721600">- Update to RabbitMQ version 3.7.18
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.18
- RabbitMQ 3.7.18 is a maintenance release. It focuses on bug fixes and internal
  API changes that refine the common plugin API with the upcoming 3.8.0 version.</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1571054400">- Update to RabbitMQ version 3.7.19
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.19
- RabbitMQ 3.7.19 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@suse.com" date="1572350400">- Update to RabbitMQ version 3.7.20
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.20
- RabbitMQ 3.7.20 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@gmail.com" date="1572868800">- Update to RabbitMQ version 3.7.21
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.21
- RabbitMQ 3.7.21 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1574856000">- Update to RabbitMQ version 3.7.22
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.22
- RabbitMQ 3.7.22 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.
- Per the new Erlang version support policy in effect starting with January 2019,
  this release no longer supports Erlang/OTP 20.3.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1575633600">- Update to RabbitMQ version 3.7.23
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.23
- RabbitMQ 3.7.23 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.
- Per the new Erlang version support policy in effect starting with January 2019,
  this release no longer supports Erlang/OTP 20.3.</changelog>
  <changelog author="g.santomaggio@suse.com" date="1578916800">- Update to 3.8.2
- RabbitMQ 3.8.2 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.2
- RabbitMQ 3.8.2 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.x series is recommended.
- RabbitMQ 3.8.2 is an RabbitMQ 3.8.0 update
- RabbitMQ 3.8.0 is a feature release. It contains several major improvements
  in areas of data safety, replication, observability, and ease of upgrades.
  Some highlight features are:
  * Quorum Queues
  * Built-in Prometheus support with a set of Grafana dashboards to complement it
  * Feature Flags
  * Single Active Consumer
  * New authentication and authorisation backend that uses OAuth 2.0 (JWT)
    tokens and scopes
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.0
- Read the upgrading guide before update: https://www.rabbitmq.com/upgrade.html</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1582545600">- jsc#SLE-10913</changelog>
  <changelog author="gsantomaggio@suse.de" date="1584014400">- Update to 3.8.3
- RabbitMQ 3.8.3 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.3
- RabbitMQ 3.8.3 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.x series is recommended.
- RabbitMQ 3.8.3 is an RabbitMQ 3.8.0 update</changelog>
  <changelog author="dmueller@suse.com" date="1587729600">- use python 3.x for building, allows dropping python 2.x</changelog>
  <changelog author="gsantomaggio@suse.de" date="1594296000">- Update to 3.8.5
- RabbitMQ 3.8.5 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.5
- RabbitMQ 3.8.5 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 series is recommended.
- RabbitMQ 3.8.5 is an RabbitMQ 3.8.0 update
- Update to 3.8.4
- RabbitMQ 3.8.4 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.4
- RabbitMQ 3.8.4 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 series is recommended.
- This is the first release to officially support Erlang 23. Compared to 3.8.3, which
  generally works as expected on Erlang 23, Prometheus monitoring plugin had to
  be adapted to support a memory allocator metric format that has changed compared to
  earlier Erlang releases.
  There is one remaining known Erlang 23 incompatibility: rabbitmq-diagnostics observer will fail on Erlang 23.
  This will be addressed in a future release.
  The root cause is the same memory allocator metric change.
  Provisioning Latest Erlang Releases explains
  what package repositories and tools can be used to provision latest patch versions of Erlang 22.3.x
- RabbitMQ 3.8.4 is an RabbitMQ 3.8.0 update</changelog>
  <changelog author="gsantomaggio@suse.de" date="1597838400">- Update to 3.8.7
- RabbitMQ 3.8.7 is a maintenance release that patches a **security** vulnerability.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.7
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 releases are recommended.
- Update to 3.8.6
- RabbitMQ 3.8.6 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.6
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 releases are recommended.
- RabbitMQ Adopts the Mozilla Public License 2.0
  Starting with this release, core RabbitMQ server and all tier 1 plugins [1]
  are relicensed[2] under the Mozilla Public License 2.0[3]
  (previously used license: the Mozilla Public License 1.1).
  The permissiveness of the MPL 2.0 is largely the same as of the MPL 1.1.
  See the MPL 2.0 FAQ[4] and MPL 2.0 Revision and Changes FAQ[5] to learn more.
  1- https://www.rabbitmq.com/plugins.html#plugin-tiers
  2- https://github.com/rabbitmq/rabbitmq-server/issues/2372
  3- https://www.mozilla.org/en-US/MPL/2.0/
  4- https://www.mozilla.org/en-US/MPL/2.0/FAQ/
  5- https://www.mozilla.org/en-US/MPL/2.0/Revision-FAQ/</changelog>
  <changelog author="dheidler@suse.de" date="1601985600">- Add requirement for rabbitmq-server-plugins (boo#1174068)</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1603195200">- Update to RabbitMQ 3.8.9
- RabbitMQ 3.8.9 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.9
- This release no longer supports Erlang 21.3.
- This release is compatible with Erlang 23
- Update to RabbitMQ 3.8.8
- RabbitMQ 3.8.8 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.8
- This is the last RabbitMQ release to support Erlang 21.3.
- This release is compatible with Erlang 23</changelog>
  <changelog author="fbui@suse.com" date="1606132800">- %insserv_prereq is only requires when !have_systemd</changelog>
  <changelog author="psimons@suse.com" date="1612180800">- Update to RabbitMQ 3.8.11
  * Quorum queues that had active consumers during a rolling
    cluster upgrade could run into an exception and restart loop.
  * Nodes that had reverse_dns_lookup set to true could not accept
    client connections.
- Update to RabbitMQ 3.8.10
  * This release deprecates boot time definition import build into
    the management plugin.
  * Repeated polling of a quorum queue with basic.get that yielded
    an empty response could result in an unbounded growth of log
    segment files on on disk.
  * RabbitMQ core plugin activation was revisited to be closer to
    that of 3.7.x. This does not any related improvements w.r.t.
    definition import, e.g. those introudced in RabbitMQ 3.8.6.
  * Syslog dependency was not started correctly. This meant no log
    messages were sent to Syslog.
  * rabbitmq-diagnostics check_if_node_is_quorum_critical returned
    a false positive for a node marked for maintenance.
  * Queues could update their internal bookkeeping state
    incorrectly in some cases, leading to a file_handle_cache
    operation exception.
  * Quorum queues now can use the reject-publish max length
    overflow strategy.
  * Quorum queues now support consumer priority.
  * Per-user connection and queue limits. This is similar to
    per-vhost limits but, as the name suggests, these limits are
    associated for a given user.
  * TLSv1.3 is no longer considered experimental (on Erlang 23) and
    excluded from TLS listener configuration.
  * When a node is put under maintenance, it will now stop all
    local quorum queue replicas after completing leadership
    transfer. This means that no quorum queue replicas on the node
    will be considered for leader elections.
  * Nodes now keep track of failed client authentication attempts
    and expose it as a metric via both the Prometheus endpoint and
    the HTTP API at GET /api/auth/attempts/{node}.
  * bypass_pem_cache is a new configuration key that makes it
    possible to disable the cache of PEM files used by the Erlang
    TLS implementation. This rotated certificates quicker to detect
    for nodes but can also increase latency for inbound TLS
    connections, e.g. under high connection churn scenarios.
  * Definition import now safely handles some missing queue object
    arguments.
  * rabbitmq.conf schema now allows for peer certificate chain
    verification depth to be set to zero. When this value is used,
    peer certificate must be signed by a trusted CA certificate
    directly in order for the verification to pass.
  * RABBITMQ_IO_THREAD_POOL_SIZE will no longer be respected by
    RabbitMQ nodes. It is no longer relevant with supported Erlang
    versions and will simplify rabbitmq-diagnostics
    runtime_thread_stats output.
  * The +K runtime parameter is no longer used by RabbitMQ nodes as
    it has no effect with supported Erlang versions.</changelog>
  <changelog author="jengelh@inai.de" date="1612440000">- Remove recipe parts for SUSE 11.x, since that does not build.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629979200">- Fix CVE-2021-32718 improper neutralization of script-related HTML tags in a
  web page (basic XSS) in management UI (CVE-2021-32718, bsc#1187818)
  * fix-CVE-2021-32718.patch
- Fix CVE-2021-32719 improper neutralization of script-related HTML tags in a
  web page (basic XSS) in federation management plugin (CVE-2021-32719, bsc#1187819)
  * fix-CVE-2021-32719.patch
- Fix CVE-2021-22116 improper input validation may lead to DoS
  (CVE-2021-22116, bsc#1186203)
  * fix-CVE-2021-22116.patch
- Use /run instead of /var/run in tmpfiles.d configuration, fix bsc#1185075</changelog>
</package>
<package pkgid="36c81edf3283a56c38343715dc37857fec4143335780ca2ee7acc21fd1806717" name="erlang-rabbitmq-client" arch="s390x">
  <version epoch="0" ver="3.8.11" rel="3.3.3"/>
  <changelog author="g.santomaggio@gmail.com" date="1566216000">- Update to RabbitMQ version 3.7.17
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.17
- RabbitMQ 3.7.17 is a maintenance release. It focuses on bug fixes and upgrades
  a JavaScript dependency in the management UI to patch three CVEs in that library.</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1568721600">- Update to RabbitMQ version 3.7.18
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.18
- RabbitMQ 3.7.18 is a maintenance release. It focuses on bug fixes and internal
  API changes that refine the common plugin API with the upcoming 3.8.0 version.</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1571054400">- Update to RabbitMQ version 3.7.19
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.19
- RabbitMQ 3.7.19 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@suse.com" date="1572350400">- Update to RabbitMQ version 3.7.20
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.20
- RabbitMQ 3.7.20 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@gmail.com" date="1572868800">- Update to RabbitMQ version 3.7.21
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.21
- RabbitMQ 3.7.21 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1574856000">- Update to RabbitMQ version 3.7.22
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.22
- RabbitMQ 3.7.22 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.
- Per the new Erlang version support policy in effect starting with January 2019,
  this release no longer supports Erlang/OTP 20.3.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1575633600">- Update to RabbitMQ version 3.7.23
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.23
- RabbitMQ 3.7.23 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.
- Per the new Erlang version support policy in effect starting with January 2019,
  this release no longer supports Erlang/OTP 20.3.</changelog>
  <changelog author="g.santomaggio@suse.com" date="1578916800">- Update to 3.8.2
- RabbitMQ 3.8.2 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.2
- RabbitMQ 3.8.2 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.x series is recommended.
- RabbitMQ 3.8.2 is an RabbitMQ 3.8.0 update
- RabbitMQ 3.8.0 is a feature release. It contains several major improvements
  in areas of data safety, replication, observability, and ease of upgrades.
  Some highlight features are:
  * Quorum Queues
  * Built-in Prometheus support with a set of Grafana dashboards to complement it
  * Feature Flags
  * Single Active Consumer
  * New authentication and authorisation backend that uses OAuth 2.0 (JWT)
    tokens and scopes
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.0
- Read the upgrading guide before update: https://www.rabbitmq.com/upgrade.html</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1582545600">- jsc#SLE-10913</changelog>
  <changelog author="gsantomaggio@suse.de" date="1584014400">- Update to 3.8.3
- RabbitMQ 3.8.3 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.3
- RabbitMQ 3.8.3 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.x series is recommended.
- RabbitMQ 3.8.3 is an RabbitMQ 3.8.0 update</changelog>
  <changelog author="dmueller@suse.com" date="1587729600">- use python 3.x for building, allows dropping python 2.x</changelog>
  <changelog author="gsantomaggio@suse.de" date="1594296000">- Update to 3.8.5
- RabbitMQ 3.8.5 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.5
- RabbitMQ 3.8.5 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 series is recommended.
- RabbitMQ 3.8.5 is an RabbitMQ 3.8.0 update
- Update to 3.8.4
- RabbitMQ 3.8.4 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.4
- RabbitMQ 3.8.4 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 series is recommended.
- This is the first release to officially support Erlang 23. Compared to 3.8.3, which
  generally works as expected on Erlang 23, Prometheus monitoring plugin had to
  be adapted to support a memory allocator metric format that has changed compared to
  earlier Erlang releases.
  There is one remaining known Erlang 23 incompatibility: rabbitmq-diagnostics observer will fail on Erlang 23.
  This will be addressed in a future release.
  The root cause is the same memory allocator metric change.
  Provisioning Latest Erlang Releases explains
  what package repositories and tools can be used to provision latest patch versions of Erlang 22.3.x
- RabbitMQ 3.8.4 is an RabbitMQ 3.8.0 update</changelog>
  <changelog author="gsantomaggio@suse.de" date="1597838400">- Update to 3.8.7
- RabbitMQ 3.8.7 is a maintenance release that patches a **security** vulnerability.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.7
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 releases are recommended.
- Update to 3.8.6
- RabbitMQ 3.8.6 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.6
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 releases are recommended.
- RabbitMQ Adopts the Mozilla Public License 2.0
  Starting with this release, core RabbitMQ server and all tier 1 plugins [1]
  are relicensed[2] under the Mozilla Public License 2.0[3]
  (previously used license: the Mozilla Public License 1.1).
  The permissiveness of the MPL 2.0 is largely the same as of the MPL 1.1.
  See the MPL 2.0 FAQ[4] and MPL 2.0 Revision and Changes FAQ[5] to learn more.
  1- https://www.rabbitmq.com/plugins.html#plugin-tiers
  2- https://github.com/rabbitmq/rabbitmq-server/issues/2372
  3- https://www.mozilla.org/en-US/MPL/2.0/
  4- https://www.mozilla.org/en-US/MPL/2.0/FAQ/
  5- https://www.mozilla.org/en-US/MPL/2.0/Revision-FAQ/</changelog>
  <changelog author="dheidler@suse.de" date="1601985600">- Add requirement for rabbitmq-server-plugins (boo#1174068)</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1603195200">- Update to RabbitMQ 3.8.9
- RabbitMQ 3.8.9 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.9
- This release no longer supports Erlang 21.3.
- This release is compatible with Erlang 23
- Update to RabbitMQ 3.8.8
- RabbitMQ 3.8.8 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.8
- This is the last RabbitMQ release to support Erlang 21.3.
- This release is compatible with Erlang 23</changelog>
  <changelog author="fbui@suse.com" date="1606132800">- %insserv_prereq is only requires when !have_systemd</changelog>
  <changelog author="psimons@suse.com" date="1612180800">- Update to RabbitMQ 3.8.11
  * Quorum queues that had active consumers during a rolling
    cluster upgrade could run into an exception and restart loop.
  * Nodes that had reverse_dns_lookup set to true could not accept
    client connections.
- Update to RabbitMQ 3.8.10
  * This release deprecates boot time definition import build into
    the management plugin.
  * Repeated polling of a quorum queue with basic.get that yielded
    an empty response could result in an unbounded growth of log
    segment files on on disk.
  * RabbitMQ core plugin activation was revisited to be closer to
    that of 3.7.x. This does not any related improvements w.r.t.
    definition import, e.g. those introudced in RabbitMQ 3.8.6.
  * Syslog dependency was not started correctly. This meant no log
    messages were sent to Syslog.
  * rabbitmq-diagnostics check_if_node_is_quorum_critical returned
    a false positive for a node marked for maintenance.
  * Queues could update their internal bookkeeping state
    incorrectly in some cases, leading to a file_handle_cache
    operation exception.
  * Quorum queues now can use the reject-publish max length
    overflow strategy.
  * Quorum queues now support consumer priority.
  * Per-user connection and queue limits. This is similar to
    per-vhost limits but, as the name suggests, these limits are
    associated for a given user.
  * TLSv1.3 is no longer considered experimental (on Erlang 23) and
    excluded from TLS listener configuration.
  * When a node is put under maintenance, it will now stop all
    local quorum queue replicas after completing leadership
    transfer. This means that no quorum queue replicas on the node
    will be considered for leader elections.
  * Nodes now keep track of failed client authentication attempts
    and expose it as a metric via both the Prometheus endpoint and
    the HTTP API at GET /api/auth/attempts/{node}.
  * bypass_pem_cache is a new configuration key that makes it
    possible to disable the cache of PEM files used by the Erlang
    TLS implementation. This rotated certificates quicker to detect
    for nodes but can also increase latency for inbound TLS
    connections, e.g. under high connection churn scenarios.
  * Definition import now safely handles some missing queue object
    arguments.
  * rabbitmq.conf schema now allows for peer certificate chain
    verification depth to be set to zero. When this value is used,
    peer certificate must be signed by a trusted CA certificate
    directly in order for the verification to pass.
  * RABBITMQ_IO_THREAD_POOL_SIZE will no longer be respected by
    RabbitMQ nodes. It is no longer relevant with supported Erlang
    versions and will simplify rabbitmq-diagnostics
    runtime_thread_stats output.
  * The +K runtime parameter is no longer used by RabbitMQ nodes as
    it has no effect with supported Erlang versions.</changelog>
  <changelog author="jengelh@inai.de" date="1612440000">- Remove recipe parts for SUSE 11.x, since that does not build.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629979200">- Fix CVE-2021-32718 improper neutralization of script-related HTML tags in a
  web page (basic XSS) in management UI (CVE-2021-32718, bsc#1187818)
  * fix-CVE-2021-32718.patch
- Fix CVE-2021-32719 improper neutralization of script-related HTML tags in a
  web page (basic XSS) in federation management plugin (CVE-2021-32719, bsc#1187819)
  * fix-CVE-2021-32719.patch
- Fix CVE-2021-22116 improper input validation may lead to DoS
  (CVE-2021-22116, bsc#1186203)
  * fix-CVE-2021-22116.patch
- Use /run instead of /var/run in tmpfiles.d configuration, fix bsc#1185075</changelog>
</package>
<package pkgid="d10ad317ebccf7a1709d06a4bfdc77b8a2a0427d3f09ea1b30f908c448f51caf" name="erlang-rabbitmq-client" arch="x86_64">
  <version epoch="0" ver="3.8.11" rel="3.3.3"/>
  <changelog author="g.santomaggio@gmail.com" date="1566216000">- Update to RabbitMQ version 3.7.17
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.17
- RabbitMQ 3.7.17 is a maintenance release. It focuses on bug fixes and upgrades
  a JavaScript dependency in the management UI to patch three CVEs in that library.</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1568721600">- Update to RabbitMQ version 3.7.18
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.18
- RabbitMQ 3.7.18 is a maintenance release. It focuses on bug fixes and internal
  API changes that refine the common plugin API with the upcoming 3.8.0 version.</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1571054400">- Update to RabbitMQ version 3.7.19
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.19
- RabbitMQ 3.7.19 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@suse.com" date="1572350400">- Update to RabbitMQ version 3.7.20
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.20
- RabbitMQ 3.7.20 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@gmail.com" date="1572868800">- Update to RabbitMQ version 3.7.21
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.21
- RabbitMQ 3.7.21 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1574856000">- Update to RabbitMQ version 3.7.22
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.22
- RabbitMQ 3.7.22 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.
- Per the new Erlang version support policy in effect starting with January 2019,
  this release no longer supports Erlang/OTP 20.3.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1575633600">- Update to RabbitMQ version 3.7.23
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.7.23
- RabbitMQ 3.7.23 is a maintenance release that focuses on bug fixes.
- RabbitMQ 3.7.x series is supported through March 2020.
- Per the new Erlang version support policy in effect starting with January 2019,
  this release no longer supports Erlang/OTP 20.3.</changelog>
  <changelog author="g.santomaggio@suse.com" date="1578916800">- Update to 3.8.2
- RabbitMQ 3.8.2 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.2
- RabbitMQ 3.8.2 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.x series is recommended.
- RabbitMQ 3.8.2 is an RabbitMQ 3.8.0 update
- RabbitMQ 3.8.0 is a feature release. It contains several major improvements
  in areas of data safety, replication, observability, and ease of upgrades.
  Some highlight features are:
  * Quorum Queues
  * Built-in Prometheus support with a set of Grafana dashboards to complement it
  * Feature Flags
  * Single Active Consumer
  * New authentication and authorisation backend that uses OAuth 2.0 (JWT)
    tokens and scopes
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.0
- Read the upgrading guide before update: https://www.rabbitmq.com/upgrade.html</changelog>
  <changelog author="dimstar@opensuse.org" date="1580731200">- BuildRequire pkgconfig(systemd) instead of systemd: allow OBS to
  shortcut through the -mini flavors.</changelog>
  <changelog author="gsantomaggio@suse.de" date="1582545600">- jsc#SLE-10913</changelog>
  <changelog author="gsantomaggio@suse.de" date="1584014400">- Update to 3.8.3
- RabbitMQ 3.8.3 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.3
- RabbitMQ 3.8.3 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.x series is recommended.
- RabbitMQ 3.8.3 is an RabbitMQ 3.8.0 update</changelog>
  <changelog author="dmueller@suse.com" date="1587729600">- use python 3.x for building, allows dropping python 2.x</changelog>
  <changelog author="gsantomaggio@suse.de" date="1594296000">- Update to 3.8.5
- RabbitMQ 3.8.5 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.5
- RabbitMQ 3.8.5 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 series is recommended.
- RabbitMQ 3.8.5 is an RabbitMQ 3.8.0 update
- Update to 3.8.4
- RabbitMQ 3.8.4 is a maintenance release.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.4
- RabbitMQ 3.8.4 is a maintenance release.
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 series is recommended.
- This is the first release to officially support Erlang 23. Compared to 3.8.3, which
  generally works as expected on Erlang 23, Prometheus monitoring plugin had to
  be adapted to support a memory allocator metric format that has changed compared to
  earlier Erlang releases.
  There is one remaining known Erlang 23 incompatibility: rabbitmq-diagnostics observer will fail on Erlang 23.
  This will be addressed in a future release.
  The root cause is the same memory allocator metric change.
  Provisioning Latest Erlang Releases explains
  what package repositories and tools can be used to provision latest patch versions of Erlang 22.3.x
- RabbitMQ 3.8.4 is an RabbitMQ 3.8.0 update</changelog>
  <changelog author="gsantomaggio@suse.de" date="1597838400">- Update to 3.8.7
- RabbitMQ 3.8.7 is a maintenance release that patches a **security** vulnerability.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.7
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 releases are recommended.
- Update to 3.8.6
- RabbitMQ 3.8.6 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.6
- This release requires Erlang/OTP 21.3 or later.
  22.3 or 23.0 releases are recommended.
- RabbitMQ Adopts the Mozilla Public License 2.0
  Starting with this release, core RabbitMQ server and all tier 1 plugins [1]
  are relicensed[2] under the Mozilla Public License 2.0[3]
  (previously used license: the Mozilla Public License 1.1).
  The permissiveness of the MPL 2.0 is largely the same as of the MPL 1.1.
  See the MPL 2.0 FAQ[4] and MPL 2.0 Revision and Changes FAQ[5] to learn more.
  1- https://www.rabbitmq.com/plugins.html#plugin-tiers
  2- https://github.com/rabbitmq/rabbitmq-server/issues/2372
  3- https://www.mozilla.org/en-US/MPL/2.0/
  4- https://www.mozilla.org/en-US/MPL/2.0/FAQ/
  5- https://www.mozilla.org/en-US/MPL/2.0/Revision-FAQ/</changelog>
  <changelog author="dheidler@suse.de" date="1601985600">- Add requirement for rabbitmq-server-plugins (boo#1174068)</changelog>
  <changelog author="g.santomaggio@gmail.com" date="1603195200">- Update to RabbitMQ 3.8.9
- RabbitMQ 3.8.9 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.9
- This release no longer supports Erlang 21.3.
- This release is compatible with Erlang 23
- Update to RabbitMQ 3.8.8
- RabbitMQ 3.8.8 is a maintenance release.
  It focuses on bug fixes and usability improvements.
- Full release notes: https://github.com/rabbitmq/rabbitmq-server/releases/tag/v3.8.8
- This is the last RabbitMQ release to support Erlang 21.3.
- This release is compatible with Erlang 23</changelog>
  <changelog author="fbui@suse.com" date="1606132800">- %insserv_prereq is only requires when !have_systemd</changelog>
  <changelog author="psimons@suse.com" date="1612180800">- Update to RabbitMQ 3.8.11
  * Quorum queues that had active consumers during a rolling
    cluster upgrade could run into an exception and restart loop.
  * Nodes that had reverse_dns_lookup set to true could not accept
    client connections.
- Update to RabbitMQ 3.8.10
  * This release deprecates boot time definition import build into
    the management plugin.
  * Repeated polling of a quorum queue with basic.get that yielded
    an empty response could result in an unbounded growth of log
    segment files on on disk.
  * RabbitMQ core plugin activation was revisited to be closer to
    that of 3.7.x. This does not any related improvements w.r.t.
    definition import, e.g. those introudced in RabbitMQ 3.8.6.
  * Syslog dependency was not started correctly. This meant no log
    messages were sent to Syslog.
  * rabbitmq-diagnostics check_if_node_is_quorum_critical returned
    a false positive for a node marked for maintenance.
  * Queues could update their internal bookkeeping state
    incorrectly in some cases, leading to a file_handle_cache
    operation exception.
  * Quorum queues now can use the reject-publish max length
    overflow strategy.
  * Quorum queues now support consumer priority.
  * Per-user connection and queue limits. This is similar to
    per-vhost limits but, as the name suggests, these limits are
    associated for a given user.
  * TLSv1.3 is no longer considered experimental (on Erlang 23) and
    excluded from TLS listener configuration.
  * When a node is put under maintenance, it will now stop all
    local quorum queue replicas after completing leadership
    transfer. This means that no quorum queue replicas on the node
    will be considered for leader elections.
  * Nodes now keep track of failed client authentication attempts
    and expose it as a metric via both the Prometheus endpoint and
    the HTTP API at GET /api/auth/attempts/{node}.
  * bypass_pem_cache is a new configuration key that makes it
    possible to disable the cache of PEM files used by the Erlang
    TLS implementation. This rotated certificates quicker to detect
    for nodes but can also increase latency for inbound TLS
    connections, e.g. under high connection churn scenarios.
  * Definition import now safely handles some missing queue object
    arguments.
  * rabbitmq.conf schema now allows for peer certificate chain
    verification depth to be set to zero. When this value is used,
    peer certificate must be signed by a trusted CA certificate
    directly in order for the verification to pass.
  * RABBITMQ_IO_THREAD_POOL_SIZE will no longer be respected by
    RabbitMQ nodes. It is no longer relevant with supported Erlang
    versions and will simplify rabbitmq-diagnostics
    runtime_thread_stats output.
  * The +K runtime parameter is no longer used by RabbitMQ nodes as
    it has no effect with supported Erlang versions.</changelog>
  <changelog author="jengelh@inai.de" date="1612440000">- Remove recipe parts for SUSE 11.x, since that does not build.</changelog>
  <changelog author="danilo.spinella@suse.com" date="1629979200">- Fix CVE-2021-32718 improper neutralization of script-related HTML tags in a
  web page (basic XSS) in management UI (CVE-2021-32718, bsc#1187818)
  * fix-CVE-2021-32718.patch
- Fix CVE-2021-32719 improper neutralization of script-related HTML tags in a
  web page (basic XSS) in federation management plugin (CVE-2021-32719, bsc#1187819)
  * fix-CVE-2021-32719.patch
- Fix CVE-2021-22116 improper input validation may lead to DoS
  (CVE-2021-22116, bsc#1186203)
  * fix-CVE-2021-22116.patch
- Use /run instead of /var/run in tmpfiles.d configuration, fix bsc#1185075</changelog>
</package>
<package pkgid="069fafc51a86e93e7949dc57c6b3d65dffd0e9ca405143ff5ff287431ee2768d" name="etags" arch="aarch64">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="2cd06036540e33f295f229d2a49195d5428f3f7b7433d7a71474a4dd83c07b68" name="etags" arch="ppc64le">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="2b4a04fcecf047dd23094bf537052a4770595867b31675dd48d934fded6528e8" name="etags" arch="s390x">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="d8632790aa4f433df4adc03ab605bcbb4625d356ab2093b0b3f8dcfe4c095c70" name="etags" arch="x86_64">
  <version epoch="0" ver="25.3" rel="3.9.2"/>
  <changelog author="werner@suse.de" date="1478865600">- Avoid address space randomization during emacs build
- Check for active Execution Shield as this breaks emacs</changelog>
  <changelog author="werner@suse.de" date="1482235200">- Add patch emacs-25.1-custom-fonts.patch as workaround for boo#1016172</changelog>
  <changelog author="werner@suse.de" date="1488283200">- Test out release candidate of emacs bugfix release 25.2
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.
- Patch emacs-25.1.dif renamed to emacs-25.2.dif
- Modified patches emacs-24.4-glibc.patch and emacs-24.4-ps-bdf.patch</changelog>
  <changelog author="kukuk@suse.de" date="1489233600">- Add /var/games to filelist</changelog>
  <changelog author="meissner@suse.com" date="1491134400">- also pass "-no-pie" as linkerflag to disable PIE.</changelog>
  <changelog author="werner@suse.de" date="1491220800">- Check if "-no-pie" is known to the compiler/linker</changelog>
  <changelog author="pgajdos@suse.com" date="1491998400">- build with ImageMagick 7 [bsc#1033077]
  + emacs-25.2-ImageMagick7.patch</changelog>
  <changelog author="werner@suse.de" date="1493121600">- Update to emacs version 25.2 a bugfix release
  * 'find-library', 'help-function-def' and 'help-variable-def' now run
    'find-function-after-hook'.
  * New basic face 'fixed-pitch-serif', for a fixed-width font with serifs.
    The 'Info-quoted' and 'tex-verbatim' faces inherit from it by default.
  * New variable 'use-default-font-for-symbols', for backward compatibility.
    This variable allows you to get back pre-Emacs 25 behavior where the
    font for displaying symbol and punctuation characters was always
    selected according to your fontset setup.  By default, Emacs 25 tries
    to use the default face's font for such characters, if it supports
    them, disregarding the fontsets.  Set this variable to nil to disable
    this and get back the old behavior.
  * 'electric-quote-mode' is no longer suppressed in a buffer whose
    coding system cannot represent curved quote characters.
    Instead, users can deal with the unrepresentable characters in the
    usual way when they save the buffer.
  * New variable 'inhibit-compacting-font-caches'.
    Set this variable to a non-nil value to speed up display of characters
    using large fonts, at the price of a larger memory footprint.
  * The version number of CC Mode has been changed from 5.33 to
    5.32.99, although the software itself hasn't changed.  This aims to
    reduce confusion with the standalone CC Mode 5.33 (available from
    http://cc-mode.sourceforge.net), which is a more mature version than
    the one included in Emacs 25.2.</changelog>
  <changelog author="werner@suse.de" date="1493121601">- Fix emacs.sh wrapper script to check modern dbus session (boo#1032759)</changelog>
  <changelog author="werner@suse.de" date="1493208000">- Use socket activation to get dbus up before starting emacs</changelog>
  <changelog author="werner@suse.de" date="1493726400">- Add patch gnulib.git-94e01571.patch to fix CVE-2017-7476</changelog>
  <changelog author="zaitor@opensuse.org" date="1496404800">- Add conditional emacs-25.2-xwidget.patch, and
  pkgconfig(webkit2gtk-4.0) BuildRequires; depend on latest
  webkitgtk for Tumbleweed.</changelog>
  <changelog author="astieger@suse.com" date="1503403200">- build without libgnutls-openssl-devel</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Add patch emacs-25.2-bsc1058425.patch to fix bsc#1058425
  VUL-0: emacs: GNU Emacs 25.2 enriched text remote code execution</changelog>
  <changelog author="werner@suse.de" date="1506081600">- Update to emacs version 25.3 a security release
  * * Security vulnerability related to Enriched Text mode is removed.
- Modified patches
  * emacs-24.4-ps-bdf.patch
  * emacs-25.2-ImageMagick7.patch
  * emacs-25.2-bsc1058425.patch now partly upstream
- Rename emacs-25.2.dif to emacs-25.3.dif</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch emacs-25.3-xft4x11.patch to allow emacs-x11 to use
  xft even for its menu bar (boo#1096354)</changelog>
  <changelog author="werner@suse.de" date="1529064000">- Simplify patch emacs-25.3-xft4x11.patch (from Henryk Hecht) for
  boo#1096354</changelog>
  <changelog author="werner@suse.de" date="1597060800">- Add patch emacs-libX11-boo1175028.patch to fix SIGSEGV introduced
  by a security fix for libX11 (boo#1175028)</changelog>
  <changelog author="werner@suse.de" date="1631188800">- Add patch boo1180353-6d8144a2.patch to fix boo#1180353 that is a
  possible segmentation fault in case of stack overflow of etags</changelog>
  <changelog author="werner@suse.de" date="1631188801">- Add patch boo1178942-bedb3cb6.patch to avoid that emacs hang in
  isearch (boo#1178942)</changelog>
</package>
<package pkgid="7bb88a31fd12dab3701ce8f3051600e9748012f4024f4acdd7e548ef2f1dbad5" name="evolution" arch="aarch64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="8b1f1dc99a2cdb2600b122d63164262811c597d3706812406dac81c910161d0c" name="evolution" arch="ppc64le">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="97adcd9b3f558b25570cc00553248c974b4a362db772e6fd36fc372b59c8724b" name="evolution" arch="s390x">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="59d6e9d2045032894e8a66d624379a63a182d544c2a522ab4014030aec42d787" name="evolution" arch="src">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="eb980179598ae968dfefc0411366c9f5d00d5b50f330cc75b355d3b93b944246" name="evolution" arch="x86_64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="a65442ae1f57e1ba5ff09d1b5585f03fee8552f09a45f68206254c99fa4a7daf" name="evolution-devel" arch="aarch64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="0a22fab0c53db55f63032f326b15f70e5fea56f95520a36212530ddf39efd9a0" name="evolution-devel" arch="ppc64le">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="017df1e880b5d79a594ef77385b08f52ef867b94f4c1fb25aa139aad374b4733" name="evolution-devel" arch="s390x">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="555aaa34bb438f3d87b968e2f6416deb44ee2c93cf286deb696001d028a66215" name="evolution-devel" arch="x86_64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="1c31612b064f5e18bcc96e87498933cc4e33ea5c451c6f6229c2b98d2ae2cf3a" name="evolution-lang" arch="noarch">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="38a3beeb6d2992cfd3b858c09a6c17b6454d94daa4c9870e3453d94cebcdbb15" name="evolution-plugin-bogofilter" arch="aarch64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="a762db9b52002a2772f1e8503e75f93ce0e4833c61b96092566a5f159a27c467" name="evolution-plugin-bogofilter" arch="ppc64le">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="a627b3612be87805c363a7207963e69008637695e004176ea69f371d3297015e" name="evolution-plugin-bogofilter" arch="s390x">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="83b6a87e332ae2aae121e0f5a90a29651e093be4db1bb61eb14083d470b2ae85" name="evolution-plugin-bogofilter" arch="x86_64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="b989f6cd953b035c0eb7c1802a5bcda770981acb5e7a0d08c92374b1b39e12d9" name="evolution-plugin-pst-import" arch="aarch64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="7230a70e3d8d77aeddf198abb8a29a9900b2ba09543d2a079452ee558632dfc4" name="evolution-plugin-pst-import" arch="ppc64le">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="07f88f002164de94be8a1cff09061e8d659b04bcf6871853d1b48b18559f2073" name="evolution-plugin-pst-import" arch="s390x">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="aa1c07ef2789b31282e8a1b8e43d8c6d1952c008afd8185bc65957fdf6f3fad0" name="evolution-plugin-pst-import" arch="x86_64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="d48aae009ebfeb9c44f79050b0001c1866da07363d13d62b50bba195b88f78e2" name="evolution-plugin-spamassassin" arch="aarch64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="7b526f9e80904356119465728c876e4cf0ab59e92298df2ebb9018f82ae866a0" name="evolution-plugin-spamassassin" arch="ppc64le">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="74cbb43d5783b98339211f9f116ff76f32db446b8d6f4d07f4a4ff779514e5f0" name="evolution-plugin-spamassassin" arch="s390x">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="129512b831ef50aa951b04b7e4aefef75989bd116a251339c9fecf5981668974" name="evolution-plugin-spamassassin" arch="x86_64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="3eaa1358734f35cb86fd97b6f0908a06a46deeac10069dbb05ee47b0139bfb80" name="evolution-plugin-text-highlight" arch="aarch64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="7a6bfa7d16144ba7e0c1ee49a8f2da1720f86b4e399e770cd637ad968ee60dba" name="evolution-plugin-text-highlight" arch="ppc64le">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="02c61022cca8c6b5d2f3fabf38a30780620ba1d6d6bce68bb88846b1c9366626" name="evolution-plugin-text-highlight" arch="s390x">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="ac98deb89940dab06e4ebcaae2adb95551f1dc755788ac6f442c6fd3a0833ff8" name="evolution-plugin-text-highlight" arch="x86_64">
  <version epoch="0" ver="3.34.4" rel="3.3.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1546862400">- Update to version 3.30.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bugs fixed: glgo#GNOME/evolution#273.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549627200">- Update to version 3.30.5:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#282,
    glgo#GNOME/evolution#283, glgo#GNOME/evolution#284,
    glgo#GNOME/evolution#288.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713600">- Update to version 3.31.3:
  + [EWebView] Use case insensitive search when highlighting words
    in the body.
  + Correct how extra compiler warnings are used in the maintainer
    mode.
  + e_mail_formatter_format_address: Quote name part when it
    contains special letters.
  + [SRV config lookup] Preset authentication method for SMTP.
  + [itip-view] Do not duplicate X-MICROSOFT-CDO-REPLYTIME in
    replies.
  + [Flatpak] Update manifests to reflect recent
    evolution-data-server changes.
  + [Flatpak manifests] Build geocode-glib directly with meson.
  + help: Make clearer that SSL is dead and TLS is its successor.
  + Bugs fixed: glgo#GNOME/evolution#154, glgo#GNOME/evolution#162,
    glgo#GNOME/evolution#165, glgo#GNOME/evolution#168,
    glgo#GNOME/evolution#169, glgo#GNOME/evolution#236,
    glgo#GNOME/evolution#237, glgo#GNOME/evolution#238,
    glgo#GNOME/evolution#239, glgo#GNOME/evolution#248,
    glgo#GNOME/evolution#252, glgo#GNOME/evolution#254.
  + Updated translations.
- Changes from version 3.31.2:
  + Free/Busy lookup for authenticated URLs not re-tried.
  + [Calendar] Fix issues with attendees editing of an existing
    meeting.
  + A little code clean-up related to the previous commit.
  + [Event/Task editor] Force timezone part show only if really
    needed.
  + [Flatpak] Update some of the dependencies.
  + Make sure intltool-merge cache is created only once.
  + Correct evolution-mail-formatter user documentation build
    warning.
  + Include also environment LD_LIBRARY_PATH in gtk-doc-scangobj
    call.
  + Bugs fixed: bgo#228772, bgo#561799, bgo#610741, bgo#652821,
    bgo#741363, bgo#769396, bgo#781122, bgo#795202,
    glgo#GNOME/evolution#113, glgo#GNOME/evolution#120
    (boo#1125230 CVE-2018-15587), glgo#GNOME/evolution#140,
    glgo#GNOME/evolution#163, glgo#GNOME/evolution#164,
    glgo#GNOME/evolution#166, glgo#GNOME/evolution#176,
    glgo#GNOME/evolution#180, glgo#GNOME/evolution#181,
    glgo#GNOME/evolution#182, glgo#GNOME/evolution#183,
    glgo#GNOME/evolution#187, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#196, glgo#GNOME/evolution#198,
    glgo#GNOME/evolution#208, glgo#GNOME/evolution#211,
    glgo#GNOME/evolution#214.
  + Updated translations.
- Changes from version 3.31.1:
  + Update Flatpak build scripts to better integrate with the host
    desktop.
  + Add a man page for evolution.
  + [mail-send-receive] Try harder when searching for mail shell
    view.
  + Improve Flatpak manifests.
  + Composer autosave can stop working.
  + GNOME Bugzilla has been replaced by GNOME Gitlab.
  + [ECollectionAccountWizard] Preset user name to mail sources.
  + [EMVFolderEditor] Correct path used to e_restore_window().
  + Updated Czech default mail translation.
  + Fixed links in default mail.
  + Print actions disabled in Calendar view.
  + Task Location shown as Summary in preview pane.
  + Make sure message_list_folder_changed() is called from the
    main/UI thread.
  + [Flatpak] Use host system DConf to store user settings.
  + Bugs fixed: bgo#548656, bgo#640994, bgo#724129, bgo#750636,
    bgo#785719, glgo#GNOME/evolution#66, glgo#GNOME/evolution#84,
    glgo#GNOME/evolution#86, glgo#GNOME/evolution#101,
    glgo#GNOME/evolution#103, glgo#GNOME/evolution#104,
    glgo#GNOME/evolution#106, glgo#GNOME/evolution#107,
    glgo#GNOME/evolution#108, glgo#GNOME/evolution#110,
    glgo#GNOME/evolution#111, glgo#GNOME/evolution#115,
    glgo#GNOME/evolution#118, glgo#GNOME/evolution#119,
    glgo#GNOME/evolution#122, glgo#GNOME/evolution#123,
    glgo#GNOME/evolution#127, glgo#GNOME/evolution#128,
    glgo#GNOME/evolution#129, glgo#GNOME/evolution#135,
    glgo#GNOME/evolution#136, glgo#GNOME/evolution#139,
    glgo#GNOME/evolution#140, glgo#GNOME/evolution#155,
    glgo#GNOME/evolution#156, glgo#GNOME/evolution#159,
    glgo#GNOME/evolution#162.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1549713601">- Update to version 3.31.4:
  + Clamp GSettings values before restoring window size.
  + "Save Image..." fails on shown attached image in message
    preview.
  + Bump copyright year - the future is now!.
  + Help: Mention the existence of mnemonics / accelerators.
  + Bugs fixed: glgo#GNOME/evolution#273.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550577600">- Update to version 3.31.91:
  + Change parentheses in an if() to avoid clang warning.
  + [em-format] Unfold Mailer header value before using it.
  + Bugs fixed: glgo#GNOME/evolution#302, glgo#GNOME/evolution#306,
    glgo#GNOME/evolution#307.
  + Updated translations.
- Changes from version 3.31.90:
  + Event with empty summary can cause crash.
  + [Composer] Draft email can lose attachments when opened.
  + Initialize 'cache' variable in e_http_request_process_sync().
  + Help:
  - Backspace works similar to Space across folders.
  - Mention 'Show Junk Messages' option.
  - Loading remote images: Match the string in the UI.
  + Bugs fixed: glgo#GNOME/evolution#76, glgo#GNOME/evolution#250,
    glgo#GNOME/evolution#275, glgo#GNOME/evolution#277,
    glgo#GNOME/evolution#278, glgo#GNOME/evolution#279,
    glgo#GNOME/evolution#282, glgo#GNOME/evolution#283,
    glgo#GNOME/evolution#284, glgo#GNOME/evolution#288,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#297.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551700800">- Update to version 3.31.92:
  + The 'Show' combo box hidden for small screens in the search
    bar.
  + Ref/unref imbalance on a CamelFolder instance.
  + Change how label actions are updated in EMailReader.
  + Use GWeakRef when watching D-Bus bus names.
  + [EWebKitEditor] Fix few memory leaks.
  + Initialize all members of 'struct tm' in e_cert_populate().
  + Fix few memory leaks around mail print.
  + Colorize insecure parts as 'bad' in otherwise secure mail.
  + Change order of CFLAGS/LDFLAGS passed to gtk-doc.
  + help:
  - Fix wrong docs about email thread collapsing by default.
  - Cover saving and applying Custom Views for mail folders.
  - Replace git.gnome.org by gitlab.gnome.org.
  + Bugs fixed: bgo#791044, glgo#GNOME/evolution-data-server#86,
    glgo#GNOME/evolution#289, glgo#GNOME/evolution#313,
    glgo#GNOME/evolution#318, glgo#GNOME/evolution#324.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552305600">- Update to version 3.32.0:
  + help:
  - Update cs screenshot of mail switcher.
  - Remove ancient outdated Spanish screenshot.
  - Set an image to non-executable mode.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Update flatpak 'master' version manifest.
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.bgo
  + Fix some maybe uninitialized variable usages.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Fix two memory leaks.
  + help:
  - Cover customizing keyboard shortcuts.
  - A custom Archive mail folder requires to first set a general
    one.
  - New mail notification in mail icon is not a star anymore.
  - Update application icon for 3.32.
  + Bugs fixed: glgo#GNOME/evolution#190, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#325, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#336, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#378,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#395.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1557144000">- Update to version 3.32.2:
  + Use lower-case "mailto:" consistently in the code.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + [Flatpak]
  - Cover changes in 'gdbus wait' timeout argument units.
  - Change how already running services are detected in the
    wrapper script.
  - Give access to filesystem's ~/.gnupg.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560772800">- Update to version 3.32.3:
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Change buffer size argument value in call of
    icalvalue_decode_ical_string().
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Bugs fixed: glgo#GNOME/evolution#400, glgo#GNOME/evolution#405,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#437, glgo#GNOME/evolution#439,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#454, glgo#GNOME/evolution#472,
    glgo#GNOME/evolution#474, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution!13, glgo#GNOME/evolution!14,
    glgo#GNOME/evolution!16, glgo#GNOME/evolution#112.
  + Updated translations.
- Use modern cmake_build macro.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1563192000">- Update to version 3.32.4:
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Test whether referenced column exists when loading ETableState.
  + Bugs fixed: bgo#755730, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#501,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1563796800">- Split text highlight plugin into a subpackage.
- Add missing runtime dependency on the 'highlight' package.
- Replace packageand() by boolean dependencies.</changelog>
  <changelog author="luke@ljones.dev" date="1567598400">- Update to version 3.33.92
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.
- Update to version 3.33.91
  + Include also CFLAGS in gtkdoc-scangobj command line.
  + Fix few memory leaks in internal test programs.
  + ECellTree: Limit deep threads indent up to 70% of the cell
    width.
  + EDayView: Time zone name not always updated on time zone change
    in UI.
  + Bug Fixes: glgo#GNOME/evolution#518, glgo#GNOME/evolution#541,
    glgo#GNOME/evolution#554, glgo#GNOME/evolution#563,
    glgo#GNOME/evolution#568, glgo#GNOME/evolution#576.
- Update to version 3.33.90
  + Add refresh interval settings for CardDAV address books.
  + killev: Search for killall/pkill in runtime, rather than in
    compile time.
  + Use Unicode triple-dots in translatable strings.
  + help: Replace an external redirect link by its direct link.
  + help: Fix xmlns for XInclude (must be http) so pages validate.
  + help: Cover formatting of received HTML mail, e.g. showing
    Plain Text.
  + Bug Fixes: glgo#GNOME/evolution#549, glgo#GNOME/evolution#564.
- Update to version 3.33.4
  + Use GtkPopover for EColorCombo widget.
  + Do not unfold DKIM and ARC headers in message preview.
  + Remember source message information when re-editing in Drafts
    or Outbox.
  + [ECalModel] Cache value for E_CAL_MODEL_FIELD_ICON.
  + Inconsistent background color in ETable for Memos, Tasks and
    List View.
  + Incorrect timezone selected in ETimezoneDialog.
  + Remove useless runtime check in date_time_list_finalize().
  + Correct coding typo in e_day_view_on_editing_stopped().
  + Refer to 'Evolution Website' only as 'Website' in the About
    dialog.
  + [ECompEditor] Ensure attendee changes stored before save.
  + Check whether enum-based ICalParameter had been created before
    using it.
  + Test whether referenced column exists when loading ETableState.
  + Search for Bogofilter/SpamAssassin binaries during configure
    time.
  + [addressbook] Claim what image size is expected when asking to
    resize given image.
  + help: Update main window screenshot for 3.32 style.
  + Bug Fixes: bgo#755730, bgo#759493, glgo#GNOME/evolution#533,
    glgo#GNOME/evolution#385, glgo#GNOME/evolution#479,
    glgo#GNOME/evolution#487, glgo#GNOME/evolution#492,
    glgo#GNOME/evolution#494, glgo#GNOME/evolution#499,
    glgo#GNOME/evolution#501, glgo#GNOME/evolution#503,
    glgo#GNOME/evolution#504, glgo#GNOME/evolution#506,
    glgo#GNOME/evolution#507, glgo#GNOME/evolution#508,
    glgo#GNOME/evolution#517, glgo#GNOME/evolution#519,
    glgo#GNOME/evolution#529, glgo#GNOME/evolution#534.
- Update to version 3.33.3
  + Fix a crash in itip-view.c:extract_itip_data().
  + Fix clang warnings (mostly [-Wenum-conversion]).
  + Add all icon directories into icon theme search path in
    maintainer mode.
  + Local calendar config option to open for writing does nothing.
  + Change path where backup/restore searches for the .running
    file.
  + Fix several memory leaks in the addressbook code.
  + Memos cannot have set reminders according to RFC 5545.
  + Use ECalComponentAlarm members instead of ICalProperty objects.
  + Add 'Status' column to Memos and Calendar's List View.
  + Bug Fixes:
    bgo#233065, bgo#793795,glgo#GNOME/evolution#399,
    glgo#GNOME/evolution#408, glgo#GNOME/evolution#433,
    glgo#GNOME/evolution#481, glgo#GNOME/evolution#484,
    glgo#GNOME/evolution#445, glgo#GNOME/evolution#446,
    glgo#GNOME/evolution#448, glgo#GNOME/evolution#454,
    glgo#GNOME/evolution#463, glgo#GNOME/evolution#468,
    glgo#GNOME/evolution#472, glgo#GNOME/evolution#474,
    glgo#GNOME/evolution#475, glgo#GNOME/evolution#476,
    glgo#GNOME/evolution#478, glgo#GNOME/evolution#479.
- Update to version 3.33.2
  + Fixed typo in string.
  + Prevent crash in cal_data_model_notify_recurrences_cb().
  + Correct code typo in test-keyfile-settings-backend.c.
  + Fix a possible memory leak in
    e-web-view.c:web_view_initialize().
  + Reference a GDBusProxy object in the synchronous call wrappers.
  + Fix a crash when filling mail threaded view.
  + Port to libecal-2.0 and adapt to libebook API changes.
  + Address some issues reported by static analyzers..
  + Correct type of ECalDataModel::timezone property.
  + Miscellaneous changes for issues overlooked during port to
    libical-glib.
  + Bug Fixes: glgo#GNOME/evolution#240, glgo#GNOME/evolution#400,
    glgo#GNOME/evolution#405, glgo#GNOME/evolution#406,
    glgo#GNOME/evolution#407, glgo#GNOME/evolution#417,
    glgo#GNOME/evolution#429, glgo#GNOME/evolution#430,
    glgo#GNOME/evolution#432, glgo#GNOME/evolution#437,
    glgo#GNOME/evolution#439, glgo#GNOME/evolution#112.
- Update to version 3.33.1
  + Expand/collapse buttons in vCard preview do nothing.
  + Fix few memory leaks around vCard preview and mail attachment
    parsing.
  + Fix some maybe uninitialized variable usages.
  + Inline Forward headers bold in Plain Text mode.
  + Fix a copy&amp;paste error with LC_TIME in emcu_change_locale().
  + [CompEditor] Use CSS3 color name in the iCalendar COLOR
    property.
  + Update flatpak README.
  + Add a link to an online build manual into the README.
  + Fix two memory leaks.
  + Use lower-case "mailto:" consistently in the code.
  + [mail-notification] Use sound theme by default.
  + help: Cover customizing keyboard shortcuts.
  + help: A custom Archive mail folder requires to first set a
    general one.
  + help: New mail notification in mail icon is not a star anymore.
  + help: Update screenshots of mail switcher to 3.32 style.
  + help: Update application icon for 3.32.
  + Bug Fixes: bg0#202257, bgo#203955, glgo#GNOME/evolution#190,
    glgo#GNOME/evolution#210, glgo#GNOME/evolution#256,
    glgo#GNOME/evolution#395, glgo#GNOME/evolution#286,
    glgo#GNOME/evolution#323, glgo#GNOME/evolution#325,
    glgo#GNOME/evolution#326, glgo#GNOME/evolution#327,
    glgo#GNOME/evolution#330, glgo#GNOME/evolution#336,
    glgo#GNOME/evolution#338, glgo#GNOME/evolution#339,
    glgo#GNOME/evolution#343, glgo#GNOME/evolution#344,
    glgo#GNOME/evolution#348, glgo#GNOME/evolution#359,
    glgo#GNOME/evolution#370, glgo#GNOME/evolution#373,
    glgo#GNOME/evolution#376, glgo#GNOME/evolution#377,
    glgo#GNOME/evolution#378, glgo#GNOME/evolution#380,
    glgo#GNOME/evolution#383, glgo#GNOME/evolution#384,
    glgo#GNOME/evolution#386, glgo#GNOME/evolution#390,
    glgo#GNOME/evolution#392, glgo#GNOME/evolution#94,
    glgo#GNOME/evolution#99, glgo#GNOME/evolution#102.</changelog>
  <changelog author="luke@ljones.dev" date="1567684800">- Update to version 3.33.92:
  + itip-formatter: Doesn't match attendee when an alias address is
    used.
  + ECompEditor: Set window's urgency hint after error when not
    focused.
  + Bug Fixes: glgo#GNOME/evolution#528, glgo#GNOME/evolution#551,
    glgo#GNOME/evolution#562, glgo#GNOME/evolution#574,
    glgo#GNOME/evolution#578, glgo#GNOME/evolution#583,
    glgo#GNOME/evolution#588, glgo#GNOME/evolution#592,
    glgo#GNOME/evolution#593, glgo#GNOME/evolution#601.</changelog>
  <changelog author="mgorse@suse.com" date="1568030400">- Update to version 3.34.0:
  + help: Fix broken markup in cs help translation.
  + help: Remove XInclude for Account settings' \"Identity\"
    section.
  + help: Cover server-side search behavior for remote accounts.
  + help: Remove unproven statement about search speed.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570449600">- Update to version 3.34.1:
  + EWebView: Pile calls to Web Extension proxy only when such
    exists.
  + Fix several memory leaks in ECalModel and its descendants.
  + help:
  - Update application logo.
  - Fix a typo (semi-colon instead of colon).
  + Bugs fixed: glgo#GNOME/evolution#524, glgo#GNOME/evolution#587,
    glgo#GNOME/evolution#603, glgo#GNOME/evolution#610,
    glgo#GNOME/evolution#611, glgo#GNOME/evolution#615,
    glgo#GNOME/evolution#617, glgo#GNOME/evolution#623,
    glgo#GNOME/evolution#624, glgo#GNOME/evolution#636,
    glgo#GNOME/evolution#641, glgo#GNOME/evolution#644,
    glgo#GNOME/evolution#645.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574424000">- Update to version 3.34.2:
  + Fix a crash when changing Archive folder.
  + Calendar: Show only the last part of the timezone above the
    time column in the Day View.
  + ESimpleAsyncResult: Avoid thread scheduling race when finishing
    on idle.
  + Bugs fixed: glgo#GNOME/evolution#659, glgo#GNOME/evolution#680,
    glgo#GNOME/evolution#681, glgo#GNOME/evolution#696,
    glgo#GNOME/evolution#701, glgo#GNOME/evolution#702,
    glgo#GNOME/evolution#709, glgo#GNOME/evolution#711.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1578052800">- Update to version 3.34.3:
  + Bugs fixed:
  - glgo#GNOME/evolution#681 Cannot type the date of a meeting.
  - glgo#GNOME/evolution#719 e-cal-dialogs: Set default responses
    for dialogs.
  - glgo#GNOME/evolution#729 New Mail account wizard ignores
    email address change.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581681600">- Update to version 3.34.4:
  + Emoticon: Replace Unicode variant for face-smile and face-sad
    with Emoji.
  + Bugs fixed:
  - 'open-map:' URI passed to browser.
  - PST importer: Fix name of MIME multipart/alternative.
  - Incorrect time shown in Reply credits for Australia/Adelaide.
  - ECompEditor: Typing end time messes up start time.</changelog>
  <changelog author="mgorse@suse.com" date="1624017600">- Add evolution-disable-sandboxing-to-enable-printing.patch:
  disable WebKit sandboxing. Needed for printing to work until
  webkit#202363 is fixed (boo#1174907).</changelog>
</package>
<package pkgid="4fa9ff438c33173c8c233b812e5d06e8bf5451e33024b6edcd528ee07ecd04b9" name="exfatprogs" arch="aarch64">
  <version epoch="0" ver="1.0.4" rel="3.3.1"/>
  <changelog author="idonmez@suse.com" date="1587643200">- Initial release on OBS</changelog>
  <changelog author="idonmez@suse.com" date="1589284800">- Update to version 1.0.3
  * libexfat0 library is no longer installed
  * Rename label.exfat to tune.exfat.
  * tune.exfat: change argument style
    (-l option for print level, -L option for setting label)
  * mkfs.exfat: harmonize set volume label option with tune.exfat.
  * Fix the reported build warnings/errors.
  * Add memset to clean garbage in allocation.
  * Fix wrong volume label array size.
  * Open a device using O_EXCL to avoid formatting it while it is mounted.
  * Add man page.</changelog>
  <changelog author="idonmez@suse.com" date="1596456000">- Update to version 1.0.4
  * fsck.exfat: display sector, cluster, and volume sizes in the human
    readable format.
  * fsck.exfat: reduce the elapsed time using read-ahead.
  * mkfs.exfat: generate pseudo unique serials while creating filesystems.
  * mkfs.exfat: add the "-b" option to align the start offset of FAT and
    data clusters.
  * fsck.exfat: repair zero-byte files which have the NoFatChain attribute.
  * Fix memory leaks on error handling paths.
  * fsck.exfat: fix the bug that cannot access space beyond 2TB.</changelog>
  <changelog author="idonmez@suse.com" date="1599480000">- Remove ExclusiveArch, the code compiles on all arches cleanly now.</changelog>
  <changelog author="mvetter@suse.com" date="1599825600">- jsc#SLE-16156: Add exfatprogs to SLE</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619611200">- exfatprogs-libexfat-make-set_bit_le-64-bit-compatible.patch:
  Make set_bit_le() 64-bit compatible (bsc#1184882)</changelog>
</package>
<package pkgid="c8cf2661a13fcee3e505c0e669281d76b7d659654512354a8e9c3c60a15fd38c" name="exfatprogs" arch="ppc64le">
  <version epoch="0" ver="1.0.4" rel="3.3.1"/>
  <changelog author="idonmez@suse.com" date="1587643200">- Initial release on OBS</changelog>
  <changelog author="idonmez@suse.com" date="1589284800">- Update to version 1.0.3
  * libexfat0 library is no longer installed
  * Rename label.exfat to tune.exfat.
  * tune.exfat: change argument style
    (-l option for print level, -L option for setting label)
  * mkfs.exfat: harmonize set volume label option with tune.exfat.
  * Fix the reported build warnings/errors.
  * Add memset to clean garbage in allocation.
  * Fix wrong volume label array size.
  * Open a device using O_EXCL to avoid formatting it while it is mounted.
  * Add man page.</changelog>
  <changelog author="idonmez@suse.com" date="1596456000">- Update to version 1.0.4
  * fsck.exfat: display sector, cluster, and volume sizes in the human
    readable format.
  * fsck.exfat: reduce the elapsed time using read-ahead.
  * mkfs.exfat: generate pseudo unique serials while creating filesystems.
  * mkfs.exfat: add the "-b" option to align the start offset of FAT and
    data clusters.
  * fsck.exfat: repair zero-byte files which have the NoFatChain attribute.
  * Fix memory leaks on error handling paths.
  * fsck.exfat: fix the bug that cannot access space beyond 2TB.</changelog>
  <changelog author="idonmez@suse.com" date="1599480000">- Remove ExclusiveArch, the code compiles on all arches cleanly now.</changelog>
  <changelog author="mvetter@suse.com" date="1599825600">- jsc#SLE-16156: Add exfatprogs to SLE</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619611200">- exfatprogs-libexfat-make-set_bit_le-64-bit-compatible.patch:
  Make set_bit_le() 64-bit compatible (bsc#1184882)</changelog>
</package>
<package pkgid="26e46da0abf131f47775b04f8cf9908695dee3a80566f86c6f32fa514a4abc7e" name="exfatprogs" arch="s390x">
  <version epoch="0" ver="1.0.4" rel="3.3.1"/>
  <changelog author="idonmez@suse.com" date="1587643200">- Initial release on OBS</changelog>
  <changelog author="idonmez@suse.com" date="1589284800">- Update to version 1.0.3
  * libexfat0 library is no longer installed
  * Rename label.exfat to tune.exfat.
  * tune.exfat: change argument style
    (-l option for print level, -L option for setting label)
  * mkfs.exfat: harmonize set volume label option with tune.exfat.
  * Fix the reported build warnings/errors.
  * Add memset to clean garbage in allocation.
  * Fix wrong volume label array size.
  * Open a device using O_EXCL to avoid formatting it while it is mounted.
  * Add man page.</changelog>
  <changelog author="idonmez@suse.com" date="1596456000">- Update to version 1.0.4
  * fsck.exfat: display sector, cluster, and volume sizes in the human
    readable format.
  * fsck.exfat: reduce the elapsed time using read-ahead.
  * mkfs.exfat: generate pseudo unique serials while creating filesystems.
  * mkfs.exfat: add the "-b" option to align the start offset of FAT and
    data clusters.
  * fsck.exfat: repair zero-byte files which have the NoFatChain attribute.
  * Fix memory leaks on error handling paths.
  * fsck.exfat: fix the bug that cannot access space beyond 2TB.</changelog>
  <changelog author="idonmez@suse.com" date="1599480000">- Remove ExclusiveArch, the code compiles on all arches cleanly now.</changelog>
  <changelog author="mvetter@suse.com" date="1599825600">- jsc#SLE-16156: Add exfatprogs to SLE</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619611200">- exfatprogs-libexfat-make-set_bit_le-64-bit-compatible.patch:
  Make set_bit_le() 64-bit compatible (bsc#1184882)</changelog>
</package>
<package pkgid="9f944f8c18c5b4709a28bca21dc18632e610f9f392a673d2587dd1e8d88e2d81" name="exfatprogs" arch="src">
  <version epoch="0" ver="1.0.4" rel="3.3.1"/>
  <changelog author="idonmez@suse.com" date="1587643200">- Initial release on OBS</changelog>
  <changelog author="idonmez@suse.com" date="1589284800">- Update to version 1.0.3
  * libexfat0 library is no longer installed
  * Rename label.exfat to tune.exfat.
  * tune.exfat: change argument style
    (-l option for print level, -L option for setting label)
  * mkfs.exfat: harmonize set volume label option with tune.exfat.
  * Fix the reported build warnings/errors.
  * Add memset to clean garbage in allocation.
  * Fix wrong volume label array size.
  * Open a device using O_EXCL to avoid formatting it while it is mounted.
  * Add man page.</changelog>
  <changelog author="idonmez@suse.com" date="1596456000">- Update to version 1.0.4
  * fsck.exfat: display sector, cluster, and volume sizes in the human
    readable format.
  * fsck.exfat: reduce the elapsed time using read-ahead.
  * mkfs.exfat: generate pseudo unique serials while creating filesystems.
  * mkfs.exfat: add the "-b" option to align the start offset of FAT and
    data clusters.
  * fsck.exfat: repair zero-byte files which have the NoFatChain attribute.
  * Fix memory leaks on error handling paths.
  * fsck.exfat: fix the bug that cannot access space beyond 2TB.</changelog>
  <changelog author="idonmez@suse.com" date="1599480000">- Remove ExclusiveArch, the code compiles on all arches cleanly now.</changelog>
  <changelog author="mvetter@suse.com" date="1599825600">- jsc#SLE-16156: Add exfatprogs to SLE</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619611200">- exfatprogs-libexfat-make-set_bit_le-64-bit-compatible.patch:
  Make set_bit_le() 64-bit compatible (bsc#1184882)</changelog>
</package>
<package pkgid="693069578958b6fc9ee2ebbccc9dcb1312cc0f95694c662cfc7a29d4a4e69709" name="exfatprogs" arch="x86_64">
  <version epoch="0" ver="1.0.4" rel="3.3.1"/>
  <changelog author="idonmez@suse.com" date="1587643200">- Initial release on OBS</changelog>
  <changelog author="idonmez@suse.com" date="1589284800">- Update to version 1.0.3
  * libexfat0 library is no longer installed
  * Rename label.exfat to tune.exfat.
  * tune.exfat: change argument style
    (-l option for print level, -L option for setting label)
  * mkfs.exfat: harmonize set volume label option with tune.exfat.
  * Fix the reported build warnings/errors.
  * Add memset to clean garbage in allocation.
  * Fix wrong volume label array size.
  * Open a device using O_EXCL to avoid formatting it while it is mounted.
  * Add man page.</changelog>
  <changelog author="idonmez@suse.com" date="1596456000">- Update to version 1.0.4
  * fsck.exfat: display sector, cluster, and volume sizes in the human
    readable format.
  * fsck.exfat: reduce the elapsed time using read-ahead.
  * mkfs.exfat: generate pseudo unique serials while creating filesystems.
  * mkfs.exfat: add the "-b" option to align the start offset of FAT and
    data clusters.
  * fsck.exfat: repair zero-byte files which have the NoFatChain attribute.
  * Fix memory leaks on error handling paths.
  * fsck.exfat: fix the bug that cannot access space beyond 2TB.</changelog>
  <changelog author="idonmez@suse.com" date="1599480000">- Remove ExclusiveArch, the code compiles on all arches cleanly now.</changelog>
  <changelog author="mvetter@suse.com" date="1599825600">- jsc#SLE-16156: Add exfatprogs to SLE</changelog>
  <changelog author="rgoldwyn@suse.com" date="1619611200">- exfatprogs-libexfat-make-set_bit_le-64-bit-compatible.patch:
  Make set_bit_le() 64-bit compatible (bsc#1184882)</changelog>
</package>
<package pkgid="08dfd1dbc5531ffd6dcc651e56aa94c25950ede335ccb115265fe5c1bd3fbfd8" name="expect" arch="aarch64">
  <version epoch="0" ver="5.45.4" rel="3.3.1"/>
  <changelog author="schwab@linux-m68k.org" date="1334404800">- Remove execute permission from logfiles</changelog>
  <changelog author="schwab@suse.de" date="1360152000">- Update config.guess/sub for aarch64</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="max@suse.com" date="1437134400">- Don't ship the 'weather' example anymore (fate#318342).</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- New version 5.45.3:
  * expect.c: On finding a full buffer during matching the sliding
    window mechanism slides too far, truncating the whole buffer and
    preventing matches across the boundary. Fix is shortening the
    slide distance (slide only one 1/3).
  * expect.c: Replaced a cc==0 check with proper Tcl_Eof() check.
- Includes changes from 5.45.2:
  * configure: Extended Tcl header detection for OS X Mountain Lion.
  * expect.c: Replaced memcpy with memmove to properly handle
    overlapping memory.
- Includes changes from 5.45.1:
  * exp_chan.c: Fix a problem when talking a tty where the writer
    dies. Some operating systems report the condition as EIO with
    nothing read, while this actually an EOF. Previously, returned
    data was incomplete due to the error causing data in buffers to
    be dropped.
  * exp_chan.c: Fix a problem with the iteration over the expect
    channel list where the loop code may modify the list, breaking
    the iterator.
  * Fixes for exp_chan.c and exp_command.h
  * expect.c: Convert #bytes information to #chars to prevent later
    code to fail when copying strings around and miscalculating how
    much to copy, for strings containing non-ASCII utf chars.
  * exp_inter.c: Hack access to TCL_REG_BOSONLY when not present,
    became private with Tcl 8.5 and higher.
  * expect.h: Remove the local fiddling with the memory allocation
    and panic macros.
  * example/unbuffer: Prevent unbuffer from swallowing exit code of
    the command it ran (regular mode only, not -p)
  * Various deduplications and cleanups
- cleanup with spec-cleaner
- use %make_install macro</changelog>
  <changelog author="max@suse.com" date="1540468800">- New version 5.45.4:
  * Fix two bugs in EOF handling.</changelog>
  <changelog author="max@suse.com" date="1602763200">- Add an unversioned symlink to make linking easier for
  applications that use libexpect without Tcl (boo#1172681).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- pass explicit -pie flag to CFLAGS and hack `make` invocation so that
  /usr/bin/expect actually becomes a PIE binary. This is especially awkard
  since the expect build system implicitly passes -fPIC which breaks our
  gcc-PIE package, but does not pass -pie while linking the executable.
  Shared libraries are also not linked with -shared so we need to explicitly
  pass this, too, to avoid build breakage (bsc#1184122).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1620129600">- fix previous change regarding PIE linking. Passing SHLIB_CFLAGS="-shared"
  causes /usr/bin/expect to become a shared library that SEGFAULTs upon
  execution. Instead use SHLIB_LD to pass -shared only to shared library
  linking.</changelog>
  <changelog author="max@suse.com" date="1620648000">- bsc#1183904, expect-errorfd.patch:
  errorfd file descriptors should be closed when forking</changelog>
</package>
<package pkgid="39d29e782f41f1c7de1207b47c460724a87e3f468322ce100dc2245ac55eab56" name="expect" arch="ppc64le">
  <version epoch="0" ver="5.45.4" rel="3.3.1"/>
  <changelog author="schwab@linux-m68k.org" date="1334404800">- Remove execute permission from logfiles</changelog>
  <changelog author="schwab@suse.de" date="1360152000">- Update config.guess/sub for aarch64</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="max@suse.com" date="1437134400">- Don't ship the 'weather' example anymore (fate#318342).</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- New version 5.45.3:
  * expect.c: On finding a full buffer during matching the sliding
    window mechanism slides too far, truncating the whole buffer and
    preventing matches across the boundary. Fix is shortening the
    slide distance (slide only one 1/3).
  * expect.c: Replaced a cc==0 check with proper Tcl_Eof() check.
- Includes changes from 5.45.2:
  * configure: Extended Tcl header detection for OS X Mountain Lion.
  * expect.c: Replaced memcpy with memmove to properly handle
    overlapping memory.
- Includes changes from 5.45.1:
  * exp_chan.c: Fix a problem when talking a tty where the writer
    dies. Some operating systems report the condition as EIO with
    nothing read, while this actually an EOF. Previously, returned
    data was incomplete due to the error causing data in buffers to
    be dropped.
  * exp_chan.c: Fix a problem with the iteration over the expect
    channel list where the loop code may modify the list, breaking
    the iterator.
  * Fixes for exp_chan.c and exp_command.h
  * expect.c: Convert #bytes information to #chars to prevent later
    code to fail when copying strings around and miscalculating how
    much to copy, for strings containing non-ASCII utf chars.
  * exp_inter.c: Hack access to TCL_REG_BOSONLY when not present,
    became private with Tcl 8.5 and higher.
  * expect.h: Remove the local fiddling with the memory allocation
    and panic macros.
  * example/unbuffer: Prevent unbuffer from swallowing exit code of
    the command it ran (regular mode only, not -p)
  * Various deduplications and cleanups
- cleanup with spec-cleaner
- use %make_install macro</changelog>
  <changelog author="max@suse.com" date="1540468800">- New version 5.45.4:
  * Fix two bugs in EOF handling.</changelog>
  <changelog author="max@suse.com" date="1602763200">- Add an unversioned symlink to make linking easier for
  applications that use libexpect without Tcl (boo#1172681).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- pass explicit -pie flag to CFLAGS and hack `make` invocation so that
  /usr/bin/expect actually becomes a PIE binary. This is especially awkard
  since the expect build system implicitly passes -fPIC which breaks our
  gcc-PIE package, but does not pass -pie while linking the executable.
  Shared libraries are also not linked with -shared so we need to explicitly
  pass this, too, to avoid build breakage (bsc#1184122).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1620129600">- fix previous change regarding PIE linking. Passing SHLIB_CFLAGS="-shared"
  causes /usr/bin/expect to become a shared library that SEGFAULTs upon
  execution. Instead use SHLIB_LD to pass -shared only to shared library
  linking.</changelog>
  <changelog author="max@suse.com" date="1620648000">- bsc#1183904, expect-errorfd.patch:
  errorfd file descriptors should be closed when forking</changelog>
</package>
<package pkgid="819649a509fe4d1592daf20f6623a669cbb5ef6aa8bd35fb06c2dc1c6fb6d76d" name="expect" arch="s390x">
  <version epoch="0" ver="5.45.4" rel="3.3.1"/>
  <changelog author="schwab@linux-m68k.org" date="1334404800">- Remove execute permission from logfiles</changelog>
  <changelog author="schwab@suse.de" date="1360152000">- Update config.guess/sub for aarch64</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="max@suse.com" date="1437134400">- Don't ship the 'weather' example anymore (fate#318342).</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- New version 5.45.3:
  * expect.c: On finding a full buffer during matching the sliding
    window mechanism slides too far, truncating the whole buffer and
    preventing matches across the boundary. Fix is shortening the
    slide distance (slide only one 1/3).
  * expect.c: Replaced a cc==0 check with proper Tcl_Eof() check.
- Includes changes from 5.45.2:
  * configure: Extended Tcl header detection for OS X Mountain Lion.
  * expect.c: Replaced memcpy with memmove to properly handle
    overlapping memory.
- Includes changes from 5.45.1:
  * exp_chan.c: Fix a problem when talking a tty where the writer
    dies. Some operating systems report the condition as EIO with
    nothing read, while this actually an EOF. Previously, returned
    data was incomplete due to the error causing data in buffers to
    be dropped.
  * exp_chan.c: Fix a problem with the iteration over the expect
    channel list where the loop code may modify the list, breaking
    the iterator.
  * Fixes for exp_chan.c and exp_command.h
  * expect.c: Convert #bytes information to #chars to prevent later
    code to fail when copying strings around and miscalculating how
    much to copy, for strings containing non-ASCII utf chars.
  * exp_inter.c: Hack access to TCL_REG_BOSONLY when not present,
    became private with Tcl 8.5 and higher.
  * expect.h: Remove the local fiddling with the memory allocation
    and panic macros.
  * example/unbuffer: Prevent unbuffer from swallowing exit code of
    the command it ran (regular mode only, not -p)
  * Various deduplications and cleanups
- cleanup with spec-cleaner
- use %make_install macro</changelog>
  <changelog author="max@suse.com" date="1540468800">- New version 5.45.4:
  * Fix two bugs in EOF handling.</changelog>
  <changelog author="max@suse.com" date="1602763200">- Add an unversioned symlink to make linking easier for
  applications that use libexpect without Tcl (boo#1172681).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- pass explicit -pie flag to CFLAGS and hack `make` invocation so that
  /usr/bin/expect actually becomes a PIE binary. This is especially awkard
  since the expect build system implicitly passes -fPIC which breaks our
  gcc-PIE package, but does not pass -pie while linking the executable.
  Shared libraries are also not linked with -shared so we need to explicitly
  pass this, too, to avoid build breakage (bsc#1184122).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1620129600">- fix previous change regarding PIE linking. Passing SHLIB_CFLAGS="-shared"
  causes /usr/bin/expect to become a shared library that SEGFAULTs upon
  execution. Instead use SHLIB_LD to pass -shared only to shared library
  linking.</changelog>
  <changelog author="max@suse.com" date="1620648000">- bsc#1183904, expect-errorfd.patch:
  errorfd file descriptors should be closed when forking</changelog>
</package>
<package pkgid="17c7261fae0f8fae337c75e98f3ec500b20905cc872a8d2a3d7732e180d1687d" name="expect" arch="src">
  <version epoch="0" ver="5.45.4" rel="3.3.1"/>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="max@suse.de" date="1206014400">- Update to version 5.44.1.5 from CVS:
  * Improved internal buffer management
  * Ported script-level commands to the newer Tcl object API
  * Optimized regular expression matching
- Split off a -devel subpackage
- Don't package the example subdir anymore.
- Fix all critical and part of the non-critical warnings that
  show up with gcc 4.3. To be continued...</changelog>
  <changelog author="max@suse.de" date="1207224000">- Fixed swapped arguments in prototype of exp_cmd_init()
- Adjusted installation to the new Tcl file system layout</changelog>
  <changelog author="aj@suse.de" date="1210075200">- Add missing return values.</changelog>
  <changelog author="meissner@suse.de" date="1223985600">- fixed fortify implicits.</changelog>
  <changelog author="max@suse.de" date="1223985601">- Update to version 5.44.1.11 from CVS. The changes mainly consist
  of our former expect-fixes.patch and expect-warnings.patch, plus
  some more bug fixes, e.g. for the [expect -exact] crash reported
  at bnc#427270 .</changelog>
  <changelog author="max@suse.de" date="1243252800">- Fix buffer overflow in the "stty" command
  (bnc#506873, bnc#501291).</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Remove redundant/obsolete tags/sections from specfile
  (cf. packaging guidelines)
- Use %_smp_mflags for parallel build</changelog>
  <changelog author="max@suse.com" date="1317988800">- New version 5.45:
  * Examples now use the expect package instead of /usr/bin/expect.
  * Countless other bug fixes. For details, see
    /usr/share/doc/packages/expect/ChangeLog</changelog>
  <changelog author="coolo@suse.com" date="1324382400">- add autoconf as buildrequire to avoid implicit dependency</changelog>
  <changelog author="schwab@linux-m68k.org" date="1334404800">- Remove execute permission from logfiles</changelog>
  <changelog author="schwab@suse.de" date="1360152000">- Update config.guess/sub for aarch64</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="max@suse.com" date="1437134400">- Don't ship the 'weather' example anymore (fate#318342).</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- New version 5.45.3:
  * expect.c: On finding a full buffer during matching the sliding
    window mechanism slides too far, truncating the whole buffer and
    preventing matches across the boundary. Fix is shortening the
    slide distance (slide only one 1/3).
  * expect.c: Replaced a cc==0 check with proper Tcl_Eof() check.
- Includes changes from 5.45.2:
  * configure: Extended Tcl header detection for OS X Mountain Lion.
  * expect.c: Replaced memcpy with memmove to properly handle
    overlapping memory.
- Includes changes from 5.45.1:
  * exp_chan.c: Fix a problem when talking a tty where the writer
    dies. Some operating systems report the condition as EIO with
    nothing read, while this actually an EOF. Previously, returned
    data was incomplete due to the error causing data in buffers to
    be dropped.
  * exp_chan.c: Fix a problem with the iteration over the expect
    channel list where the loop code may modify the list, breaking
    the iterator.
  * Fixes for exp_chan.c and exp_command.h
  * expect.c: Convert #bytes information to #chars to prevent later
    code to fail when copying strings around and miscalculating how
    much to copy, for strings containing non-ASCII utf chars.
  * exp_inter.c: Hack access to TCL_REG_BOSONLY when not present,
    became private with Tcl 8.5 and higher.
  * expect.h: Remove the local fiddling with the memory allocation
    and panic macros.
  * example/unbuffer: Prevent unbuffer from swallowing exit code of
    the command it ran (regular mode only, not -p)
  * Various deduplications and cleanups
- cleanup with spec-cleaner
- use %make_install macro</changelog>
  <changelog author="max@suse.com" date="1540468800">- New version 5.45.4:
  * Fix two bugs in EOF handling.</changelog>
  <changelog author="max@suse.com" date="1602763200">- Add an unversioned symlink to make linking easier for
  applications that use libexpect without Tcl (boo#1172681).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- pass explicit -pie flag to CFLAGS and hack `make` invocation so that
  /usr/bin/expect actually becomes a PIE binary. This is especially awkard
  since the expect build system implicitly passes -fPIC which breaks our
  gcc-PIE package, but does not pass -pie while linking the executable.
  Shared libraries are also not linked with -shared so we need to explicitly
  pass this, too, to avoid build breakage (bsc#1184122).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1620129600">- fix previous change regarding PIE linking. Passing SHLIB_CFLAGS="-shared"
  causes /usr/bin/expect to become a shared library that SEGFAULTs upon
  execution. Instead use SHLIB_LD to pass -shared only to shared library
  linking.</changelog>
  <changelog author="max@suse.com" date="1620648000">- bsc#1183904, expect-errorfd.patch:
  errorfd file descriptors should be closed when forking</changelog>
</package>
<package pkgid="3c7e64886c205b0dd015c25057463c23a4eb9f737416580a2ed80decfbc13d3a" name="expect" arch="x86_64">
  <version epoch="0" ver="5.45.4" rel="3.3.1"/>
  <changelog author="schwab@linux-m68k.org" date="1334404800">- Remove execute permission from logfiles</changelog>
  <changelog author="schwab@suse.de" date="1360152000">- Update config.guess/sub for aarch64</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="max@suse.com" date="1437134400">- Don't ship the 'weather' example anymore (fate#318342).</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- New version 5.45.3:
  * expect.c: On finding a full buffer during matching the sliding
    window mechanism slides too far, truncating the whole buffer and
    preventing matches across the boundary. Fix is shortening the
    slide distance (slide only one 1/3).
  * expect.c: Replaced a cc==0 check with proper Tcl_Eof() check.
- Includes changes from 5.45.2:
  * configure: Extended Tcl header detection for OS X Mountain Lion.
  * expect.c: Replaced memcpy with memmove to properly handle
    overlapping memory.
- Includes changes from 5.45.1:
  * exp_chan.c: Fix a problem when talking a tty where the writer
    dies. Some operating systems report the condition as EIO with
    nothing read, while this actually an EOF. Previously, returned
    data was incomplete due to the error causing data in buffers to
    be dropped.
  * exp_chan.c: Fix a problem with the iteration over the expect
    channel list where the loop code may modify the list, breaking
    the iterator.
  * Fixes for exp_chan.c and exp_command.h
  * expect.c: Convert #bytes information to #chars to prevent later
    code to fail when copying strings around and miscalculating how
    much to copy, for strings containing non-ASCII utf chars.
  * exp_inter.c: Hack access to TCL_REG_BOSONLY when not present,
    became private with Tcl 8.5 and higher.
  * expect.h: Remove the local fiddling with the memory allocation
    and panic macros.
  * example/unbuffer: Prevent unbuffer from swallowing exit code of
    the command it ran (regular mode only, not -p)
  * Various deduplications and cleanups
- cleanup with spec-cleaner
- use %make_install macro</changelog>
  <changelog author="max@suse.com" date="1540468800">- New version 5.45.4:
  * Fix two bugs in EOF handling.</changelog>
  <changelog author="max@suse.com" date="1602763200">- Add an unversioned symlink to make linking easier for
  applications that use libexpect without Tcl (boo#1172681).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- pass explicit -pie flag to CFLAGS and hack `make` invocation so that
  /usr/bin/expect actually becomes a PIE binary. This is especially awkard
  since the expect build system implicitly passes -fPIC which breaks our
  gcc-PIE package, but does not pass -pie while linking the executable.
  Shared libraries are also not linked with -shared so we need to explicitly
  pass this, too, to avoid build breakage (bsc#1184122).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1620129600">- fix previous change regarding PIE linking. Passing SHLIB_CFLAGS="-shared"
  causes /usr/bin/expect to become a shared library that SEGFAULTs upon
  execution. Instead use SHLIB_LD to pass -shared only to shared library
  linking.</changelog>
  <changelog author="max@suse.com" date="1620648000">- bsc#1183904, expect-errorfd.patch:
  errorfd file descriptors should be closed when forking</changelog>
</package>
<package pkgid="0cc177422a8a630d4c3147271dcbd5ede074415a1278076066763718731cba8a" name="expect-devel" arch="aarch64">
  <version epoch="0" ver="5.45.4" rel="3.3.1"/>
  <changelog author="schwab@linux-m68k.org" date="1334404800">- Remove execute permission from logfiles</changelog>
  <changelog author="schwab@suse.de" date="1360152000">- Update config.guess/sub for aarch64</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="max@suse.com" date="1437134400">- Don't ship the 'weather' example anymore (fate#318342).</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- New version 5.45.3:
  * expect.c: On finding a full buffer during matching the sliding
    window mechanism slides too far, truncating the whole buffer and
    preventing matches across the boundary. Fix is shortening the
    slide distance (slide only one 1/3).
  * expect.c: Replaced a cc==0 check with proper Tcl_Eof() check.
- Includes changes from 5.45.2:
  * configure: Extended Tcl header detection for OS X Mountain Lion.
  * expect.c: Replaced memcpy with memmove to properly handle
    overlapping memory.
- Includes changes from 5.45.1:
  * exp_chan.c: Fix a problem when talking a tty where the writer
    dies. Some operating systems report the condition as EIO with
    nothing read, while this actually an EOF. Previously, returned
    data was incomplete due to the error causing data in buffers to
    be dropped.
  * exp_chan.c: Fix a problem with the iteration over the expect
    channel list where the loop code may modify the list, breaking
    the iterator.
  * Fixes for exp_chan.c and exp_command.h
  * expect.c: Convert #bytes information to #chars to prevent later
    code to fail when copying strings around and miscalculating how
    much to copy, for strings containing non-ASCII utf chars.
  * exp_inter.c: Hack access to TCL_REG_BOSONLY when not present,
    became private with Tcl 8.5 and higher.
  * expect.h: Remove the local fiddling with the memory allocation
    and panic macros.
  * example/unbuffer: Prevent unbuffer from swallowing exit code of
    the command it ran (regular mode only, not -p)
  * Various deduplications and cleanups
- cleanup with spec-cleaner
- use %make_install macro</changelog>
  <changelog author="max@suse.com" date="1540468800">- New version 5.45.4:
  * Fix two bugs in EOF handling.</changelog>
  <changelog author="max@suse.com" date="1602763200">- Add an unversioned symlink to make linking easier for
  applications that use libexpect without Tcl (boo#1172681).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- pass explicit -pie flag to CFLAGS and hack `make` invocation so that
  /usr/bin/expect actually becomes a PIE binary. This is especially awkard
  since the expect build system implicitly passes -fPIC which breaks our
  gcc-PIE package, but does not pass -pie while linking the executable.
  Shared libraries are also not linked with -shared so we need to explicitly
  pass this, too, to avoid build breakage (bsc#1184122).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1620129600">- fix previous change regarding PIE linking. Passing SHLIB_CFLAGS="-shared"
  causes /usr/bin/expect to become a shared library that SEGFAULTs upon
  execution. Instead use SHLIB_LD to pass -shared only to shared library
  linking.</changelog>
  <changelog author="max@suse.com" date="1620648000">- bsc#1183904, expect-errorfd.patch:
  errorfd file descriptors should be closed when forking</changelog>
</package>
<package pkgid="3a746943118bbb9c855f0e06480545c2457b7ad2706cea70843055f00342774c" name="expect-devel" arch="ppc64le">
  <version epoch="0" ver="5.45.4" rel="3.3.1"/>
  <changelog author="schwab@linux-m68k.org" date="1334404800">- Remove execute permission from logfiles</changelog>
  <changelog author="schwab@suse.de" date="1360152000">- Update config.guess/sub for aarch64</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="max@suse.com" date="1437134400">- Don't ship the 'weather' example anymore (fate#318342).</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- New version 5.45.3:
  * expect.c: On finding a full buffer during matching the sliding
    window mechanism slides too far, truncating the whole buffer and
    preventing matches across the boundary. Fix is shortening the
    slide distance (slide only one 1/3).
  * expect.c: Replaced a cc==0 check with proper Tcl_Eof() check.
- Includes changes from 5.45.2:
  * configure: Extended Tcl header detection for OS X Mountain Lion.
  * expect.c: Replaced memcpy with memmove to properly handle
    overlapping memory.
- Includes changes from 5.45.1:
  * exp_chan.c: Fix a problem when talking a tty where the writer
    dies. Some operating systems report the condition as EIO with
    nothing read, while this actually an EOF. Previously, returned
    data was incomplete due to the error causing data in buffers to
    be dropped.
  * exp_chan.c: Fix a problem with the iteration over the expect
    channel list where the loop code may modify the list, breaking
    the iterator.
  * Fixes for exp_chan.c and exp_command.h
  * expect.c: Convert #bytes information to #chars to prevent later
    code to fail when copying strings around and miscalculating how
    much to copy, for strings containing non-ASCII utf chars.
  * exp_inter.c: Hack access to TCL_REG_BOSONLY when not present,
    became private with Tcl 8.5 and higher.
  * expect.h: Remove the local fiddling with the memory allocation
    and panic macros.
  * example/unbuffer: Prevent unbuffer from swallowing exit code of
    the command it ran (regular mode only, not -p)
  * Various deduplications and cleanups
- cleanup with spec-cleaner
- use %make_install macro</changelog>
  <changelog author="max@suse.com" date="1540468800">- New version 5.45.4:
  * Fix two bugs in EOF handling.</changelog>
  <changelog author="max@suse.com" date="1602763200">- Add an unversioned symlink to make linking easier for
  applications that use libexpect without Tcl (boo#1172681).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- pass explicit -pie flag to CFLAGS and hack `make` invocation so that
  /usr/bin/expect actually becomes a PIE binary. This is especially awkard
  since the expect build system implicitly passes -fPIC which breaks our
  gcc-PIE package, but does not pass -pie while linking the executable.
  Shared libraries are also not linked with -shared so we need to explicitly
  pass this, too, to avoid build breakage (bsc#1184122).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1620129600">- fix previous change regarding PIE linking. Passing SHLIB_CFLAGS="-shared"
  causes /usr/bin/expect to become a shared library that SEGFAULTs upon
  execution. Instead use SHLIB_LD to pass -shared only to shared library
  linking.</changelog>
  <changelog author="max@suse.com" date="1620648000">- bsc#1183904, expect-errorfd.patch:
  errorfd file descriptors should be closed when forking</changelog>
</package>
<package pkgid="100c719f221b39decd29264788c40e88600fb6e4aec05c4000740b7dd0f42f21" name="expect-devel" arch="s390x">
  <version epoch="0" ver="5.45.4" rel="3.3.1"/>
  <changelog author="schwab@linux-m68k.org" date="1334404800">- Remove execute permission from logfiles</changelog>
  <changelog author="schwab@suse.de" date="1360152000">- Update config.guess/sub for aarch64</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="max@suse.com" date="1437134400">- Don't ship the 'weather' example anymore (fate#318342).</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- New version 5.45.3:
  * expect.c: On finding a full buffer during matching the sliding
    window mechanism slides too far, truncating the whole buffer and
    preventing matches across the boundary. Fix is shortening the
    slide distance (slide only one 1/3).
  * expect.c: Replaced a cc==0 check with proper Tcl_Eof() check.
- Includes changes from 5.45.2:
  * configure: Extended Tcl header detection for OS X Mountain Lion.
  * expect.c: Replaced memcpy with memmove to properly handle
    overlapping memory.
- Includes changes from 5.45.1:
  * exp_chan.c: Fix a problem when talking a tty where the writer
    dies. Some operating systems report the condition as EIO with
    nothing read, while this actually an EOF. Previously, returned
    data was incomplete due to the error causing data in buffers to
    be dropped.
  * exp_chan.c: Fix a problem with the iteration over the expect
    channel list where the loop code may modify the list, breaking
    the iterator.
  * Fixes for exp_chan.c and exp_command.h
  * expect.c: Convert #bytes information to #chars to prevent later
    code to fail when copying strings around and miscalculating how
    much to copy, for strings containing non-ASCII utf chars.
  * exp_inter.c: Hack access to TCL_REG_BOSONLY when not present,
    became private with Tcl 8.5 and higher.
  * expect.h: Remove the local fiddling with the memory allocation
    and panic macros.
  * example/unbuffer: Prevent unbuffer from swallowing exit code of
    the command it ran (regular mode only, not -p)
  * Various deduplications and cleanups
- cleanup with spec-cleaner
- use %make_install macro</changelog>
  <changelog author="max@suse.com" date="1540468800">- New version 5.45.4:
  * Fix two bugs in EOF handling.</changelog>
  <changelog author="max@suse.com" date="1602763200">- Add an unversioned symlink to make linking easier for
  applications that use libexpect without Tcl (boo#1172681).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- pass explicit -pie flag to CFLAGS and hack `make` invocation so that
  /usr/bin/expect actually becomes a PIE binary. This is especially awkard
  since the expect build system implicitly passes -fPIC which breaks our
  gcc-PIE package, but does not pass -pie while linking the executable.
  Shared libraries are also not linked with -shared so we need to explicitly
  pass this, too, to avoid build breakage (bsc#1184122).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1620129600">- fix previous change regarding PIE linking. Passing SHLIB_CFLAGS="-shared"
  causes /usr/bin/expect to become a shared library that SEGFAULTs upon
  execution. Instead use SHLIB_LD to pass -shared only to shared library
  linking.</changelog>
  <changelog author="max@suse.com" date="1620648000">- bsc#1183904, expect-errorfd.patch:
  errorfd file descriptors should be closed when forking</changelog>
</package>
<package pkgid="c9b7921d36134e9f6fc086cbff2333993cd63ea9d9ac2455e3ce43b7283a344b" name="expect-devel" arch="x86_64">
  <version epoch="0" ver="5.45.4" rel="3.3.1"/>
  <changelog author="schwab@linux-m68k.org" date="1334404800">- Remove execute permission from logfiles</changelog>
  <changelog author="schwab@suse.de" date="1360152000">- Update config.guess/sub for aarch64</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="max@suse.com" date="1437134400">- Don't ship the 'weather' example anymore (fate#318342).</changelog>
  <changelog author="aavindraa@gmail.com" date="1510142400">- New version 5.45.3:
  * expect.c: On finding a full buffer during matching the sliding
    window mechanism slides too far, truncating the whole buffer and
    preventing matches across the boundary. Fix is shortening the
    slide distance (slide only one 1/3).
  * expect.c: Replaced a cc==0 check with proper Tcl_Eof() check.
- Includes changes from 5.45.2:
  * configure: Extended Tcl header detection for OS X Mountain Lion.
  * expect.c: Replaced memcpy with memmove to properly handle
    overlapping memory.
- Includes changes from 5.45.1:
  * exp_chan.c: Fix a problem when talking a tty where the writer
    dies. Some operating systems report the condition as EIO with
    nothing read, while this actually an EOF. Previously, returned
    data was incomplete due to the error causing data in buffers to
    be dropped.
  * exp_chan.c: Fix a problem with the iteration over the expect
    channel list where the loop code may modify the list, breaking
    the iterator.
  * Fixes for exp_chan.c and exp_command.h
  * expect.c: Convert #bytes information to #chars to prevent later
    code to fail when copying strings around and miscalculating how
    much to copy, for strings containing non-ASCII utf chars.
  * exp_inter.c: Hack access to TCL_REG_BOSONLY when not present,
    became private with Tcl 8.5 and higher.
  * expect.h: Remove the local fiddling with the memory allocation
    and panic macros.
  * example/unbuffer: Prevent unbuffer from swallowing exit code of
    the command it ran (regular mode only, not -p)
  * Various deduplications and cleanups
- cleanup with spec-cleaner
- use %make_install macro</changelog>
  <changelog author="max@suse.com" date="1540468800">- New version 5.45.4:
  * Fix two bugs in EOF handling.</changelog>
  <changelog author="max@suse.com" date="1602763200">- Add an unversioned symlink to make linking easier for
  applications that use libexpect without Tcl (boo#1172681).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619006400">- pass explicit -pie flag to CFLAGS and hack `make` invocation so that
  /usr/bin/expect actually becomes a PIE binary. This is especially awkard
  since the expect build system implicitly passes -fPIC which breaks our
  gcc-PIE package, but does not pass -pie while linking the executable.
  Shared libraries are also not linked with -shared so we need to explicitly
  pass this, too, to avoid build breakage (bsc#1184122).</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1620129600">- fix previous change regarding PIE linking. Passing SHLIB_CFLAGS="-shared"
  causes /usr/bin/expect to become a shared library that SEGFAULTs upon
  execution. Instead use SHLIB_LD to pass -shared only to shared library
  linking.</changelog>
  <changelog author="max@suse.com" date="1620648000">- bsc#1183904, expect-errorfd.patch:
  errorfd file descriptors should be closed when forking</changelog>
</package>
<package pkgid="caa4f4c5a6065fa733886d7fe475e61943eeb3093d2e2dec01050a4797be876b" name="fastjar" arch="aarch64">
  <version epoch="0" ver="0.98" rel="3.6.2"/>
  <changelog author="rguenther@suse.de" date="1154952000">- Update fix for 191845 to upstream version.</changelog>
  <changelog author="rguenther@suse.de" date="1175169600">- Add zlib-devel BuildRequires.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1218628800">- Update to 0.95
  - included an fix of a directory traversal to parents of the extraction root.
  - some fixes in build system - Makefile.{am,in}, configure.ac, ...
  - enable fastjar to update an existing .jar with an META-INF/INDEX.LIST aka
  - i support. Still, it doesn't process the MANIFEST.MF to index files
    coming from dependant archives.
  - use '\n' instead of '\0' before adding the index to the jar file to avoid
    having a zero byte at the end of the index file.
  - Fallback on the method used for non-seekable files when reading the
    central-header-end section does not work, i.e. in archives with a zipfile
    comment at the end.
  - Added support for native libraries for libfastjar.
  - jartool.c: Include regex.h, as recommended by  gnulib-tool for the gnulib
    getopt functionality</changelog>
  <changelog author="rguenther@novell.com" date="1267444800">- Update to 0.98
  - added support for -J and @file options.
  - fixed file name extraction, so that it can now be used during OpenJDK build.
- Fix unterminated filenames on archive update.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1274788800">- fix bnc#607043 - fastjar directory traversal</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Apply packaging guidelines (remove redundant/obsolete
  tags/sections from specfile, etc.)</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1428840000">- Cleanup spec file with spec-clenaner
- Correct info scriplet requirements</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Apply patches from debian to be up-par:
  * fix-update-mode.diff
  * jartool.diff
- Remove patch fastjar-0.98-fix.patch
  * Merged in jartool.diff
- Remove patch fastjar-0.98-directory-traversal.patch
  * Merged in jartool.diff</changelog>
  <changelog author="pmonreal@suse.com" date="1627041600">- Add reference for CVE-2010-2322 [bsc#1188517, CVE-2010-2322]
  * Directory traversal vulnerabilities
  * Rename jartool.diff to fastjar-CVE-2010-2322.patch</changelog>
</package>
<package pkgid="07f0e668247b1bf174a624ef951dd3e097e6a5c47f91a9f76c03f4efc5bcd801" name="fastjar" arch="ppc64le">
  <version epoch="0" ver="0.98" rel="3.6.2"/>
  <changelog author="rguenther@suse.de" date="1154952000">- Update fix for 191845 to upstream version.</changelog>
  <changelog author="rguenther@suse.de" date="1175169600">- Add zlib-devel BuildRequires.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1218628800">- Update to 0.95
  - included an fix of a directory traversal to parents of the extraction root.
  - some fixes in build system - Makefile.{am,in}, configure.ac, ...
  - enable fastjar to update an existing .jar with an META-INF/INDEX.LIST aka
  - i support. Still, it doesn't process the MANIFEST.MF to index files
    coming from dependant archives.
  - use '\n' instead of '\0' before adding the index to the jar file to avoid
    having a zero byte at the end of the index file.
  - Fallback on the method used for non-seekable files when reading the
    central-header-end section does not work, i.e. in archives with a zipfile
    comment at the end.
  - Added support for native libraries for libfastjar.
  - jartool.c: Include regex.h, as recommended by  gnulib-tool for the gnulib
    getopt functionality</changelog>
  <changelog author="rguenther@novell.com" date="1267444800">- Update to 0.98
  - added support for -J and @file options.
  - fixed file name extraction, so that it can now be used during OpenJDK build.
- Fix unterminated filenames on archive update.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1274788800">- fix bnc#607043 - fastjar directory traversal</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Apply packaging guidelines (remove redundant/obsolete
  tags/sections from specfile, etc.)</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1428840000">- Cleanup spec file with spec-clenaner
- Correct info scriplet requirements</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Apply patches from debian to be up-par:
  * fix-update-mode.diff
  * jartool.diff
- Remove patch fastjar-0.98-fix.patch
  * Merged in jartool.diff
- Remove patch fastjar-0.98-directory-traversal.patch
  * Merged in jartool.diff</changelog>
  <changelog author="pmonreal@suse.com" date="1627041600">- Add reference for CVE-2010-2322 [bsc#1188517, CVE-2010-2322]
  * Directory traversal vulnerabilities
  * Rename jartool.diff to fastjar-CVE-2010-2322.patch</changelog>
</package>
<package pkgid="985711d29c02bb97ede4468525ebef757ccd19104754270e885f141c54b44998" name="fastjar" arch="s390x">
  <version epoch="0" ver="0.98" rel="3.6.2"/>
  <changelog author="rguenther@suse.de" date="1154952000">- Update fix for 191845 to upstream version.</changelog>
  <changelog author="rguenther@suse.de" date="1175169600">- Add zlib-devel BuildRequires.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1218628800">- Update to 0.95
  - included an fix of a directory traversal to parents of the extraction root.
  - some fixes in build system - Makefile.{am,in}, configure.ac, ...
  - enable fastjar to update an existing .jar with an META-INF/INDEX.LIST aka
  - i support. Still, it doesn't process the MANIFEST.MF to index files
    coming from dependant archives.
  - use '\n' instead of '\0' before adding the index to the jar file to avoid
    having a zero byte at the end of the index file.
  - Fallback on the method used for non-seekable files when reading the
    central-header-end section does not work, i.e. in archives with a zipfile
    comment at the end.
  - Added support for native libraries for libfastjar.
  - jartool.c: Include regex.h, as recommended by  gnulib-tool for the gnulib
    getopt functionality</changelog>
  <changelog author="rguenther@novell.com" date="1267444800">- Update to 0.98
  - added support for -J and @file options.
  - fixed file name extraction, so that it can now be used during OpenJDK build.
- Fix unterminated filenames on archive update.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1274788800">- fix bnc#607043 - fastjar directory traversal</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Apply packaging guidelines (remove redundant/obsolete
  tags/sections from specfile, etc.)</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1428840000">- Cleanup spec file with spec-clenaner
- Correct info scriplet requirements</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Apply patches from debian to be up-par:
  * fix-update-mode.diff
  * jartool.diff
- Remove patch fastjar-0.98-fix.patch
  * Merged in jartool.diff
- Remove patch fastjar-0.98-directory-traversal.patch
  * Merged in jartool.diff</changelog>
  <changelog author="pmonreal@suse.com" date="1627041600">- Add reference for CVE-2010-2322 [bsc#1188517, CVE-2010-2322]
  * Directory traversal vulnerabilities
  * Rename jartool.diff to fastjar-CVE-2010-2322.patch</changelog>
</package>
<package pkgid="2bdc67b5e455e74a2df51587bd8fb0f4c344daca22e433503ff8d850b6f00c6f" name="fastjar" arch="src">
  <version epoch="0" ver="0.98" rel="3.6.2"/>
  <changelog author="rguenther@suse.de" date="1148904000">- New fastjar package from savannah sources.</changelog>
  <changelog author="rguenther@suse.de" date="1152705600">- Fix 191845, directory traversal on unpacking.</changelog>
  <changelog author="rguenther@suse.de" date="1154952000">- Update fix for 191845 to upstream version.</changelog>
  <changelog author="rguenther@suse.de" date="1175169600">- Add zlib-devel BuildRequires.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1218628800">- Update to 0.95
  - included an fix of a directory traversal to parents of the extraction root.
  - some fixes in build system - Makefile.{am,in}, configure.ac, ...
  - enable fastjar to update an existing .jar with an META-INF/INDEX.LIST aka
  - i support. Still, it doesn't process the MANIFEST.MF to index files
    coming from dependant archives.
  - use '\n' instead of '\0' before adding the index to the jar file to avoid
    having a zero byte at the end of the index file.
  - Fallback on the method used for non-seekable files when reading the
    central-header-end section does not work, i.e. in archives with a zipfile
    comment at the end.
  - Added support for native libraries for libfastjar.
  - jartool.c: Include regex.h, as recommended by  gnulib-tool for the gnulib
    getopt functionality</changelog>
  <changelog author="rguenther@novell.com" date="1267444800">- Update to 0.98
  - added support for -J and @file options.
  - fixed file name extraction, so that it can now be used during OpenJDK build.
- Fix unterminated filenames on archive update.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1274788800">- fix bnc#607043 - fastjar directory traversal</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Apply packaging guidelines (remove redundant/obsolete
  tags/sections from specfile, etc.)</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1428840000">- Cleanup spec file with spec-clenaner
- Correct info scriplet requirements</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Apply patches from debian to be up-par:
  * fix-update-mode.diff
  * jartool.diff
- Remove patch fastjar-0.98-fix.patch
  * Merged in jartool.diff
- Remove patch fastjar-0.98-directory-traversal.patch
  * Merged in jartool.diff</changelog>
  <changelog author="pmonreal@suse.com" date="1627041600">- Add reference for CVE-2010-2322 [bsc#1188517, CVE-2010-2322]
  * Directory traversal vulnerabilities
  * Rename jartool.diff to fastjar-CVE-2010-2322.patch</changelog>
</package>
<package pkgid="77c139a1354d5f203113c8e6c1bc7316a34d091da7cd279cdd740f5de44c8b40" name="fastjar" arch="x86_64">
  <version epoch="0" ver="0.98" rel="3.6.2"/>
  <changelog author="rguenther@suse.de" date="1154952000">- Update fix for 191845 to upstream version.</changelog>
  <changelog author="rguenther@suse.de" date="1175169600">- Add zlib-devel BuildRequires.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1218628800">- Update to 0.95
  - included an fix of a directory traversal to parents of the extraction root.
  - some fixes in build system - Makefile.{am,in}, configure.ac, ...
  - enable fastjar to update an existing .jar with an META-INF/INDEX.LIST aka
  - i support. Still, it doesn't process the MANIFEST.MF to index files
    coming from dependant archives.
  - use '\n' instead of '\0' before adding the index to the jar file to avoid
    having a zero byte at the end of the index file.
  - Fallback on the method used for non-seekable files when reading the
    central-header-end section does not work, i.e. in archives with a zipfile
    comment at the end.
  - Added support for native libraries for libfastjar.
  - jartool.c: Include regex.h, as recommended by  gnulib-tool for the gnulib
    getopt functionality</changelog>
  <changelog author="rguenther@novell.com" date="1267444800">- Update to 0.98
  - added support for -J and @file options.
  - fixed file name extraction, so that it can now be used during OpenJDK build.
- Fix unterminated filenames on archive update.</changelog>
  <changelog author="mvyskocil@suse.cz" date="1274788800">- fix bnc#607043 - fastjar directory traversal</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Apply packaging guidelines (remove redundant/obsolete
  tags/sections from specfile, etc.)</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="mpluskal@suse.com" date="1428840000">- Cleanup spec file with spec-clenaner
- Correct info scriplet requirements</changelog>
  <changelog author="tchvatal@suse.com" date="1495195200">- Apply patches from debian to be up-par:
  * fix-update-mode.diff
  * jartool.diff
- Remove patch fastjar-0.98-fix.patch
  * Merged in jartool.diff
- Remove patch fastjar-0.98-directory-traversal.patch
  * Merged in jartool.diff</changelog>
  <changelog author="pmonreal@suse.com" date="1627041600">- Add reference for CVE-2010-2322 [bsc#1188517, CVE-2010-2322]
  * Directory traversal vulnerabilities
  * Rename jartool.diff to fastjar-CVE-2010-2322.patch</changelog>
</package>
<package pkgid="c5a80739274a9b239bff36bf3c37054715f315c181ffa92286aaba9d8edc9d23" name="fcoe-utils" arch="aarch64">
  <version epoch="0" ver="1.0.34" rel="12.3.1"/>
  <changelog author="hare@suse.de" date="1438603200">- Update to version 1.0.30 (FATE#318849)
  * Remove merged patches:
    + 0001-man-Fix-small-typo-regarding-fcf-option.patch
    + 0002-Don-t-call-AM_INIT_AUTOMAKE-twice.patch
    + 0003-fipvlan-fails-on-powerpc.patch
    + 0004-fipvlan-Only-shutdown-interfaces-if-no-vlans-are-cre.patch
    + 0005-fipvlan-start-VLAN-interface-from-netlink-handler.patch
    + 0006-fipvlan-Extract-create_missing_vlan-function-from-lo.patch
    + 0007-fipvlan-create-VLANs-from-netlink-handler.patch
    + 0008-fipvlan-Start-FCoE-from-netlink-handler.patch
    + 0009-fipvlan-Update-wait-loop-to-wait-for-VLANs.patch
    + 0010-fipvlan-Re-send-VLAN-discovery.patch
    + 0011-fipvlan-update-manpage.patch
    + 0012-fipvlan-Leave-link-up-if-requested.patch
    + 0013-fipvlan-Update-manpage-to-reflect-correct-timeout.patch
    + 0014-fipvlan-Do-not-shut-down-FCoE-connections-on-physica.patch
    + 0015-fipvlan-break-out-of-receive-loop-on-error.patch
    + 0016-fipvlan-handle-errors-from-fip-socket-creation.patch
    + 0017-fipvlan-filter-interfaces-from-rtnl_getlink.patch
    + 0018-Add-missing-DESTDIR-when-installing-bash-completion.patch
    + 0019-Fix-build-with-Wl-as-needed.patch
    + 0020-Fix-integer-formatting.patch
    + 0021-fcnsq-Fixup-help-text.patch
    + 0022-fcnsq-Fixup-64bit-integer-handling.patch
    + 0023-fcoemon-add-systemd-service-file.patch
    + 0024-fcoemon-systemd-socket-activation.patch
    + 0025-doc-Update-QUICKSTART-INSTALL-docs-for-systemd-init-.patch
    + 0026-FIPVLAN-Really-break-out-of-the-recv_loop-upon-fip_r.patch
    + 0027-man-Fix-typo-in-fcoemon-documentation.patch
    + 0032-fipvlan-Fix-crash-in-create_and_start_vlan.patch
    + 0033-fipvlan-suppress-warning-interface-already-exists.patch
    + 0034-fipvlan-do-not-crash-on-empty-MAC-address-in-lookup_.patch
  * Add new patches from upstream:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
  * Rename patches:
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0003-systemctl-cannot-start-fcoemon.socket.patch
    + 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
    + 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
    + 0006-fipvlan-fixup-return-value-on-error.patch
    + 0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
    + 0008-Use-correct-socket-for-fcoemon.socket.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1439380800">- Replace libHBAAPI and libhbalinux by new internal implementation (FATE#319021)</changelog>
  <changelog author="jthumshirn@suse.com" date="1439467200">- Fix segmentation fault (bsc#941577)
- Fix display of driver name and version (bsc#941566)</changelog>
  <changelog author="jthumshirn@suse.com" date="1443700800">- Fix enumeration of FCoE connections (bsc#947587)
  + 0018-support-multiple-connections.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1444996800">- Fix erroneous memory free corruption (bsc#950696)
  + 0019-fcping-fix-erroneous-memory-free.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1446465600">- Fix display of NPIV ports (bsc#951859)
  + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1454932800">- Update to version 1.0.31 (FATE#320515)
  * Removed merged patches:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0009-fcoe-utils-Add-sysfs_hba-to-to-fcoemon_utils.patch
    + 0010-fcoeadm-Use-internal-sysfs-based-hba-lib-for-informa.patch
    + 0011-fcoeadm-Use-internal-sysfs-lib-to-display-target-and.patch
    + 0012-fcoeadm-Use-internal-sysfs-lib-to-display-port-stati.patch
    + 0013-fcoeadm-Get-rid-of-some-includes.patch
    + 0014-fcoemon-Use-internal-sysfs_hba-library.patch
    + 0015-libutil-remove-definition-of-sa_hex_format.patch
    + 0016-fcping-Convert-fcping-to-internal-sysfs-based-implem.patch
    + 0017-configure.ac-Remove-libHBAAPIv2-and-libhbalinux2.patch
    + 0018-support-multiple-connections.patch
    + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1466510400">- Don't activate DCB on adapters which do DCB in Hardware (bsc#985816)
  + 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch</changelog>
  <changelog author="hare@suse.de" date="1468497600">- fcoemon cannot start FIP responder (bsc#988887)
  * 0010-fcoemon-fixup-log_nlmsg_error.patch
  * 0011-fcoemon-Add-debugging-message-for-recv.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * 0013-Fallback-to-default-MAC-address-for-FIP.patch
- Rediff patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
- Rename patch
  * old: 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch
  * new: 0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
- Fixup spec file to correctly refer to service_del_postun</changelog>
  <changelog author="jthumshirn@suse.com" date="1477310400">- Fix fcoeadm-t crash when other FC storage is present (bsc#1006027)
  * 0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1486641600">- Update to latest upstream release (FATE#320515)
    Remove the following upstreamed patches:
  0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
  0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
  0010-fcoemon-fixup-log_nlmsg_error.patch
  0011-fcoemon-Add-debugging-message-for-recv.patch
  0013-Fallback-to-default-MAC-address-for-FIP.patch
  0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1491912000">- Disable Werror when building to work around a new GCC 7 warning. (bsc#1030244)
  + 0009-disable-Werror-building.patch</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="dimstar@opensuse.org" date="1560945600">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut by using systemd-devel-mini.</changelog>
  <changelog author="lduncan@suse.com" date="1585915200">- Change use of "ifconfig" to "ip", since ifconfig is no
  longer around (bsc#1073886), adding:
  * fcoe-utils-stop-using-ifconfig.patch</changelog>
  <changelog author="lduncan@suse.com" date="1591704000">- Updated with latest upstream v1.0.33 from v1.0.32:
  * Added "-Wextra" and enabled "-Werror" for compiling
  * Ignore auto-generated files
  * Update systemd service files (several updates)
  * A bunch of gcc-10-related fixes, such as marking unused
    arguments, fixing strncpy()s, string truncation/overflow
  * better error handling/retry for link issues (like EBUSY)
  * replace use of "ifconfig" with "ip" in debug scripts
  * fix long-standing issue with netlink buffer resizing
  * move bash completions to proper system directory
  This replaces fcoe-utils-v1.0.32.tar.xz with
  fcoe-utils-v1.0.33.tar.xz, and it does away with the
  following patches, since they are all fixed upstream:
  * 0003-systemctl-cannot-start-fcoemon.socket.patch
  * 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
  * 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
  * 0008-Use-correct-socket-for-fcoemon.socket.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * fcoe-utils-1.0.29-make.patch
  * fcoe-utils-stop-using-ifconfig.patch
  And the following patch was removed because we can
  successfully compile with "-Werror" now:
  * 0009-disable-Werror-building.patch</changelog>
  <changelog author="lduncan@suse.com" date="1594814400">- Handle NIC names longer than 7 characters for the output of
  "fcoeadm -s" output (bsc#1010047), adding patch:
  * Handle-NIC-names-longer-than-7-characters.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1597924800">- Add patch to fix build on architectures where char is
  unsigned (%arm, aarch64):
  * fcoe-utils-fix-arm.patch</changelog>
  <changelog author="lduncan@suse.com" date="1616673600">- Update to version 1.0.34 (fixing bsc#1182804), which replaces the
  source tarball, and removes these two patches, which are fixed
  upstream:
  * Handle-NIC-names-longer-than-7-characters.patch
  * fcoe-utils-fix-arm.patch
  Change summary:
    Chris Leech (6):
  21 string-op truncation, format truncation, and format overflow errors
  use of uninitialized values detected during LTO
  Revert "Make gcc compiler happy about ifname string truncation."
  fix VLAN device name overflow check
  fix regressions caused by safe_makepath change in libopenfcoe.c
  minor fcoeadm output issues
    Guillaume Gardet (1):
  char can be unsigned on arm, so set signed explicitly as the check expects it can be negative
    Lee Duncan (6):
  Handle NIC names longer than 7 characters.
  Change debug-&gt;log message if daemon running
  Remove references to open-fcoe.org
  Fix two gcc-11 compiler warnings.
  Remove comment that doesn't match code.
  Preparing for version v1.0.34
    Lily Nie (1):
  fix one bug introduced by commit b06c3df
    Nitin U. Yewale (1):
  Exit fcoemon command if fcoemon daemon is already running.</changelog>
</package>
<package pkgid="bac7d9d14891177bcacc04c6f19c958bcfaac54b942cbd33df50d1547b1a7c6d" name="fcoe-utils" arch="ppc64le">
  <version epoch="0" ver="1.0.34" rel="12.3.1"/>
  <changelog author="hare@suse.de" date="1438603200">- Update to version 1.0.30 (FATE#318849)
  * Remove merged patches:
    + 0001-man-Fix-small-typo-regarding-fcf-option.patch
    + 0002-Don-t-call-AM_INIT_AUTOMAKE-twice.patch
    + 0003-fipvlan-fails-on-powerpc.patch
    + 0004-fipvlan-Only-shutdown-interfaces-if-no-vlans-are-cre.patch
    + 0005-fipvlan-start-VLAN-interface-from-netlink-handler.patch
    + 0006-fipvlan-Extract-create_missing_vlan-function-from-lo.patch
    + 0007-fipvlan-create-VLANs-from-netlink-handler.patch
    + 0008-fipvlan-Start-FCoE-from-netlink-handler.patch
    + 0009-fipvlan-Update-wait-loop-to-wait-for-VLANs.patch
    + 0010-fipvlan-Re-send-VLAN-discovery.patch
    + 0011-fipvlan-update-manpage.patch
    + 0012-fipvlan-Leave-link-up-if-requested.patch
    + 0013-fipvlan-Update-manpage-to-reflect-correct-timeout.patch
    + 0014-fipvlan-Do-not-shut-down-FCoE-connections-on-physica.patch
    + 0015-fipvlan-break-out-of-receive-loop-on-error.patch
    + 0016-fipvlan-handle-errors-from-fip-socket-creation.patch
    + 0017-fipvlan-filter-interfaces-from-rtnl_getlink.patch
    + 0018-Add-missing-DESTDIR-when-installing-bash-completion.patch
    + 0019-Fix-build-with-Wl-as-needed.patch
    + 0020-Fix-integer-formatting.patch
    + 0021-fcnsq-Fixup-help-text.patch
    + 0022-fcnsq-Fixup-64bit-integer-handling.patch
    + 0023-fcoemon-add-systemd-service-file.patch
    + 0024-fcoemon-systemd-socket-activation.patch
    + 0025-doc-Update-QUICKSTART-INSTALL-docs-for-systemd-init-.patch
    + 0026-FIPVLAN-Really-break-out-of-the-recv_loop-upon-fip_r.patch
    + 0027-man-Fix-typo-in-fcoemon-documentation.patch
    + 0032-fipvlan-Fix-crash-in-create_and_start_vlan.patch
    + 0033-fipvlan-suppress-warning-interface-already-exists.patch
    + 0034-fipvlan-do-not-crash-on-empty-MAC-address-in-lookup_.patch
  * Add new patches from upstream:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
  * Rename patches:
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0003-systemctl-cannot-start-fcoemon.socket.patch
    + 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
    + 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
    + 0006-fipvlan-fixup-return-value-on-error.patch
    + 0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
    + 0008-Use-correct-socket-for-fcoemon.socket.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1439380800">- Replace libHBAAPI and libhbalinux by new internal implementation (FATE#319021)</changelog>
  <changelog author="jthumshirn@suse.com" date="1439467200">- Fix segmentation fault (bsc#941577)
- Fix display of driver name and version (bsc#941566)</changelog>
  <changelog author="jthumshirn@suse.com" date="1443700800">- Fix enumeration of FCoE connections (bsc#947587)
  + 0018-support-multiple-connections.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1444996800">- Fix erroneous memory free corruption (bsc#950696)
  + 0019-fcping-fix-erroneous-memory-free.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1446465600">- Fix display of NPIV ports (bsc#951859)
  + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1454932800">- Update to version 1.0.31 (FATE#320515)
  * Removed merged patches:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0009-fcoe-utils-Add-sysfs_hba-to-to-fcoemon_utils.patch
    + 0010-fcoeadm-Use-internal-sysfs-based-hba-lib-for-informa.patch
    + 0011-fcoeadm-Use-internal-sysfs-lib-to-display-target-and.patch
    + 0012-fcoeadm-Use-internal-sysfs-lib-to-display-port-stati.patch
    + 0013-fcoeadm-Get-rid-of-some-includes.patch
    + 0014-fcoemon-Use-internal-sysfs_hba-library.patch
    + 0015-libutil-remove-definition-of-sa_hex_format.patch
    + 0016-fcping-Convert-fcping-to-internal-sysfs-based-implem.patch
    + 0017-configure.ac-Remove-libHBAAPIv2-and-libhbalinux2.patch
    + 0018-support-multiple-connections.patch
    + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1466510400">- Don't activate DCB on adapters which do DCB in Hardware (bsc#985816)
  + 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch</changelog>
  <changelog author="hare@suse.de" date="1468497600">- fcoemon cannot start FIP responder (bsc#988887)
  * 0010-fcoemon-fixup-log_nlmsg_error.patch
  * 0011-fcoemon-Add-debugging-message-for-recv.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * 0013-Fallback-to-default-MAC-address-for-FIP.patch
- Rediff patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
- Rename patch
  * old: 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch
  * new: 0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
- Fixup spec file to correctly refer to service_del_postun</changelog>
  <changelog author="jthumshirn@suse.com" date="1477310400">- Fix fcoeadm-t crash when other FC storage is present (bsc#1006027)
  * 0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1486641600">- Update to latest upstream release (FATE#320515)
    Remove the following upstreamed patches:
  0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
  0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
  0010-fcoemon-fixup-log_nlmsg_error.patch
  0011-fcoemon-Add-debugging-message-for-recv.patch
  0013-Fallback-to-default-MAC-address-for-FIP.patch
  0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1491912000">- Disable Werror when building to work around a new GCC 7 warning. (bsc#1030244)
  + 0009-disable-Werror-building.patch</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="dimstar@opensuse.org" date="1560945600">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut by using systemd-devel-mini.</changelog>
  <changelog author="lduncan@suse.com" date="1585915200">- Change use of "ifconfig" to "ip", since ifconfig is no
  longer around (bsc#1073886), adding:
  * fcoe-utils-stop-using-ifconfig.patch</changelog>
  <changelog author="lduncan@suse.com" date="1591704000">- Updated with latest upstream v1.0.33 from v1.0.32:
  * Added "-Wextra" and enabled "-Werror" for compiling
  * Ignore auto-generated files
  * Update systemd service files (several updates)
  * A bunch of gcc-10-related fixes, such as marking unused
    arguments, fixing strncpy()s, string truncation/overflow
  * better error handling/retry for link issues (like EBUSY)
  * replace use of "ifconfig" with "ip" in debug scripts
  * fix long-standing issue with netlink buffer resizing
  * move bash completions to proper system directory
  This replaces fcoe-utils-v1.0.32.tar.xz with
  fcoe-utils-v1.0.33.tar.xz, and it does away with the
  following patches, since they are all fixed upstream:
  * 0003-systemctl-cannot-start-fcoemon.socket.patch
  * 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
  * 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
  * 0008-Use-correct-socket-for-fcoemon.socket.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * fcoe-utils-1.0.29-make.patch
  * fcoe-utils-stop-using-ifconfig.patch
  And the following patch was removed because we can
  successfully compile with "-Werror" now:
  * 0009-disable-Werror-building.patch</changelog>
  <changelog author="lduncan@suse.com" date="1594814400">- Handle NIC names longer than 7 characters for the output of
  "fcoeadm -s" output (bsc#1010047), adding patch:
  * Handle-NIC-names-longer-than-7-characters.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1597924800">- Add patch to fix build on architectures where char is
  unsigned (%arm, aarch64):
  * fcoe-utils-fix-arm.patch</changelog>
  <changelog author="lduncan@suse.com" date="1616673600">- Update to version 1.0.34 (fixing bsc#1182804), which replaces the
  source tarball, and removes these two patches, which are fixed
  upstream:
  * Handle-NIC-names-longer-than-7-characters.patch
  * fcoe-utils-fix-arm.patch
  Change summary:
    Chris Leech (6):
  21 string-op truncation, format truncation, and format overflow errors
  use of uninitialized values detected during LTO
  Revert "Make gcc compiler happy about ifname string truncation."
  fix VLAN device name overflow check
  fix regressions caused by safe_makepath change in libopenfcoe.c
  minor fcoeadm output issues
    Guillaume Gardet (1):
  char can be unsigned on arm, so set signed explicitly as the check expects it can be negative
    Lee Duncan (6):
  Handle NIC names longer than 7 characters.
  Change debug-&gt;log message if daemon running
  Remove references to open-fcoe.org
  Fix two gcc-11 compiler warnings.
  Remove comment that doesn't match code.
  Preparing for version v1.0.34
    Lily Nie (1):
  fix one bug introduced by commit b06c3df
    Nitin U. Yewale (1):
  Exit fcoemon command if fcoemon daemon is already running.</changelog>
</package>
<package pkgid="b4c357df400209c160f0693c61eda4b7ce8963d444c066c9b2ca5a6faa8ed749" name="fcoe-utils" arch="s390x">
  <version epoch="0" ver="1.0.34" rel="12.3.1"/>
  <changelog author="hare@suse.de" date="1438603200">- Update to version 1.0.30 (FATE#318849)
  * Remove merged patches:
    + 0001-man-Fix-small-typo-regarding-fcf-option.patch
    + 0002-Don-t-call-AM_INIT_AUTOMAKE-twice.patch
    + 0003-fipvlan-fails-on-powerpc.patch
    + 0004-fipvlan-Only-shutdown-interfaces-if-no-vlans-are-cre.patch
    + 0005-fipvlan-start-VLAN-interface-from-netlink-handler.patch
    + 0006-fipvlan-Extract-create_missing_vlan-function-from-lo.patch
    + 0007-fipvlan-create-VLANs-from-netlink-handler.patch
    + 0008-fipvlan-Start-FCoE-from-netlink-handler.patch
    + 0009-fipvlan-Update-wait-loop-to-wait-for-VLANs.patch
    + 0010-fipvlan-Re-send-VLAN-discovery.patch
    + 0011-fipvlan-update-manpage.patch
    + 0012-fipvlan-Leave-link-up-if-requested.patch
    + 0013-fipvlan-Update-manpage-to-reflect-correct-timeout.patch
    + 0014-fipvlan-Do-not-shut-down-FCoE-connections-on-physica.patch
    + 0015-fipvlan-break-out-of-receive-loop-on-error.patch
    + 0016-fipvlan-handle-errors-from-fip-socket-creation.patch
    + 0017-fipvlan-filter-interfaces-from-rtnl_getlink.patch
    + 0018-Add-missing-DESTDIR-when-installing-bash-completion.patch
    + 0019-Fix-build-with-Wl-as-needed.patch
    + 0020-Fix-integer-formatting.patch
    + 0021-fcnsq-Fixup-help-text.patch
    + 0022-fcnsq-Fixup-64bit-integer-handling.patch
    + 0023-fcoemon-add-systemd-service-file.patch
    + 0024-fcoemon-systemd-socket-activation.patch
    + 0025-doc-Update-QUICKSTART-INSTALL-docs-for-systemd-init-.patch
    + 0026-FIPVLAN-Really-break-out-of-the-recv_loop-upon-fip_r.patch
    + 0027-man-Fix-typo-in-fcoemon-documentation.patch
    + 0032-fipvlan-Fix-crash-in-create_and_start_vlan.patch
    + 0033-fipvlan-suppress-warning-interface-already-exists.patch
    + 0034-fipvlan-do-not-crash-on-empty-MAC-address-in-lookup_.patch
  * Add new patches from upstream:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
  * Rename patches:
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0003-systemctl-cannot-start-fcoemon.socket.patch
    + 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
    + 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
    + 0006-fipvlan-fixup-return-value-on-error.patch
    + 0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
    + 0008-Use-correct-socket-for-fcoemon.socket.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1439380800">- Replace libHBAAPI and libhbalinux by new internal implementation (FATE#319021)</changelog>
  <changelog author="jthumshirn@suse.com" date="1439467200">- Fix segmentation fault (bsc#941577)
- Fix display of driver name and version (bsc#941566)</changelog>
  <changelog author="jthumshirn@suse.com" date="1443700800">- Fix enumeration of FCoE connections (bsc#947587)
  + 0018-support-multiple-connections.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1444996800">- Fix erroneous memory free corruption (bsc#950696)
  + 0019-fcping-fix-erroneous-memory-free.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1446465600">- Fix display of NPIV ports (bsc#951859)
  + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1454932800">- Update to version 1.0.31 (FATE#320515)
  * Removed merged patches:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0009-fcoe-utils-Add-sysfs_hba-to-to-fcoemon_utils.patch
    + 0010-fcoeadm-Use-internal-sysfs-based-hba-lib-for-informa.patch
    + 0011-fcoeadm-Use-internal-sysfs-lib-to-display-target-and.patch
    + 0012-fcoeadm-Use-internal-sysfs-lib-to-display-port-stati.patch
    + 0013-fcoeadm-Get-rid-of-some-includes.patch
    + 0014-fcoemon-Use-internal-sysfs_hba-library.patch
    + 0015-libutil-remove-definition-of-sa_hex_format.patch
    + 0016-fcping-Convert-fcping-to-internal-sysfs-based-implem.patch
    + 0017-configure.ac-Remove-libHBAAPIv2-and-libhbalinux2.patch
    + 0018-support-multiple-connections.patch
    + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1466510400">- Don't activate DCB on adapters which do DCB in Hardware (bsc#985816)
  + 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch</changelog>
  <changelog author="hare@suse.de" date="1468497600">- fcoemon cannot start FIP responder (bsc#988887)
  * 0010-fcoemon-fixup-log_nlmsg_error.patch
  * 0011-fcoemon-Add-debugging-message-for-recv.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * 0013-Fallback-to-default-MAC-address-for-FIP.patch
- Rediff patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
- Rename patch
  * old: 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch
  * new: 0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
- Fixup spec file to correctly refer to service_del_postun</changelog>
  <changelog author="jthumshirn@suse.com" date="1477310400">- Fix fcoeadm-t crash when other FC storage is present (bsc#1006027)
  * 0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1486641600">- Update to latest upstream release (FATE#320515)
    Remove the following upstreamed patches:
  0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
  0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
  0010-fcoemon-fixup-log_nlmsg_error.patch
  0011-fcoemon-Add-debugging-message-for-recv.patch
  0013-Fallback-to-default-MAC-address-for-FIP.patch
  0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1491912000">- Disable Werror when building to work around a new GCC 7 warning. (bsc#1030244)
  + 0009-disable-Werror-building.patch</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="dimstar@opensuse.org" date="1560945600">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut by using systemd-devel-mini.</changelog>
  <changelog author="lduncan@suse.com" date="1585915200">- Change use of "ifconfig" to "ip", since ifconfig is no
  longer around (bsc#1073886), adding:
  * fcoe-utils-stop-using-ifconfig.patch</changelog>
  <changelog author="lduncan@suse.com" date="1591704000">- Updated with latest upstream v1.0.33 from v1.0.32:
  * Added "-Wextra" and enabled "-Werror" for compiling
  * Ignore auto-generated files
  * Update systemd service files (several updates)
  * A bunch of gcc-10-related fixes, such as marking unused
    arguments, fixing strncpy()s, string truncation/overflow
  * better error handling/retry for link issues (like EBUSY)
  * replace use of "ifconfig" with "ip" in debug scripts
  * fix long-standing issue with netlink buffer resizing
  * move bash completions to proper system directory
  This replaces fcoe-utils-v1.0.32.tar.xz with
  fcoe-utils-v1.0.33.tar.xz, and it does away with the
  following patches, since they are all fixed upstream:
  * 0003-systemctl-cannot-start-fcoemon.socket.patch
  * 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
  * 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
  * 0008-Use-correct-socket-for-fcoemon.socket.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * fcoe-utils-1.0.29-make.patch
  * fcoe-utils-stop-using-ifconfig.patch
  And the following patch was removed because we can
  successfully compile with "-Werror" now:
  * 0009-disable-Werror-building.patch</changelog>
  <changelog author="lduncan@suse.com" date="1594814400">- Handle NIC names longer than 7 characters for the output of
  "fcoeadm -s" output (bsc#1010047), adding patch:
  * Handle-NIC-names-longer-than-7-characters.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1597924800">- Add patch to fix build on architectures where char is
  unsigned (%arm, aarch64):
  * fcoe-utils-fix-arm.patch</changelog>
  <changelog author="lduncan@suse.com" date="1616673600">- Update to version 1.0.34 (fixing bsc#1182804), which replaces the
  source tarball, and removes these two patches, which are fixed
  upstream:
  * Handle-NIC-names-longer-than-7-characters.patch
  * fcoe-utils-fix-arm.patch
  Change summary:
    Chris Leech (6):
  21 string-op truncation, format truncation, and format overflow errors
  use of uninitialized values detected during LTO
  Revert "Make gcc compiler happy about ifname string truncation."
  fix VLAN device name overflow check
  fix regressions caused by safe_makepath change in libopenfcoe.c
  minor fcoeadm output issues
    Guillaume Gardet (1):
  char can be unsigned on arm, so set signed explicitly as the check expects it can be negative
    Lee Duncan (6):
  Handle NIC names longer than 7 characters.
  Change debug-&gt;log message if daemon running
  Remove references to open-fcoe.org
  Fix two gcc-11 compiler warnings.
  Remove comment that doesn't match code.
  Preparing for version v1.0.34
    Lily Nie (1):
  fix one bug introduced by commit b06c3df
    Nitin U. Yewale (1):
  Exit fcoemon command if fcoemon daemon is already running.</changelog>
</package>
<package pkgid="e73acfc97ddd3f7fe2511fc65083ced6019410316db3b5080f69cdf047841fb3" name="fcoe-utils" arch="src">
  <version epoch="0" ver="1.0.34" rel="12.3.1"/>
  <changelog author="hare@suse.de" date="1406548800">- Use correct socket name in fcoemon.socket (bnc#881205)
  * Add 0037-Use-correct-socket-for-fcoemon.socket.patch</changelog>
  <changelog author="hare@suse.de" date="1438603200">- Update to version 1.0.30 (FATE#318849)
  * Remove merged patches:
    + 0001-man-Fix-small-typo-regarding-fcf-option.patch
    + 0002-Don-t-call-AM_INIT_AUTOMAKE-twice.patch
    + 0003-fipvlan-fails-on-powerpc.patch
    + 0004-fipvlan-Only-shutdown-interfaces-if-no-vlans-are-cre.patch
    + 0005-fipvlan-start-VLAN-interface-from-netlink-handler.patch
    + 0006-fipvlan-Extract-create_missing_vlan-function-from-lo.patch
    + 0007-fipvlan-create-VLANs-from-netlink-handler.patch
    + 0008-fipvlan-Start-FCoE-from-netlink-handler.patch
    + 0009-fipvlan-Update-wait-loop-to-wait-for-VLANs.patch
    + 0010-fipvlan-Re-send-VLAN-discovery.patch
    + 0011-fipvlan-update-manpage.patch
    + 0012-fipvlan-Leave-link-up-if-requested.patch
    + 0013-fipvlan-Update-manpage-to-reflect-correct-timeout.patch
    + 0014-fipvlan-Do-not-shut-down-FCoE-connections-on-physica.patch
    + 0015-fipvlan-break-out-of-receive-loop-on-error.patch
    + 0016-fipvlan-handle-errors-from-fip-socket-creation.patch
    + 0017-fipvlan-filter-interfaces-from-rtnl_getlink.patch
    + 0018-Add-missing-DESTDIR-when-installing-bash-completion.patch
    + 0019-Fix-build-with-Wl-as-needed.patch
    + 0020-Fix-integer-formatting.patch
    + 0021-fcnsq-Fixup-help-text.patch
    + 0022-fcnsq-Fixup-64bit-integer-handling.patch
    + 0023-fcoemon-add-systemd-service-file.patch
    + 0024-fcoemon-systemd-socket-activation.patch
    + 0025-doc-Update-QUICKSTART-INSTALL-docs-for-systemd-init-.patch
    + 0026-FIPVLAN-Really-break-out-of-the-recv_loop-upon-fip_r.patch
    + 0027-man-Fix-typo-in-fcoemon-documentation.patch
    + 0032-fipvlan-Fix-crash-in-create_and_start_vlan.patch
    + 0033-fipvlan-suppress-warning-interface-already-exists.patch
    + 0034-fipvlan-do-not-crash-on-empty-MAC-address-in-lookup_.patch
  * Add new patches from upstream:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
  * Rename patches:
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0003-systemctl-cannot-start-fcoemon.socket.patch
    + 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
    + 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
    + 0006-fipvlan-fixup-return-value-on-error.patch
    + 0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
    + 0008-Use-correct-socket-for-fcoemon.socket.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1439380800">- Replace libHBAAPI and libhbalinux by new internal implementation (FATE#319021)</changelog>
  <changelog author="jthumshirn@suse.com" date="1439467200">- Fix segmentation fault (bsc#941577)
- Fix display of driver name and version (bsc#941566)</changelog>
  <changelog author="jthumshirn@suse.com" date="1443700800">- Fix enumeration of FCoE connections (bsc#947587)
  + 0018-support-multiple-connections.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1444996800">- Fix erroneous memory free corruption (bsc#950696)
  + 0019-fcping-fix-erroneous-memory-free.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1446465600">- Fix display of NPIV ports (bsc#951859)
  + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1454932800">- Update to version 1.0.31 (FATE#320515)
  * Removed merged patches:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0009-fcoe-utils-Add-sysfs_hba-to-to-fcoemon_utils.patch
    + 0010-fcoeadm-Use-internal-sysfs-based-hba-lib-for-informa.patch
    + 0011-fcoeadm-Use-internal-sysfs-lib-to-display-target-and.patch
    + 0012-fcoeadm-Use-internal-sysfs-lib-to-display-port-stati.patch
    + 0013-fcoeadm-Get-rid-of-some-includes.patch
    + 0014-fcoemon-Use-internal-sysfs_hba-library.patch
    + 0015-libutil-remove-definition-of-sa_hex_format.patch
    + 0016-fcping-Convert-fcping-to-internal-sysfs-based-implem.patch
    + 0017-configure.ac-Remove-libHBAAPIv2-and-libhbalinux2.patch
    + 0018-support-multiple-connections.patch
    + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1466510400">- Don't activate DCB on adapters which do DCB in Hardware (bsc#985816)
  + 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch</changelog>
  <changelog author="hare@suse.de" date="1468497600">- fcoemon cannot start FIP responder (bsc#988887)
  * 0010-fcoemon-fixup-log_nlmsg_error.patch
  * 0011-fcoemon-Add-debugging-message-for-recv.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * 0013-Fallback-to-default-MAC-address-for-FIP.patch
- Rediff patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
- Rename patch
  * old: 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch
  * new: 0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
- Fixup spec file to correctly refer to service_del_postun</changelog>
  <changelog author="jthumshirn@suse.com" date="1477310400">- Fix fcoeadm-t crash when other FC storage is present (bsc#1006027)
  * 0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1486641600">- Update to latest upstream release (FATE#320515)
    Remove the following upstreamed patches:
  0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
  0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
  0010-fcoemon-fixup-log_nlmsg_error.patch
  0011-fcoemon-Add-debugging-message-for-recv.patch
  0013-Fallback-to-default-MAC-address-for-FIP.patch
  0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1491912000">- Disable Werror when building to work around a new GCC 7 warning. (bsc#1030244)
  + 0009-disable-Werror-building.patch</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="dimstar@opensuse.org" date="1560945600">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut by using systemd-devel-mini.</changelog>
  <changelog author="lduncan@suse.com" date="1585915200">- Change use of "ifconfig" to "ip", since ifconfig is no
  longer around (bsc#1073886), adding:
  * fcoe-utils-stop-using-ifconfig.patch</changelog>
  <changelog author="lduncan@suse.com" date="1591704000">- Updated with latest upstream v1.0.33 from v1.0.32:
  * Added "-Wextra" and enabled "-Werror" for compiling
  * Ignore auto-generated files
  * Update systemd service files (several updates)
  * A bunch of gcc-10-related fixes, such as marking unused
    arguments, fixing strncpy()s, string truncation/overflow
  * better error handling/retry for link issues (like EBUSY)
  * replace use of "ifconfig" with "ip" in debug scripts
  * fix long-standing issue with netlink buffer resizing
  * move bash completions to proper system directory
  This replaces fcoe-utils-v1.0.32.tar.xz with
  fcoe-utils-v1.0.33.tar.xz, and it does away with the
  following patches, since they are all fixed upstream:
  * 0003-systemctl-cannot-start-fcoemon.socket.patch
  * 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
  * 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
  * 0008-Use-correct-socket-for-fcoemon.socket.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * fcoe-utils-1.0.29-make.patch
  * fcoe-utils-stop-using-ifconfig.patch
  And the following patch was removed because we can
  successfully compile with "-Werror" now:
  * 0009-disable-Werror-building.patch</changelog>
  <changelog author="lduncan@suse.com" date="1594814400">- Handle NIC names longer than 7 characters for the output of
  "fcoeadm -s" output (bsc#1010047), adding patch:
  * Handle-NIC-names-longer-than-7-characters.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1597924800">- Add patch to fix build on architectures where char is
  unsigned (%arm, aarch64):
  * fcoe-utils-fix-arm.patch</changelog>
  <changelog author="lduncan@suse.com" date="1616673600">- Update to version 1.0.34 (fixing bsc#1182804), which replaces the
  source tarball, and removes these two patches, which are fixed
  upstream:
  * Handle-NIC-names-longer-than-7-characters.patch
  * fcoe-utils-fix-arm.patch
  Change summary:
    Chris Leech (6):
  21 string-op truncation, format truncation, and format overflow errors
  use of uninitialized values detected during LTO
  Revert "Make gcc compiler happy about ifname string truncation."
  fix VLAN device name overflow check
  fix regressions caused by safe_makepath change in libopenfcoe.c
  minor fcoeadm output issues
    Guillaume Gardet (1):
  char can be unsigned on arm, so set signed explicitly as the check expects it can be negative
    Lee Duncan (6):
  Handle NIC names longer than 7 characters.
  Change debug-&gt;log message if daemon running
  Remove references to open-fcoe.org
  Fix two gcc-11 compiler warnings.
  Remove comment that doesn't match code.
  Preparing for version v1.0.34
    Lily Nie (1):
  fix one bug introduced by commit b06c3df
    Nitin U. Yewale (1):
  Exit fcoemon command if fcoemon daemon is already running.</changelog>
</package>
<package pkgid="5510aac8f8748da407ab53685e9cbb0e7a49f901d03ebeb78f2b7166e23da406" name="fcoe-utils" arch="x86_64">
  <version epoch="0" ver="1.0.34" rel="12.3.1"/>
  <changelog author="hare@suse.de" date="1438603200">- Update to version 1.0.30 (FATE#318849)
  * Remove merged patches:
    + 0001-man-Fix-small-typo-regarding-fcf-option.patch
    + 0002-Don-t-call-AM_INIT_AUTOMAKE-twice.patch
    + 0003-fipvlan-fails-on-powerpc.patch
    + 0004-fipvlan-Only-shutdown-interfaces-if-no-vlans-are-cre.patch
    + 0005-fipvlan-start-VLAN-interface-from-netlink-handler.patch
    + 0006-fipvlan-Extract-create_missing_vlan-function-from-lo.patch
    + 0007-fipvlan-create-VLANs-from-netlink-handler.patch
    + 0008-fipvlan-Start-FCoE-from-netlink-handler.patch
    + 0009-fipvlan-Update-wait-loop-to-wait-for-VLANs.patch
    + 0010-fipvlan-Re-send-VLAN-discovery.patch
    + 0011-fipvlan-update-manpage.patch
    + 0012-fipvlan-Leave-link-up-if-requested.patch
    + 0013-fipvlan-Update-manpage-to-reflect-correct-timeout.patch
    + 0014-fipvlan-Do-not-shut-down-FCoE-connections-on-physica.patch
    + 0015-fipvlan-break-out-of-receive-loop-on-error.patch
    + 0016-fipvlan-handle-errors-from-fip-socket-creation.patch
    + 0017-fipvlan-filter-interfaces-from-rtnl_getlink.patch
    + 0018-Add-missing-DESTDIR-when-installing-bash-completion.patch
    + 0019-Fix-build-with-Wl-as-needed.patch
    + 0020-Fix-integer-formatting.patch
    + 0021-fcnsq-Fixup-help-text.patch
    + 0022-fcnsq-Fixup-64bit-integer-handling.patch
    + 0023-fcoemon-add-systemd-service-file.patch
    + 0024-fcoemon-systemd-socket-activation.patch
    + 0025-doc-Update-QUICKSTART-INSTALL-docs-for-systemd-init-.patch
    + 0026-FIPVLAN-Really-break-out-of-the-recv_loop-upon-fip_r.patch
    + 0027-man-Fix-typo-in-fcoemon-documentation.patch
    + 0032-fipvlan-Fix-crash-in-create_and_start_vlan.patch
    + 0033-fipvlan-suppress-warning-interface-already-exists.patch
    + 0034-fipvlan-do-not-crash-on-empty-MAC-address-in-lookup_.patch
  * Add new patches from upstream:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
  * Rename patches:
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0003-systemctl-cannot-start-fcoemon.socket.patch
    + 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
    + 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
    + 0006-fipvlan-fixup-return-value-on-error.patch
    + 0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
    + 0008-Use-correct-socket-for-fcoemon.socket.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1439380800">- Replace libHBAAPI and libhbalinux by new internal implementation (FATE#319021)</changelog>
  <changelog author="jthumshirn@suse.com" date="1439467200">- Fix segmentation fault (bsc#941577)
- Fix display of driver name and version (bsc#941566)</changelog>
  <changelog author="jthumshirn@suse.com" date="1443700800">- Fix enumeration of FCoE connections (bsc#947587)
  + 0018-support-multiple-connections.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1444996800">- Fix erroneous memory free corruption (bsc#950696)
  + 0019-fcping-fix-erroneous-memory-free.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1446465600">- Fix display of NPIV ports (bsc#951859)
  + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1454932800">- Update to version 1.0.31 (FATE#320515)
  * Removed merged patches:
    + 0001-fcoemon-Rework-daemonizing-and-error-handling.patch
    + 0002-fcoemon-fix-IEEE-state-machine.patch
    + 0009-fcoe-utils-Add-sysfs_hba-to-to-fcoemon_utils.patch
    + 0010-fcoeadm-Use-internal-sysfs-based-hba-lib-for-informa.patch
    + 0011-fcoeadm-Use-internal-sysfs-lib-to-display-target-and.patch
    + 0012-fcoeadm-Use-internal-sysfs-lib-to-display-port-stati.patch
    + 0013-fcoeadm-Get-rid-of-some-includes.patch
    + 0014-fcoemon-Use-internal-sysfs_hba-library.patch
    + 0015-libutil-remove-definition-of-sa_hex_format.patch
    + 0016-fcping-Convert-fcping-to-internal-sysfs-based-implem.patch
    + 0017-configure.ac-Remove-libHBAAPIv2-and-libhbalinux2.patch
    + 0018-support-multiple-connections.patch
    + 0019-fcoeadm_display-Fix-display-of-NPIV-ports.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1466510400">- Don't activate DCB on adapters which do DCB in Hardware (bsc#985816)
  + 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch</changelog>
  <changelog author="hare@suse.de" date="1468497600">- fcoemon cannot start FIP responder (bsc#988887)
  * 0010-fcoemon-fixup-log_nlmsg_error.patch
  * 0011-fcoemon-Add-debugging-message-for-recv.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * 0013-Fallback-to-default-MAC-address-for-FIP.patch
- Rediff patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
- Rename patch
  * old: 0009-fcoemon-c-add-a-check-to-verify-if-dcbd-is-to-be-initialized-else-do-not-try-to-connect-to-dcbd-lldpad.patch
  * new: 0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
- Fixup spec file to correctly refer to service_del_postun</changelog>
  <changelog author="jthumshirn@suse.com" date="1477310400">- Fix fcoeadm-t crash when other FC storage is present (bsc#1006027)
  * 0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1486641600">- Update to latest upstream release (FATE#320515)
    Remove the following upstreamed patches:
  0007-fipvlan-clean-up-state-machine-for-pfd_add.patch
  0009-fcoemon.c-Add-a-check-to-verify-if-dcbd-is-to-be-ini.patch
  0010-fcoemon-fixup-log_nlmsg_error.patch
  0011-fcoemon-Add-debugging-message-for-recv.patch
  0013-Fallback-to-default-MAC-address-for-FIP.patch
  0014-fcoeadm-target-segfault-with-other-fc-storage-present.patch</changelog>
  <changelog author="jthumshirn@suse.com" date="1491912000">- Disable Werror when building to work around a new GCC 7 warning. (bsc#1030244)
  + 0009-disable-Werror-building.patch</changelog>
  <changelog author="kukuk@suse.de" date="1547467200">- Use %license instead of %doc [bsc#1082318]</changelog>
  <changelog author="dimstar@opensuse.org" date="1560945600">- BuildRequire pkgconfig(libsystemd) instead of systemd-devel:
  allow OBS to shortcut by using systemd-devel-mini.</changelog>
  <changelog author="lduncan@suse.com" date="1585915200">- Change use of "ifconfig" to "ip", since ifconfig is no
  longer around (bsc#1073886), adding:
  * fcoe-utils-stop-using-ifconfig.patch</changelog>
  <changelog author="lduncan@suse.com" date="1591704000">- Updated with latest upstream v1.0.33 from v1.0.32:
  * Added "-Wextra" and enabled "-Werror" for compiling
  * Ignore auto-generated files
  * Update systemd service files (several updates)
  * A bunch of gcc-10-related fixes, such as marking unused
    arguments, fixing strncpy()s, string truncation/overflow
  * better error handling/retry for link issues (like EBUSY)
  * replace use of "ifconfig" with "ip" in debug scripts
  * fix long-standing issue with netlink buffer resizing
  * move bash completions to proper system directory
  This replaces fcoe-utils-v1.0.32.tar.xz with
  fcoe-utils-v1.0.33.tar.xz, and it does away with the
  following patches, since they are all fixed upstream:
  * 0003-systemctl-cannot-start-fcoemon.socket.patch
  * 0004-fcoemon-Correctly-handle-options-in-the-service-file.patch
  * 0005-fcoe.service-Add-foreground-to-prevent-fcoemon-to-be.patch
  * 0006-fipvlan-fixup-return-value-on-error.patch
  * 0008-Use-correct-socket-for-fcoemon.socket.patch
  * 0012-fcoemon-Retry-fcm_link_getlink-on-EBUSY.patch
  * fcoe-utils-1.0.29-make.patch
  * fcoe-utils-stop-using-ifconfig.patch
  And the following patch was removed because we can
  successfully compile with "-Werror" now:
  * 0009-disable-Werror-building.patch</changelog>
  <changelog author="lduncan@suse.com" date="1594814400">- Handle NIC names longer than 7 characters for the output of
  "fcoeadm -s" output (bsc#1010047), adding patch:
  * Handle-NIC-names-longer-than-7-characters.patch</changelog>
  <changelog author="guillaume.gardet@opensuse.org" date="1597924800">- Add patch to fix build on architectures where char is
  unsigned (%arm, aarch64):
  * fcoe-utils-fix-arm.patch</changelog>
  <changelog author="lduncan@suse.com" date="1616673600">- Update to version 1.0.34 (fixing bsc#1182804), which replaces the
  source tarball, and removes these two patches, which are fixed
  upstream:
  * Handle-NIC-names-longer-than-7-characters.patch
  * fcoe-utils-fix-arm.patch
  Change summary:
    Chris Leech (6):
  21 string-op truncation, format truncation, and format overflow errors
  use of uninitialized values detected during LTO
  Revert "Make gcc compiler happy about ifname string truncation."
  fix VLAN device name overflow check
  fix regressions caused by safe_makepath change in libopenfcoe.c
  minor fcoeadm output issues
    Guillaume Gardet (1):
  char can be unsigned on arm, so set signed explicitly as the check expects it can be negative
    Lee Duncan (6):
  Handle NIC names longer than 7 characters.
  Change debug-&gt;log message if daemon running
  Remove references to open-fcoe.org
  Fix two gcc-11 compiler warnings.
  Remove comment that doesn't match code.
  Preparing for version v1.0.34
    Lily Nie (1):
  fix one bug introduced by commit b06c3df
    Nitin U. Yewale (1):
  Exit fcoemon command if fcoemon daemon is already running.</changelog>
</package>
<package pkgid="5830c8e111c2fc0c4d99e94a7e31ee3221b76415c4c4f83c773c5d9bb542c7e3" name="fence-agents" arch="aarch64">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="8ae99b93f287d7205b531c38d42bcc81b4059e9dab587203646ed30319a1e55d" name="fence-agents" arch="ppc64le">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="edfe04ba6091ad50403ef3e1d333a05a566607659f95c8799323c1b6ff57e806" name="fence-agents" arch="s390x">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="b2c6e23b7916b90302cb6c0e97a0891f85901bf7e2590696219f28a5a80b70a8" name="fence-agents" arch="src">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="c52b3bf7f728aee1c51f257f4bbcf8a52b717f8b917d8afd2ad21d99a8ced1dc" name="fence-agents" arch="x86_64">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="342d3725d948b4d69f37039751307ed4e2d45642487e34a551806bddc824437f" name="fence-agents-amt_ws" arch="aarch64">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="f009be02d6e94208475e398e5800f48b807b3afb548efa233c9451ca9d29b00e" name="fence-agents-amt_ws" arch="ppc64le">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="d45457bc92a595020680fe47e7dd223370f39d6ef01a3ca3a3659ac65b1bb48e" name="fence-agents-amt_ws" arch="s390x">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="9e627baebf22cfd4bb577232a38e82284693eeb884998e08882b7eb91091a3bb" name="fence-agents-amt_ws" arch="x86_64">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="df2cbf937d7e998df677c24865dc272424e87ea8b686576912f333a881f3748e" name="fence-agents-devel" arch="aarch64">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="8829776a3c675b23507a5e298021a356b7add77400a04d21787a82c8a9dfeb93" name="fence-agents-devel" arch="ppc64le">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="8acd4099c487e17af97824db2e5caece6356697f02378270ef24884606bdc526" name="fence-agents-devel" arch="s390x">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="dfd1dce98d3cf87562b5e2dfee658a54bf7c0e96134001de2c32f797d463df07" name="fence-agents-devel" arch="x86_64">
  <version epoch="0" ver="4.9.0+git.1624456340.8d746be9" rel="3.5.1"/>
  <changelog author="kgronlund@suse.com" date="1526558400">- run_command: fix Python 3 encoding issue (bsc#1082871)
- fence_gce: use default credentials from googleapiclient
- fence_gce: fix regression - missing import oauth2client.client
- fence_gce: fix regression - missing import googleapiclient.discovery
- Add 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
- Add 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
- Add 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
- Add 0005-run_command-fix-Python-3-encoding-issue.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1529496000">- Update to version 4.2.1+git.1529316875.1a39345b:
  * fence_vmware_soap: fix Python 3 suds issue
  * Added python-novaclient and python-keystoneclient in configure.ac
  * novaclient 1.1 depcrecated, so making changes for novaclient
  * Python keystoneclient also included to pacify CI
  * Changed travis to include pythomn-novaclient
  * Fencing Agent for Openstack
  * fence_scsi: fix python3 encoding error #206
  * fence_ipmilan: add missing fence_ilo3 and fence_ilo4 metadata
  * fence_scsi: match device names using re.MULTILINE to avoid duplicating names in /var/run/cluster/fence_scsi.dev
  * fence_gce: use default credentials from googleapiclient
  * run_command: fix Python 3 encoding issue
- Drop merged patches:
  * Remove 0002-fence_gce-fix-regression-missing-import-googleapicli.patch
  * Remove 0003-fence_gce-fix-regression-missing-import-oauth2client.patch
  * Remove 0004-fence_gce-use-default-credentials-from-googleapiclie.patch
  * Remove 0005-run_command-fix-Python-3-encoding-issue.patch
- Enable GCE fence agent for all targets (fate#325539) (bsc#1088358)
- Enable fence_openstack agent (bsc#1097803)</changelog>
  <changelog author="kgronlund@suse.com" date="1529928000">- Unify spec file for python 2 and 3
- Enable build for python 2
  * Add 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1530100800">- Unify source package with SLE 12 and Leap 42:
  * fencing: include timestamps when logging to STDERR and debug file (bsc#1049852)
- Obsoletes the following patches (SLE 12 and Leap 42):
  * 0001-fence_compute-Only-list-nova-compute-services-when-g.patch
  * 0002-fence_compute-Don-t-list-hypervisors-but-nova-comput.patch
  * 0003-fence_compute-Do-not-override-domain-if-it-is-alread.patch
  * 0004-fence_compute-Fix-handling-of-domain-None.patch
  * 0005-fence_compute-Fix-fix_domain-to-not-return-too-early.patch
  * 0006-fence_compute-Fix-fix_plug_name-when-looking-if-plug.patch
  * 0007-fence_compute-Remove-duplicate-check-for-binary-name.patch
  * 0009-fence_compute-Fix-disabling-force_down-on-node-when-.patch
  * 0010-Make-pywsman-dependency-optional.patch
  * 0011-fencing-include-timestamps-when-logging-to-STDERR-an.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1533816000">- Update to version 4.2.1+git.1532964592.3ae5b58e:
  * fence_aliyun: Add Aliyun fence agent. (fate#326557)
  * fence_gce: add power cycle as default method
  * fence_gce: set project and zone as not required
  * fence_gce: add support for stackdriver logging
  * fence_ilo3/fence_ipmilan: show correct default method (onoff) in help
  * fence_mpath: add watchdog support
  * fence_amt_ws: create metadata without agent specific libs
- Drop obsolete patch:
  * Remove 0002-Build-without-openwsman-installed.patch</changelog>
  <changelog author="kgronlund@suse.com" date="1537963200">- Update to version 4.2.1+git.1537269352.7b1fd536:
  * fence_vmware_soap: cleanup when receiving SIGTERM
  * fence_cisco_ucs: encode POSTFIELDS
  * Update fence_rcd_serial to correct vendor URL
  * fence_aliyun: correct indentation for *key in help
  * fence_aliyun: list instance names and show up to 100 instances (fate#326557)
  * fence-rhevm: improve error reporting.
  * fence_impilan/fence_ilo_ssh: iLO5-support
  * fence_rhevm: improve indentation and metadata
  * fence_compute/fence_evacuate/fence_rhevm: dont use has_key (not supported in Python 3)
  * fence_rhevm fixing help for plug param
  * fence_kdump: fix strncpy issue
  * fence_evacuate: fix evacuable tag mix issue</changelog>
  <changelog author="dakechi@suse.com" date="1550491200">- Update to version 4.2.1+git.1550476590.98767d24:
  * fence_redfish: use "ipport" parameter and improve logging (fate#320898)
  * Changed Encoding to UTF-8 (bsc#1137314) (CVE-2019-10153)
  * fence_redfish: fail when using invalid cert without --ssl-insecure (fate#320898)
  * Removed unnecessary variable assignments to simplify code
  * fence_scsi: watchdog retries support
  * Renamed variable to avoid reusing variable name
  * Replaced default port 443 with default ssl enabled option
  * Changed reboot type to ForceRestart
  * Modify power status check
  * Added run_delay()
  * Updated fence_redfish.xml with make xml-upload (fate#320898)
  * Add new fence agent for Redfish (fate#320898)
  * build: fix issues with newer autoconf versions
  * build: fix if-redirection to make check_used_options run for the agents as intended
  * Fix 'log_expect' in fence_hpblade.py
  * fence_scsi: fix incorrect SCSI key when node ID is 10 or higher
  * fence_openstack: add detection of keystoneauth1 library
  * check_used_options: add Python 3 support, and detect unsupported has_key()-calls
  * fence_openstack: Migrate from keystoneclient to keystoneauth1
  * fence_openstack: fix missing version parameter in novaclient.Client() call
  * fence_openstack: fix configure library detection and add try/except for imports
  * fence_kdump: add validate-all action
  * fence_compute/fence_evacuate: domain parameter fixes to avoid regressions</changelog>
  <changelog author="kgronlund@suse.com" date="1560340800">- Split fence_amt_ws into separate package due to licence incompatibility:
  * Apache-2.0 is not compatible with GPL-2.0
- Update to version 4.4.0+git.1558595666.5f79f9e9:
  * fence_scsi: detect node ID using new format, and fallback to old format before failing
  * fence_rhevm: fix debug encoding issues (bsc#1137314) (CVE-2019-10153)
  * fence_mpath: import ctypes to fix watchdog hardreboot
  * fence_rhevm: add RHEV v4 API support and auto-detection
  * fence_azure_arm: use skip_shutdown feature when available
  * fence_ipmilan: Add ipmitool timeout option
  * fence_redfish: add headers to HTTP methods
  * fence_gce: fix Python 3 encoding issue
  * fence_pve: add support for sending reset command to qemu machines (#261)
  * fencing: improve stdin parse function
  * fence_redfish: backwards compatibility for &lt;ip&gt;:&lt;port&gt;</changelog>
  <changelog author="dakechi@suse.com" date="1561982400">- White list the aliyun fence agent to get it included and provided
  by the fence-agent package (bsc#1139913)</changelog>
  <changelog author="dakechi@suse.com" date="1568289600">- Update to version 4.4.0+git.1568100905.307de6f2:
  * fence_openstack: use -n/--plug/port parameter to be able to use pcmk_host_map
  * fence_apc_snmp: Add Tripplite WEBCARDLX PDU support
  * Update fence_aliyun.xml (bsc#1150504)
  * Fix argument parsing for region_name
  * fence_ilo_ssh*: add timeout warning in metadata/manpage
  * remove 'man' page formating strings to improve '-o metadata' output
  * filter out 'man' formating strings from 'longdesc' field
  * Update fence_aliyun.py (#279) (bsc#1150504)
  * Fixed issue with SUSPENDED VMs
  * Changed encoding for the raritan telnet connection to latin1
  * fence_scsi watchdog: dont exit when command fails using retry parameter</changelog>
  <changelog author="dakechi@suse.com" date="1592568000">- Update to version 4.5.2+git.1592573838.1eee0863:
  * fence_azure_arm: fixes to make MSI support work
  * fence_azure_arm: log metadata when debugging
  * fence_vmware_soap: log exception message for SSLError exception
  * build: add PHONY target to use directory dependencies for parallel builds
  * fence_aws: improve boto3_debug boolean handling
  * fence_aws: catch ConnectionError and suppress traceback for caught exceptions
  * fence_vmware_rest: support UTF-8 VM names
  * fence_openstack: import novaclient and keystone only when needed
  * build: add directory dependencies to avoid edge-case where generating manpages could happen before fencing.py was generated
  * fence_vmware_rest: dont fail when receiving more than 1000 VM error during monitor-action
  * fence_scsi: add readonly parameter
  * fence_vmware_rest: fix exception and remove default value for filter parameter (which was shown in the manpage)
  * fence_compute/fence_evacuate: fix --insecure parameter
  * fence_vmware_rest: add filter parameter
  * fence_vmware_cloud: improve exception handling in send_command()
  * fence_vmware_rest: improve exception handling in send_command()
  * Disable google api cache discovery
  * fence_aws: fix Python 3 encoding issue
  * fence_aws: Fix fence race, logging improvement and new debug option (#323)
  * fence_aws: improve connect parameter logic, so region can be specified as parameter, while using role or keys from ~/.aws/config
  * configure: fix agent filtering
  * fence_mpath: fix --reserve parameter typo
  * fence_vmware_rest: fix encoding to avoid issues with UTF-8 encoded comments
  * fence_aws: improve logging and metadata/usage text
  * fence_redfish/fence_vmware_soap: suppress warnings correctly with new python-requests
  * fence_scsi use clusterwide nodeID instead of local nodelist ID of node (#289)
  * fencing: only use inetX_only parameters for SSH based agents and fence_zvmip, and fixed syntax issue for Gawk v5+
  * spec: fix openstack BuildRequires for distros without Python 3
  * fence_virsh: fix status-based actions
  * fence_vbox: fix status-based actions
  * fix shortopt in fence-compute / fence_evacuate help messages
  * spec: add missing BuildRequires found when backporting to Fedora
  * fence_rhevm: added cookie file management (#304)
  * fence_compute: Invert the force-down/service disable order
  * fence_vmware_rest: improve logging
  * spec: only build OpenStack agents on x86_64/ppc64le, and avoid pulling in openstack via ironic from all subpackage
  * spec: add openstack subpackage
  * fence_openstack: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_mpath: fix fail_usage() issue and a couple of other minor issues w/the newly added plug/port parameter
  * fence_sbd: support errors on stderr
  * CI: improve metadata check/update dependencies
  * fence_mpath: use -n/--plug/port parameter to be able to use pcmk_host_map
  * High: mpath: Correction of failure detection behavior from watchdog service.
  * fence_zvmip: fix Python 3 issues</changelog>
  <changelog author="varkoly@suse.com" date="1603972800">- Update to version 4.6.0+git.1603723121.a17eb9d4:
  * Add a fence_crosslink agent
  * fencing: fix power-timeout when using new disable-timeout parameter
  * metadata: update for disable_timeout parameter
  * fencing: add disable-timeout parameter, and make it default when run from Pacemaker (at least 2.0+)
  * spec: make telnet a weak dependency
  * Adds baremetal support to GCE fence agent and API call retries (#355)
  * spec: add -aws and -gce dependency to -all subpackage
  * spec: fix ibmz subpackage referring to fence_z instead of fence_ibmz
  * fence_lpar: Reduce code duplication in get_lpar_list</changelog>
  <changelog author="varkoly@suse.com" date="1611230400">- Update to version 4.7.0+git.1607346448.17bd8552:
  * fence_mpath, fence_scsi: Improve logging for failed res/key get
  * fence_mpath, fence_scsi: Capture stderr in run_cmd()
  * build: depend on config changes to rebuild when running make after running ./configure
  * fence_redfish: Fix typo in help.
  * fence_aws: add support for IMDSv2
  * spec: add pkg-config file, and set version for obsoletes to avoid failing to build on Fedora 33
  * Add pkg-config file
  * fence_scsi: dont write key to device if it's already registered, and open file correctly to avoid using regex against end-of-file
  * fencing: fix run_command() to allow timeout=0 to mean forever
  * fencing: fix to make timeout(s)=0 be treated as forever for agents using pexpect</changelog>
  <changelog author="varkoly@suse.com" date="1611230401">- Adds service account authentication to GCE fence agent</changelog>
  <changelog author="varkoly@suse.com" date="1611662400">- bsc#1180518 [15sp3 FEAT] Product-HA / High Availability Extension:
  Add IBM Z LPAR fence agent fence_ibmz to Pacemaker (kvm) (fence-agents)</changelog>
  <changelog author="trenn@suse.de" date="1612353600">- Quote strings in specfile (originally by Olaf Hering, ohering@suse.de)</changelog>
  <changelog author="trenn@suse.de" date="1612440000">- This update has one part (fence-agents part) of a fix for bsc#1178294
  It still needs cobbler adjustings
- Update to version 4.7.0+git.1612425309.e4f51e44:
  * Add fence_ipmilanplus as fence_ipmilan wrapper always enabling lanplus (bsc#1178294)
  * fence_vbox: updated metadata file
  * fence_vbox: do not flood host account with vboxmanage calls
  * fence_aws/fence_gce: allow building without cloud libs
  * fence_gce: default to onoff
  * fence_lpar: Make --managed a required option
  * fence_zvmip: fix shell-timeout when using new disable-timeout parameter
  * Adds service account authentication to GCE fence agent
  * spec: dont build -all subpackage as noarch
- Patch that went mainline and got deleted:
  D 0001-Adds-service-account-authentication-to-GCE-fence-age.patch</changelog>
  <changelog author="trenn@suse.de" date="1612958400">- Update to version 4.7.1+git.1612946165.05fa9b4e:
  * fence_gce: update module reqs for SLES 15 (#383)
  * fence_redfish: Add diag action
- Fixed by previous versions already, but for the records...
  These sources include fixes for these bugs:
  bsc#1169485 (git commit 020f48a309bcad659dc493960d2b39e8e1243085)
  bsc#1169852 (git commit 5c182c4018728e3cdcc6846d74d373cc5b0639dd)
  bsc#1178343 (git commit 877be689d75892fe069154cf3bc02909f3edaf50)</changelog>
  <changelog author="trenn@suse.de" date="1612958401">- Update to version 4.7.1+git.1612974063.9e01fc92:
  * fence_gce: Adds cloud-platform scope for bare metal API and optional proxy flags (#382)</changelog>
  <changelog author="varkoly@suse.com" date="1624536000">- Update to version 4.9.0+git.1624456340.8d746be9:
  * fence_azure_arm: corrections to support Azure SDK &gt;= 15 - including backward compatibility (#415)
  (bsc#1185058)
  * fence_gce: make serviceaccount work with new libraries
  * fence_kubevirt: new fence agent
  * fence_virt*: simple_auth: use %zu for sizeof to avoid failing verbose builds on some archs
  * configure: dont fail when --with-agents contains virt
  * fence_mpath: watchdog retries support
  * fencing: add multi plug support for reboot-action
  * fence_redfish: add missing diag logic
  * fencing: fix issue with hardcoded help text length for metadata
  * fence_lindypdu: update metadata
  * fence_lindypdu: new fence agent
  * fencing: add stonith_status_sleep parameter for sleep between status calls during a STONITH action
  * fence_openstack: code formatting fixes per: https://github.com/ClusterLabs/fence-agents/pull/397#pullrequestreview-634281798
  * Proper try-except for connection exception.
  * Fix CI.
  * Do not wrap as many values.
  * Restore port metadata.
  * Update xml metadata.
  * Use standard logging.
  * Revert change to __all__
  * Major rework of the original agent:
  (bsc#1182701) [0.9.10-GCE-Build1.6] fence_gce doesn't restart the node as expected
  * fence_virt: fix required=1 parameters that used to not be required and add deprecated=1 for old deprecated params
  * fence_gce: default method moved back to powercycle (#389)
  * fence_aws: add filter parameter to be able to limit which nodes are listed
  * virt: fix a bunch of coverity scan errors in ip_lookup
  * virt: make sure to provide an empty default to strncpy
  * virt: make sure buffers are big enough for 0 byte end string
  * virt: increase buffer size to avoid overruns
  * virt: check return code in virt-sockets
  * virt: fix error code checking
  * virt: fix plugin (minor) memory leak and plug in load race
  * virt: attempt to open file directly and avoid race condition
  * virt: fix different coverity scan errors in common/tcp
  * virt: cleanup deadcode in client/vsock
  * virt: cleanup deadcode in client/tcp
  * virt: fix potential buffer overrun
  * virt: fix mcast coverity scan errors
  * virt: drop pm-fence plugin
  * virt: drop libvirt-qmf plugin
  * virt: drop null plugin
  * build: enable fence_virtd cpg plugin by default
  * virt: drop fence_virtd non-modular build
  * virt: fix plugin installation regression on upgrades
  * fence_virt: metadata fixes, implement manpage generation and metadata/delay/rng checks
  * virt: make sure variable is initialized
  * Revert "virt: drop -Werror to avoid unnecessary failures"
  * zvm: reformat fence_zvm to avoid gcc warnings
  * Ignore fence-virt man pages
  * Move fence_virt to the correct location
  * Ignore unknown options on stdin
  * fence_gce: support google-auth and oauthlib and fallback to deprecated libs when not available
  * spec:
    add aliyun subpackage and fence_mpath_check* to mpath subpackage
    add libxml2-devel to BuildRequires
  (jsc#SLE-18182) ECO: Update fence-agents
  (jsc#SLE-17998) Add upstream PR to aws-vpc-move-ip and apply required resource &amp; fence agent patches</changelog>
</package>
<package pkgid="e43ddd0bc664ef1a2b28181394df207a3dec7cccc2d3fe8849efc3848dc52d0d" name="fetchmail" arch="aarch64">
  <version epoch="0" ver="6.3.26" rel="20.14.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
</package>
<package pkgid="9c210d035fd5afdbd4a3d5ee23aec16cec7261581dc4767d7b5d07553105d5f5" name="fetchmail" arch="ppc64le">
  <version epoch="0" ver="6.3.26" rel="20.14.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
</package>
<package pkgid="2a351c691949ca939e01bc844bfd74e5e893cb6eed31b0f6d87d469f42993047" name="fetchmail" arch="s390x">
  <version epoch="0" ver="6.3.26" rel="20.14.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
</package>
<package pkgid="d4acf7a0cdd7f0c8dd9755166dfcfb258833da047e96690bb5c20a260cea6241" name="fetchmail" arch="src">
  <version epoch="0" ver="6.3.26" rel="20.14.1"/>
  <changelog author="vcizek@suse.com" date="1367236800">- added offline gpg verification
- update to 6.3.26
  [#] CRITICAL BUG FIX for setups using "mimedecode":
  * The mimedecode feature failed to ship the last line of the body if it was
    encoded as quoted-printable and had a MIME soft line break in the very last
    line.  Reported by Lars Hecking in June 2011.
  * Bug introduced on 1998-03-20 when the mimedecode support was added by ESR
    before release 4.4.1 through code contributed by Henrik Storner.
    Workaround for older releases: do not use mimedecode feature.
  * Earlier versions of this NEWS file claimed this bug fixed in fetchmail-6.3.23,
    but it was not.
  * Fixes Launchpad Bug#1171818.</changelog>
  <changelog author="p.drouand@gmail.com" date="1382875200">- Add systemd support for openSUSE &gt;= 12.3</changelog>
  <changelog author="jsegitz@novell.com" date="1400673600">- added necessary macros for systemd files</changelog>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
</package>
<package pkgid="254da6e012e0c95a515a2882d6bf7d0855f81a2a0df3b370c7e606981d67d65f" name="fetchmail" arch="x86_64">
  <version epoch="0" ver="6.3.26" rel="20.14.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
</package>
<package pkgid="31fef52b3296313a64cb34dbabf0d11f8eef6137b07d24febe1b5407aa72894b" name="fetchmail" arch="aarch64">
  <version epoch="0" ver="6.3.26" rel="20.17.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
</package>
<package pkgid="fb728b331556d99d6a3f30414f4942380ece389215c93f836eeea1375e8b9679" name="fetchmail" arch="ppc64le">
  <version epoch="0" ver="6.3.26" rel="20.17.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
</package>
<package pkgid="a656a64d30b6f3d58903c080ccd25e7898f62d45717d8d7549479c3030bfbddc" name="fetchmail" arch="s390x">
  <version epoch="0" ver="6.3.26" rel="20.17.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
</package>
<package pkgid="01930cac631bfe553ac0f6db7b6d81b999a2c45dd4109ee38401f09783eb6387" name="fetchmail" arch="src">
  <version epoch="0" ver="6.3.26" rel="20.17.1"/>
  <changelog author="p.drouand@gmail.com" date="1382875200">- Add systemd support for openSUSE &gt;= 12.3</changelog>
  <changelog author="jsegitz@novell.com" date="1400673600">- added necessary macros for systemd files</changelog>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
</package>
<package pkgid="e4766bddb36bed6d57706ec2f478cb6650c53aa04f70a3b8cdd416b788222296" name="fetchmail" arch="x86_64">
  <version epoch="0" ver="6.3.26" rel="20.17.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
</package>
<package pkgid="d5dd478a6dda11dc08b073103e992de3f0a83c23f67d83542b99dbb04aadceef" name="fetchmailconf" arch="aarch64">
  <version epoch="0" ver="6.3.26" rel="20.14.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
</package>
<package pkgid="a7c3f78548973cb7ac8784e1d77db728d4b4e5f45eb9938d28fb7292c5733564" name="fetchmailconf" arch="ppc64le">
  <version epoch="0" ver="6.3.26" rel="20.14.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
</package>
<package pkgid="c88d0715d5e2dfafedd97569d6deef155e7beaf2dda24be9928a703873783297" name="fetchmailconf" arch="s390x">
  <version epoch="0" ver="6.3.26" rel="20.14.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
</package>
<package pkgid="4db8fa5ae81d950d8247c82e9b4e165aee6105e77ada369361c0acf42ee26620" name="fetchmailconf" arch="x86_64">
  <version epoch="0" ver="6.3.26" rel="20.14.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
</package>
<package pkgid="72da869ae2e6d25e0c17257df47a18882108544f5a9ea503311abbdead4fb09d" name="fetchmailconf" arch="aarch64">
  <version epoch="0" ver="6.3.26" rel="20.17.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
</package>
<package pkgid="2e8cb8322c2298bc2faca6df467fe0034beccee3d09667e307775a5b3d708c0f" name="fetchmailconf" arch="ppc64le">
  <version epoch="0" ver="6.3.26" rel="20.17.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
</package>
<package pkgid="3f9e658b86ee113675d73243ac721bb6c96e06540e6a407a6a4a61728363dce4" name="fetchmailconf" arch="s390x">
  <version epoch="0" ver="6.3.26" rel="20.17.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
</package>
<package pkgid="ab9430e7a024ace9891b58e148cd1dea3c97c45cdf9875f66196162ab1f2d1f8" name="fetchmailconf" arch="x86_64">
  <version epoch="0" ver="6.3.26" rel="20.17.1"/>
  <changelog author="ledest@gmail.com" date="1415534400">- fix bashism in postun script</changelog>
  <changelog author="lmuelle@suse.com" date="1417780800">- Removed executable permission bits from fetchmail.service file.
- Update the project url in the spec file after Berlios shutdown.
- Remove dependency on gpg-offline as signature checking is implemented in the
  source validator.</changelog>
  <changelog author="meissner@suse.com" date="1419854400">- build with PIE</changelog>
  <changelog author="tchvatal@suse.com" date="1420718400">- Cleanup with spec-cleaner
- Remove support for &lt;12.3 as it does not build anyway.
- Fix krb5 switches
- Provide proper rcbla controler for the service</changelog>
  <changelog author="pjanouch@suse.de" date="1460116800">- Made /etc/sysconfig/fetchmail work again after a botched systemd
  conversion that ignored the file altogether (bsc#905673)
- Removed the FETCHMAIL_USER setting in favor of editing the
  systemd service file (which should be copied to the respective
  location in /etc, and not edited in-place)</changelog>
  <changelog author="pjanouch@suse.de" date="1463140800">- Made the helper script introduced in last change return exit status
  5 on configuration errors instead of 1, which should make it a bit
  less confusing (bsc#979534)</changelog>
  <changelog author="jengelh@inai.de" date="1463140801">- Check for user/group existence before attempting to add them,
  and remove error suppression from these calls.
- Ensure tmpfile creation is run</changelog>
  <changelog author="meissner@suse.com" date="1490961600">- prerequire group(daemon) to meet new tumbleweed user handling</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1493380800">- Allow --syslog option in daemon mode (bsc#1033081).
  * By default, the status messages are redirected to the syslog.</changelog>
  <changelog author="vcizek@suse.com" date="1510574400">- drop SSLv3 support to build with openssl 1.1 (bsc#1066940)
  * add fetchmail-openssl11.patch</changelog>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1519992000">- By default, the status messages are redirected to
  /var/log/fetchmail. The syslog option or no-logging are also
  available. (bsc#1033081)</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1521115200">- Fix fetchmailconf to compile with python{2,3} [bsc#1082694]
  * fetchmail-fetchmailconf-python3-1of3.patch
  * fetchmail-fetchmailconf-python3-2of3.patch
  * fetchmail-fetchmailconf-python3-3of3.patch</changelog>
  <changelog author="pmonrealgonzalez@suse.com" date="1559304000">- Remove comment about not available FETCHMAIL_USER configuration
  variable in sysconfig.fetchmail (bsc#1136538)</changelog>
  <changelog author="pmonreal@suse.com" date="1614600000">- Set the hostname for SNI when using TLS [bsc#1182807]
- Add fetchmail-SNI-hostname-support.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1626091200">- Change PASSWORDLEN from 64 to 256 [bsc#1188034]
  * Add fetchmail-PASSWORDLEN-256.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1627560000">- Security fix: [bsc#1188875, CVE-2021-36386]
  * DoS or information disclosure in some configurations.
  * See also: https://www.fetchmail.info/fetchmail-SA-2021-01.txt
  * Add fetchmail-CVE-2021-36386.patch</changelog>
  <changelog author="pmonreal@suse.com" date="1633694400">- Security fix: [bsc#1190069, CVE-2021-39272]
  * Fix failure to enforce STARTTLS session encryption in some
    circumstances, such as a certain situation with IMAP and PREAUTH.
  * Advisory: https://www.fetchmail.info/fetchmail-SA-2021-02.txt
  * Add fetchmail-CVE-2021-39272.patch</changelog>
</package>
<package pkgid="8494a66efcc9a6547e333170685e3fa3d0fa5a37b2bdea30441f198090611d58" name="ffmpeg" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.11.1"/>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
</package>
<package pkgid="b2d499287e62190c544e3d7b62506980e5a71fbee92d3ba095ae6eeae7b7bf94" name="ffmpeg" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.11.1"/>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
</package>
<package pkgid="e8747a69137aa4336a3bad9dc646d0091f0ca8e186105ab0e9f2a7aa8d75b3d0" name="ffmpeg" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.11.1"/>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
</package>
<package pkgid="fd18ce2c45846d6b78ee677c75d6e4e8dfd799e25f0d054c46fa007045cae0e4" name="ffmpeg" arch="src">
  <version epoch="0" ver="3.4.2" rel="11.11.1"/>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
</package>
<package pkgid="4b137cbbe1ae25953681ef4fda0a902c9d8ad9b0492dfd7de2d48dcc406e55b1" name="ffmpeg" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.11.1"/>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
</package>
<package pkgid="17c00929b100950d6fb74d55edf5ff8f3e72bb555f983396333f97c5ec4ccbef" name="ffmpeg" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.14.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
</package>
<package pkgid="9ab4b920484c9120a072853d60e61b9ca9d4cd85ca57e247866b1d36ec9b6867" name="ffmpeg" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.14.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
</package>
<package pkgid="1748476501ab3cb2a019330e2ce68f30dfe60f96be5438f142e5aad1b4cc1e1e" name="ffmpeg" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.14.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
</package>
<package pkgid="2a708403852f45e65cf535bd425e233979b969a3130f47c57725dae58d0c81fb" name="ffmpeg" arch="src">
  <version epoch="0" ver="3.4.2" rel="11.14.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
</package>
<package pkgid="282ee2569d735496ee5fb5e6bb612fb9e878d510f136c5b2d38a7ad597a44f3d" name="ffmpeg" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.14.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
</package>
<package pkgid="0a36990b2b12286fdc1f069e71634945737ead7b9184a071a9095b331b636a6a" name="ffmpeg" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.17.1"/>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1634212800">- Add ffmpeg-CVE-2021-38094.patch: Backport from upstream to fix
  integer overflow vulnerability in function filter_sobel in
  libavfilter/vf_convolution.c (bsc#1190735, bsc#1190734,
  bsc#1190733, CVE-2021-38093, CVE-2021-38092).
- Add ffmpeg-CVE-2020-22037.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  avcodec_alloc_context3 at options.c (bsc#1186756).
- Add ffmpeg-CVE-2021-3566.patch: Backport from upstream to fix
  exposure of sensitive information on ffmpeg version prior to 4.3
  (bsc#1189166).
- Add ffmpeg-CVE-2020-35965.patch: Backport from upstream to fix
  out-of-bounds write in decode_frame in libavcodec/exr.c
  (bsc#1187852).
- Add ffmpeg-CVE-2020-20892.patch: Backport from upstream to fix
  an issue was discovered in function filter_frame in
  libavfilter/vf_lenscorrection.c (bsc#1190719).
- Add ffmpeg-CVE-2020-20891.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_input in
  libavfilter/vf_gblur.c (bsc#1190718).
- Add ffmpeg-CVE-2020-20895.patch: Backport from upstream to fix
  buffer overflow vulnerability in function
  filter_vertically_##name in libavfilter/vf_avgblur.c
  (bsc#1190722).
- Add ffmpeg-CVE-2020-20896.patch: Backport from upstream to fix
  an issue was discovered in function latm_write_packet in
  libavformat/latmenc.c (bsc#1190723).
- Add ffmpeg-CVE-2020-20899.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_props in
  libavfilter/vf_bwdif.c (bsc#1190726).
- Add ffmpeg-CVE-2020-20902.patch: Backport from upstream to fix
  out-of-bounds read vulnerability exists in long_term_filter
  function in g729postfilter.c (bsc#1190729).</changelog>
</package>
<package pkgid="2723a707887f736b36a1308b06d0cf5a20c63afda366471146924049b00e72ec" name="ffmpeg" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.17.1"/>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1634212800">- Add ffmpeg-CVE-2021-38094.patch: Backport from upstream to fix
  integer overflow vulnerability in function filter_sobel in
  libavfilter/vf_convolution.c (bsc#1190735, bsc#1190734,
  bsc#1190733, CVE-2021-38093, CVE-2021-38092).
- Add ffmpeg-CVE-2020-22037.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  avcodec_alloc_context3 at options.c (bsc#1186756).
- Add ffmpeg-CVE-2021-3566.patch: Backport from upstream to fix
  exposure of sensitive information on ffmpeg version prior to 4.3
  (bsc#1189166).
- Add ffmpeg-CVE-2020-35965.patch: Backport from upstream to fix
  out-of-bounds write in decode_frame in libavcodec/exr.c
  (bsc#1187852).
- Add ffmpeg-CVE-2020-20892.patch: Backport from upstream to fix
  an issue was discovered in function filter_frame in
  libavfilter/vf_lenscorrection.c (bsc#1190719).
- Add ffmpeg-CVE-2020-20891.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_input in
  libavfilter/vf_gblur.c (bsc#1190718).
- Add ffmpeg-CVE-2020-20895.patch: Backport from upstream to fix
  buffer overflow vulnerability in function
  filter_vertically_##name in libavfilter/vf_avgblur.c
  (bsc#1190722).
- Add ffmpeg-CVE-2020-20896.patch: Backport from upstream to fix
  an issue was discovered in function latm_write_packet in
  libavformat/latmenc.c (bsc#1190723).
- Add ffmpeg-CVE-2020-20899.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_props in
  libavfilter/vf_bwdif.c (bsc#1190726).
- Add ffmpeg-CVE-2020-20902.patch: Backport from upstream to fix
  out-of-bounds read vulnerability exists in long_term_filter
  function in g729postfilter.c (bsc#1190729).</changelog>
</package>
<package pkgid="38b7df765e7ce390749505eaf30ec516d35b68be4c3d9a5932146f69877d3cf0" name="ffmpeg" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.17.1"/>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1634212800">- Add ffmpeg-CVE-2021-38094.patch: Backport from upstream to fix
  integer overflow vulnerability in function filter_sobel in
  libavfilter/vf_convolution.c (bsc#1190735, bsc#1190734,
  bsc#1190733, CVE-2021-38093, CVE-2021-38092).
- Add ffmpeg-CVE-2020-22037.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  avcodec_alloc_context3 at options.c (bsc#1186756).
- Add ffmpeg-CVE-2021-3566.patch: Backport from upstream to fix
  exposure of sensitive information on ffmpeg version prior to 4.3
  (bsc#1189166).
- Add ffmpeg-CVE-2020-35965.patch: Backport from upstream to fix
  out-of-bounds write in decode_frame in libavcodec/exr.c
  (bsc#1187852).
- Add ffmpeg-CVE-2020-20892.patch: Backport from upstream to fix
  an issue was discovered in function filter_frame in
  libavfilter/vf_lenscorrection.c (bsc#1190719).
- Add ffmpeg-CVE-2020-20891.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_input in
  libavfilter/vf_gblur.c (bsc#1190718).
- Add ffmpeg-CVE-2020-20895.patch: Backport from upstream to fix
  buffer overflow vulnerability in function
  filter_vertically_##name in libavfilter/vf_avgblur.c
  (bsc#1190722).
- Add ffmpeg-CVE-2020-20896.patch: Backport from upstream to fix
  an issue was discovered in function latm_write_packet in
  libavformat/latmenc.c (bsc#1190723).
- Add ffmpeg-CVE-2020-20899.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_props in
  libavfilter/vf_bwdif.c (bsc#1190726).
- Add ffmpeg-CVE-2020-20902.patch: Backport from upstream to fix
  out-of-bounds read vulnerability exists in long_term_filter
  function in g729postfilter.c (bsc#1190729).</changelog>
</package>
<package pkgid="00559a3c084d755643fa3ba2e6a8aa414f494f7b54e0b666d8722dc39df433b6" name="ffmpeg" arch="src">
  <version epoch="0" ver="3.4.2" rel="11.17.1"/>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1634212800">- Add ffmpeg-CVE-2021-38094.patch: Backport from upstream to fix
  integer overflow vulnerability in function filter_sobel in
  libavfilter/vf_convolution.c (bsc#1190735, bsc#1190734,
  bsc#1190733, CVE-2021-38093, CVE-2021-38092).
- Add ffmpeg-CVE-2020-22037.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  avcodec_alloc_context3 at options.c (bsc#1186756).
- Add ffmpeg-CVE-2021-3566.patch: Backport from upstream to fix
  exposure of sensitive information on ffmpeg version prior to 4.3
  (bsc#1189166).
- Add ffmpeg-CVE-2020-35965.patch: Backport from upstream to fix
  out-of-bounds write in decode_frame in libavcodec/exr.c
  (bsc#1187852).
- Add ffmpeg-CVE-2020-20892.patch: Backport from upstream to fix
  an issue was discovered in function filter_frame in
  libavfilter/vf_lenscorrection.c (bsc#1190719).
- Add ffmpeg-CVE-2020-20891.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_input in
  libavfilter/vf_gblur.c (bsc#1190718).
- Add ffmpeg-CVE-2020-20895.patch: Backport from upstream to fix
  buffer overflow vulnerability in function
  filter_vertically_##name in libavfilter/vf_avgblur.c
  (bsc#1190722).
- Add ffmpeg-CVE-2020-20896.patch: Backport from upstream to fix
  an issue was discovered in function latm_write_packet in
  libavformat/latmenc.c (bsc#1190723).
- Add ffmpeg-CVE-2020-20899.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_props in
  libavfilter/vf_bwdif.c (bsc#1190726).
- Add ffmpeg-CVE-2020-20902.patch: Backport from upstream to fix
  out-of-bounds read vulnerability exists in long_term_filter
  function in g729postfilter.c (bsc#1190729).</changelog>
</package>
<package pkgid="9893e537248b1931fb75c1e8e25daef4468334318b7d91ec2b13226126f392e2" name="ffmpeg" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.17.1"/>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1634212800">- Add ffmpeg-CVE-2021-38094.patch: Backport from upstream to fix
  integer overflow vulnerability in function filter_sobel in
  libavfilter/vf_convolution.c (bsc#1190735, bsc#1190734,
  bsc#1190733, CVE-2021-38093, CVE-2021-38092).
- Add ffmpeg-CVE-2020-22037.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  avcodec_alloc_context3 at options.c (bsc#1186756).
- Add ffmpeg-CVE-2021-3566.patch: Backport from upstream to fix
  exposure of sensitive information on ffmpeg version prior to 4.3
  (bsc#1189166).
- Add ffmpeg-CVE-2020-35965.patch: Backport from upstream to fix
  out-of-bounds write in decode_frame in libavcodec/exr.c
  (bsc#1187852).
- Add ffmpeg-CVE-2020-20892.patch: Backport from upstream to fix
  an issue was discovered in function filter_frame in
  libavfilter/vf_lenscorrection.c (bsc#1190719).
- Add ffmpeg-CVE-2020-20891.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_input in
  libavfilter/vf_gblur.c (bsc#1190718).
- Add ffmpeg-CVE-2020-20895.patch: Backport from upstream to fix
  buffer overflow vulnerability in function
  filter_vertically_##name in libavfilter/vf_avgblur.c
  (bsc#1190722).
- Add ffmpeg-CVE-2020-20896.patch: Backport from upstream to fix
  an issue was discovered in function latm_write_packet in
  libavformat/latmenc.c (bsc#1190723).
- Add ffmpeg-CVE-2020-20899.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_props in
  libavfilter/vf_bwdif.c (bsc#1190726).
- Add ffmpeg-CVE-2020-20902.patch: Backport from upstream to fix
  out-of-bounds read vulnerability exists in long_term_filter
  function in g729postfilter.c (bsc#1190729).</changelog>
</package>
<package pkgid="1b5de086b2981f049c4572c0bee069e0f6700436df50316dff42622340d24d35" name="ffmpeg" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.3.1"/>
  <changelog author="jengelh@inai.de" date="1512129600">- Add 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  [boo#1070762]</changelog>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new bugfix release 3.4.1
  * Fixed integer overflows, division by zero, illegal bit shifts
  * Fixed the gmc_mmx function which failed to validate width
    and height [boo#1070762, CVE-2017-17081]
  * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  * ffplay: use SDL2 audio API
- Removed 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  (upstreamed).</changelog>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
</package>
<package pkgid="f1683c3283a67055e383ffb68c537559ca27f398edb672657113690d89c617c0" name="ffmpeg" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.3.1"/>
  <changelog author="jengelh@inai.de" date="1512129600">- Add 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  [boo#1070762]</changelog>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new bugfix release 3.4.1
  * Fixed integer overflows, division by zero, illegal bit shifts
  * Fixed the gmc_mmx function which failed to validate width
    and height [boo#1070762, CVE-2017-17081]
  * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  * ffplay: use SDL2 audio API
- Removed 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  (upstreamed).</changelog>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
</package>
<package pkgid="261719e070ca068d30f7cc10de83efa96e88c15cefd7b740c935a9007b791322" name="ffmpeg" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.3.1"/>
  <changelog author="jengelh@inai.de" date="1512129600">- Add 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  [boo#1070762]</changelog>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new bugfix release 3.4.1
  * Fixed integer overflows, division by zero, illegal bit shifts
  * Fixed the gmc_mmx function which failed to validate width
    and height [boo#1070762, CVE-2017-17081]
  * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  * ffplay: use SDL2 audio API
- Removed 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  (upstreamed).</changelog>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
</package>
<package pkgid="2d716767526faeed72ae4e6c0759ee5ab607edd0e849378407049e68e647d3fa" name="ffmpeg" arch="src">
  <version epoch="0" ver="3.4.2" rel="11.3.1"/>
  <changelog author="jengelh@inai.de" date="1512129600">- Add 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  [boo#1070762]</changelog>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new bugfix release 3.4.1
  * Fixed integer overflows, division by zero, illegal bit shifts
  * Fixed the gmc_mmx function which failed to validate width
    and height [boo#1070762, CVE-2017-17081]
  * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  * ffplay: use SDL2 audio API
- Removed 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  (upstreamed).</changelog>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
</package>
<package pkgid="1f42cc28b44f6a90329f399db48461bafb050498c15cb69b01c7327066b65a53" name="ffmpeg" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.3.1"/>
  <changelog author="jengelh@inai.de" date="1512129600">- Add 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  [boo#1070762]</changelog>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new bugfix release 3.4.1
  * Fixed integer overflows, division by zero, illegal bit shifts
  * Fixed the gmc_mmx function which failed to validate width
    and height [boo#1070762, CVE-2017-17081]
  * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  * ffplay: use SDL2 audio API
- Removed 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  (upstreamed).</changelog>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
</package>
<package pkgid="e03df77b749f706f14056d14d5556c9040929119eadd0915cbc297b5d4437b25" name="ffmpeg" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.8.2"/>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
</package>
<package pkgid="97ab730d2f1868ae02b64da98a5638adc91b7fa7565b3b16f7abf43625636e3f" name="ffmpeg" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.8.2"/>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
</package>
<package pkgid="c29f8d0e502c688f3da2b2130604c3ad400ac6fbc9f24544010399f6b3c8df0e" name="ffmpeg" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.8.2"/>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
</package>
<package pkgid="5e923d89a98ca1785fa388e1b9bda8cbc38d55cb196abdfe7c29a18138db6464" name="ffmpeg" arch="src">
  <version epoch="0" ver="3.4.2" rel="11.8.2"/>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
</package>
<package pkgid="bd1dbcc45f4682dde1c7fa8bf1cc485e0ba8f6f8ab613edc48b02acdf5551d79" name="ffmpeg" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.8.2"/>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
</package>
<package pkgid="7400f80db5833c2c167bc16fe70d7f75eb3ac1e5e9812850c282923181a0df8a" name="ffmpeg-private-devel" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.11.1"/>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
</package>
<package pkgid="95dabdd6dbb829107dd9351c0669a596ecb91e0936dfd9b16cfe99879e5836fb" name="ffmpeg-private-devel" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.11.1"/>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
</package>
<package pkgid="2a7b4f032af853a54ce6eba7cbd78ed140327867e6cb94dfa12ab1825fad596a" name="ffmpeg-private-devel" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.11.1"/>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
</package>
<package pkgid="259b2cbd96421892ca11d03284b1f859d1848145160c7e6bdf772e712650669a" name="ffmpeg-private-devel" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.11.1"/>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
</package>
<package pkgid="fa5366ba3fa33e376d7e227a73d5b40571b781de732ad48ed3ace0b6e2862c05" name="ffmpeg-private-devel" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.14.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
</package>
<package pkgid="0d0ff11162b59f40e9fb03848c0cc3772674bef81c2f6d3086b947d4b6180379" name="ffmpeg-private-devel" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.14.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
</package>
<package pkgid="d73df9f6b3b439d51584d07ab4a657c473e23257cd780a7a7d2c1d2d4785d101" name="ffmpeg-private-devel" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.14.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
</package>
<package pkgid="fce65ccfdf566d6b44fcb283e1eabacc054ec992a5336f3b8ca82aa594a53180" name="ffmpeg-private-devel" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.14.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
</package>
<package pkgid="2b9b8b4f2c54e9cb173edf988c932c02976335f19e46504e78487961f2e1848b" name="ffmpeg-private-devel" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.17.1"/>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1634212800">- Add ffmpeg-CVE-2021-38094.patch: Backport from upstream to fix
  integer overflow vulnerability in function filter_sobel in
  libavfilter/vf_convolution.c (bsc#1190735, bsc#1190734,
  bsc#1190733, CVE-2021-38093, CVE-2021-38092).
- Add ffmpeg-CVE-2020-22037.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  avcodec_alloc_context3 at options.c (bsc#1186756).
- Add ffmpeg-CVE-2021-3566.patch: Backport from upstream to fix
  exposure of sensitive information on ffmpeg version prior to 4.3
  (bsc#1189166).
- Add ffmpeg-CVE-2020-35965.patch: Backport from upstream to fix
  out-of-bounds write in decode_frame in libavcodec/exr.c
  (bsc#1187852).
- Add ffmpeg-CVE-2020-20892.patch: Backport from upstream to fix
  an issue was discovered in function filter_frame in
  libavfilter/vf_lenscorrection.c (bsc#1190719).
- Add ffmpeg-CVE-2020-20891.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_input in
  libavfilter/vf_gblur.c (bsc#1190718).
- Add ffmpeg-CVE-2020-20895.patch: Backport from upstream to fix
  buffer overflow vulnerability in function
  filter_vertically_##name in libavfilter/vf_avgblur.c
  (bsc#1190722).
- Add ffmpeg-CVE-2020-20896.patch: Backport from upstream to fix
  an issue was discovered in function latm_write_packet in
  libavformat/latmenc.c (bsc#1190723).
- Add ffmpeg-CVE-2020-20899.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_props in
  libavfilter/vf_bwdif.c (bsc#1190726).
- Add ffmpeg-CVE-2020-20902.patch: Backport from upstream to fix
  out-of-bounds read vulnerability exists in long_term_filter
  function in g729postfilter.c (bsc#1190729).</changelog>
</package>
<package pkgid="bfb5955e9b086fcecd13edab50b049cf30face25102cd78ea5b9c896113a83cf" name="ffmpeg-private-devel" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.17.1"/>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1634212800">- Add ffmpeg-CVE-2021-38094.patch: Backport from upstream to fix
  integer overflow vulnerability in function filter_sobel in
  libavfilter/vf_convolution.c (bsc#1190735, bsc#1190734,
  bsc#1190733, CVE-2021-38093, CVE-2021-38092).
- Add ffmpeg-CVE-2020-22037.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  avcodec_alloc_context3 at options.c (bsc#1186756).
- Add ffmpeg-CVE-2021-3566.patch: Backport from upstream to fix
  exposure of sensitive information on ffmpeg version prior to 4.3
  (bsc#1189166).
- Add ffmpeg-CVE-2020-35965.patch: Backport from upstream to fix
  out-of-bounds write in decode_frame in libavcodec/exr.c
  (bsc#1187852).
- Add ffmpeg-CVE-2020-20892.patch: Backport from upstream to fix
  an issue was discovered in function filter_frame in
  libavfilter/vf_lenscorrection.c (bsc#1190719).
- Add ffmpeg-CVE-2020-20891.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_input in
  libavfilter/vf_gblur.c (bsc#1190718).
- Add ffmpeg-CVE-2020-20895.patch: Backport from upstream to fix
  buffer overflow vulnerability in function
  filter_vertically_##name in libavfilter/vf_avgblur.c
  (bsc#1190722).
- Add ffmpeg-CVE-2020-20896.patch: Backport from upstream to fix
  an issue was discovered in function latm_write_packet in
  libavformat/latmenc.c (bsc#1190723).
- Add ffmpeg-CVE-2020-20899.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_props in
  libavfilter/vf_bwdif.c (bsc#1190726).
- Add ffmpeg-CVE-2020-20902.patch: Backport from upstream to fix
  out-of-bounds read vulnerability exists in long_term_filter
  function in g729postfilter.c (bsc#1190729).</changelog>
</package>
<package pkgid="d100ce09083103dd7d8ec5637a2038f7f40d26a7fe2ba0c32e721fc1fb1b03fb" name="ffmpeg-private-devel" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.17.1"/>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1634212800">- Add ffmpeg-CVE-2021-38094.patch: Backport from upstream to fix
  integer overflow vulnerability in function filter_sobel in
  libavfilter/vf_convolution.c (bsc#1190735, bsc#1190734,
  bsc#1190733, CVE-2021-38093, CVE-2021-38092).
- Add ffmpeg-CVE-2020-22037.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  avcodec_alloc_context3 at options.c (bsc#1186756).
- Add ffmpeg-CVE-2021-3566.patch: Backport from upstream to fix
  exposure of sensitive information on ffmpeg version prior to 4.3
  (bsc#1189166).
- Add ffmpeg-CVE-2020-35965.patch: Backport from upstream to fix
  out-of-bounds write in decode_frame in libavcodec/exr.c
  (bsc#1187852).
- Add ffmpeg-CVE-2020-20892.patch: Backport from upstream to fix
  an issue was discovered in function filter_frame in
  libavfilter/vf_lenscorrection.c (bsc#1190719).
- Add ffmpeg-CVE-2020-20891.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_input in
  libavfilter/vf_gblur.c (bsc#1190718).
- Add ffmpeg-CVE-2020-20895.patch: Backport from upstream to fix
  buffer overflow vulnerability in function
  filter_vertically_##name in libavfilter/vf_avgblur.c
  (bsc#1190722).
- Add ffmpeg-CVE-2020-20896.patch: Backport from upstream to fix
  an issue was discovered in function latm_write_packet in
  libavformat/latmenc.c (bsc#1190723).
- Add ffmpeg-CVE-2020-20899.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_props in
  libavfilter/vf_bwdif.c (bsc#1190726).
- Add ffmpeg-CVE-2020-20902.patch: Backport from upstream to fix
  out-of-bounds read vulnerability exists in long_term_filter
  function in g729postfilter.c (bsc#1190729).</changelog>
</package>
<package pkgid="1bf8e27e8880f1ea3e5afaa2f18638a30cc2584bafaa5d4acdc020d36f8267fb" name="ffmpeg-private-devel" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.17.1"/>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1630497600">- Add ffmpeg-CVE-2021-38171.patch: Backport from upstream to fix
  adts_decode_extradata in libavformat/adtsenc.c in FFmpeg 4.4
  does not check the init_get_bits return value (bsc#1189724).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1632744000">- Add ffmpeg-CVE-2020-22042.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak is
  affected by: memory leak in the link_filter_inouts function in
  libavfilter/graphparser.c (bsc#1186761).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1634212800">- Add ffmpeg-CVE-2021-38094.patch: Backport from upstream to fix
  integer overflow vulnerability in function filter_sobel in
  libavfilter/vf_convolution.c (bsc#1190735, bsc#1190734,
  bsc#1190733, CVE-2021-38093, CVE-2021-38092).
- Add ffmpeg-CVE-2020-22037.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  avcodec_alloc_context3 at options.c (bsc#1186756).
- Add ffmpeg-CVE-2021-3566.patch: Backport from upstream to fix
  exposure of sensitive information on ffmpeg version prior to 4.3
  (bsc#1189166).
- Add ffmpeg-CVE-2020-35965.patch: Backport from upstream to fix
  out-of-bounds write in decode_frame in libavcodec/exr.c
  (bsc#1187852).
- Add ffmpeg-CVE-2020-20892.patch: Backport from upstream to fix
  an issue was discovered in function filter_frame in
  libavfilter/vf_lenscorrection.c (bsc#1190719).
- Add ffmpeg-CVE-2020-20891.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_input in
  libavfilter/vf_gblur.c (bsc#1190718).
- Add ffmpeg-CVE-2020-20895.patch: Backport from upstream to fix
  buffer overflow vulnerability in function
  filter_vertically_##name in libavfilter/vf_avgblur.c
  (bsc#1190722).
- Add ffmpeg-CVE-2020-20896.patch: Backport from upstream to fix
  an issue was discovered in function latm_write_packet in
  libavformat/latmenc.c (bsc#1190723).
- Add ffmpeg-CVE-2020-20899.patch: Backport from upstream to fix
  buffer overflow vulnerability in function config_props in
  libavfilter/vf_bwdif.c (bsc#1190726).
- Add ffmpeg-CVE-2020-20902.patch: Backport from upstream to fix
  out-of-bounds read vulnerability exists in long_term_filter
  function in g729postfilter.c (bsc#1190729).</changelog>
</package>
<package pkgid="68ef90e0be05ae2ea6845a03d483b0e9728db1c476e8b89b47a4c58cf983a2c8" name="ffmpeg-private-devel" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.3.1"/>
  <changelog author="jengelh@inai.de" date="1512129600">- Add 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  [boo#1070762]</changelog>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new bugfix release 3.4.1
  * Fixed integer overflows, division by zero, illegal bit shifts
  * Fixed the gmc_mmx function which failed to validate width
    and height [boo#1070762, CVE-2017-17081]
  * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  * ffplay: use SDL2 audio API
- Removed 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  (upstreamed).</changelog>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
</package>
<package pkgid="6c8bd387361b790ce51a785aa33cc3d52e6af29538eea7c6ae8d7a871fcc742b" name="ffmpeg-private-devel" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.3.1"/>
  <changelog author="jengelh@inai.de" date="1512129600">- Add 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  [boo#1070762]</changelog>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new bugfix release 3.4.1
  * Fixed integer overflows, division by zero, illegal bit shifts
  * Fixed the gmc_mmx function which failed to validate width
    and height [boo#1070762, CVE-2017-17081]
  * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  * ffplay: use SDL2 audio API
- Removed 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  (upstreamed).</changelog>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
</package>
<package pkgid="de0b52020e42e2f0236838d59f033f3cb6987194cc62f98fc3a00a7543dc102d" name="ffmpeg-private-devel" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.3.1"/>
  <changelog author="jengelh@inai.de" date="1512129600">- Add 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  [boo#1070762]</changelog>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new bugfix release 3.4.1
  * Fixed integer overflows, division by zero, illegal bit shifts
  * Fixed the gmc_mmx function which failed to validate width
    and height [boo#1070762, CVE-2017-17081]
  * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  * ffplay: use SDL2 audio API
- Removed 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  (upstreamed).</changelog>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
</package>
<package pkgid="7eebd67d4372fa62ba517f01945000031ebbd837f622cb034d3d406208247f28" name="ffmpeg-private-devel" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.3.1"/>
  <changelog author="jengelh@inai.de" date="1512129600">- Add 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  [boo#1070762]</changelog>
  <changelog author="jengelh@inai.de" date="1512993600">- Update to new bugfix release 3.4.1
  * Fixed integer overflows, division by zero, illegal bit shifts
  * Fixed the gmc_mmx function which failed to validate width
    and height [boo#1070762, CVE-2017-17081]
  * Fixed out-of-bounds in VC-2 encoder [boo#1069407, CVE-2017-16840]
  * ffplay: use SDL2 audio API
- Removed 0001-avcodec-x86-mpegvideodsp-Fix-signedness-bug-in-need_.patch
  (upstreamed).</changelog>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
</package>
<package pkgid="7569e6aa22be14affad3b153c811fbe547c8a8f2ca316a24171d2558e14f5df7" name="ffmpeg-private-devel" arch="aarch64">
  <version epoch="0" ver="3.4.2" rel="11.8.2"/>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
</package>
<package pkgid="33fc68784ca4100428ef1641655d73d1515f9f0686aab8f9e1edd578d1150e67" name="ffmpeg-private-devel" arch="ppc64le">
  <version epoch="0" ver="3.4.2" rel="11.8.2"/>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
</package>
<package pkgid="13b6064101ce6f21ea357c51d9c3d68d274fa76166b686f83b1e7885e9a456d7" name="ffmpeg-private-devel" arch="s390x">
  <version epoch="0" ver="3.4.2" rel="11.8.2"/>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
</package>
<package pkgid="cb1e081055f89c48a0e04cc1779295bf10fbdbf930b8548baaa5aa23ef6ad4eb" name="ffmpeg-private-devel" arch="x86_64">
  <version epoch="0" ver="3.4.2" rel="11.8.2"/>
  <changelog author="jengelh@inai.de" date="1518436800">- Update to new bugfix release 3.4.2
  * Fix integer overflows, multiplication overflows, undefined
    shifts, and verify buffer lengths.
  * avfilter/vf_transpose: Fix used plane count
    [boo#1078488, CVE-2018-6392]
  * avcodec/utvideodec: Fix bytes left check in decode_frame()
    [boo#1079368, CVE-2018-6621]
- Enable use of libzvbi for displaying teletext subtitles.
- Fixed a DoS in swri_audio_convert(), added cve-2017-17555.diff
  [boo#1072366, CVE-2017-17555].</changelog>
  <changelog author="nico.kruber@gmail.com" date="1518523200">- enable video stabilization/deshaking via libvidstab (optional)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1519128000">- Enable mpeg1video and mpeg2video in enable_decoders, and remove
  it from disable-decoders call given to configure, mpeg2 now
  available in openSUSE.</changelog>
  <changelog author="alarrosa@suse.com" date="1521633600">- Build and install also the sidxindex tool</changelog>
  <changelog author="alarrosa@suse.com" date="1521806400">- Create a new package ffmpeg-private-devel which contains some
  headers under /usr/include/ffmpeg/private that were not installed
  by upstream. Those headers are needed by the libav package in order
  to build avconv and other tools using the libav* libraries generated
  by ffmpeg instead of its own. No other package should require
  ffmpeg-private-devel.</changelog>
  <changelog author="qzheng@suse.com" date="1532088000">- Add ffmpeg-CVE-2018-13302.patch: Make backport from commit
  ed22dc2 to fix out of array access issue (bnc#1100356,
  CVE-2018-13302).</changelog>
  <changelog author="kbabioch@suse.com" date="1532692800">- Added ffmpeg-CVE-2018-1999010.patch: Fixed multiple out of array access
  vulnerabilities in the mms protocol that could result in accessing out of
  bound data via specially crafted input files (CVE-2018-1999010 bnc#1102899).
- Added ffmpeg-CVE-2018-1999011.patch: Fixed a heap buffer overflow in asf_o
  format demuxer that could result in remote code execution (CVE-2018-1999011
  bnc#1102689)
- Added ffmpeg-CVE-2018-1999012.patch: Fix an inifnite loop vulnerability in
  pva format demuxer that can result in excessive amount of ressource
  allocation like CPU an RAM (CVE-2018-1999012 bnc#1102688).
- Added ffmpeg-CVE-2018-1999013.patch: Fix an use-after-free vulnerability in
  the realmedia demuxer that can result in vulnerability, which allowed
  attackers to read heap memory (CVE-2018-1999013, bnc#1102687).</changelog>
  <changelog author="qzheng@suse.com" date="1536926400">- Add ffmpeg-CVE-2018-15822.patch: Make backport from commit
  6b67d7f to fix an assertion failure (CVE-2018-15822, boo#1105869).</changelog>
  <changelog author="qzheng@suse.com" date="1537185600">- Add ffmpeg-CVE-2018-13300.patch: Make backport from commit
  95556e2 to fix an out-of-array read (CVE-2018-13300, boo#1100348).</changelog>
  <changelog author="qzheng@suse.com" date="1540296000">- Add ffmpeg-CVE-2018-12458.patch: Make backport from commit
  e1182fa to fix an improper integer type (CVE-2018-12458,
  bsc#1097983).</changelog>
  <changelog author="qzheng@suse.com" date="1540296001">- Add ffmpeg-CVE-2018-13305.patch to add a missing check for
  negative values of the mqaunt variable (CVE-2018-13305,
  bsc#1100345).
- Rename cve-2017-17555.diff to ffmpeg-CVE-2017-17555.diff.</changelog>
  <changelog author="qzheng@suse.com" date="1542283200">- Add ffmpeg-CVE-2018-14395.patch: Make backport from commit
  fa19fbc to fix a divide-by-zero issue (CVE-2018-14395,
  boo#1101889).</changelog>
  <changelog author="qzheng@suse.com" date="1542283201">- Add ffmpeg-CVE-2018-14394.patch: Make backport from commit
  3a2d21b to fix a divide-by-zero issue (CVE-2018-14394,
  boo#1101888).</changelog>
  <changelog author="qzheng@suse.com" date="1560168000">- Add ffmpeg-CVE-2019-12730.patch: Make backport from commit
  ed188f6 to check for scanf() failure (CVE-2019-12730,
  bsc#1137526).</changelog>
  <changelog author="qzheng@suse.com" date="1560340800">- Add ffmpeg-CVE-2019-9718.patch: Make backport from commit
  1f00c97 to fix a denial of service issue (CVE-2019-9718,
  boo#1129715).</changelog>
  <changelog author="qzhao@suse.com" date="1562587200">- Add ffmpeg-CVE-2018-13301.patch: Backport from upstream to fix
  a NULL pointer dereference while converting a crafted AVI file
  to MPEG4 in the ff_mpeg4_decode_picture_header function in
  libavcodec/mpeg4videodec.c(bnc#1100352).</changelog>
  <changelog author="qzhao@suse.com" date="1574164800">- Add ffmpeg-CVE-2019-17542.patch: Backport from upstream to fix
  a heap-based buffer overflow problem in vqa_decode_chunk
  (bnc#1154064 CVE-2019-17542).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624622400">- Add ffmpeg-CVE-2020-13904.patch: Backport from upstream to fix
  use-after-free via a crafted EXTINF duration in an m3u8 file
  (bsc#1172640).
- Add ffmpeg-CVE-2020-21041.patch: Backport from upstream to fix
  buffer overflow vulnerability via apng_do_inverse_blend in
  libavcodec/pngenc.c  (bsc#1186406).
- Add ffmpeg-CVE-2019-17539.patch: Backport from upstream to fix
  NULL pointer dereference in avcodec_open2 in libavcodec/utils.c
  (bsc# 1154065).
- Add ffmpeg-CVE-2020-22026.patch: Backport from upstream to fix
  buffer overflow vulnerability exists in config_input() at
  libavfilter/af_tremolo.c (bsc#1186583).
- Add ffmpeg-CVE-2020-22021.patch: Backport from upstream to fix
  buffer overflow vulnerability in filter_edges function in
  libavfilter/vf_yadif.c (bsc#1186586).
- Add ffmpeg-CVE-2020-22020.patch: Backport from upstream to fix
  buffer overflow vulnerability in build_diff_map() in
  libavfilter/vf_fieldmatch.c (bsc#1186587).
- Add ffmpeg-CVE-2020-22015.patch: Backport from upstream to fix
  buffer overflow vulnerability in mov_write_video_tag() due to
  the out of bounds in libavformat/movenc.c (bsc#1186596).
- Add ffmpeg-CVE-2020-22016.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability at
  libavcodec/get_bits.h when writing .mov files (bsc#1186598).
- Add ffmpeg-CVE-2020-22017.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  ff_fill_rectangle() in libavfilter/drawutils.c (bsc#1186600).
- Add ffmpeg-CVE-2020-22022.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_fieldorder.c (bsc#1186603).
- Add ffmpeg-CVE-2020-22023.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  filter_frame at libavfilter/vf_bitplanenoise.c (bsc#1186604)
- Add ffmpeg-CVE-2020-22025.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists in
  gaussian_blur at libavfilter/vf_edgedetect.c (bsc#1186605).
- Add ffmpeg-CVE-2020-22031.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_w3fdif.c in filter16_complex_low()
  (bsc#1186613).
- Add ffmpeg-CVE-2020-22032.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_edgedetect.c in gaussian_blur() (bsc#1186614).
- Add ffmpeg-CVE-2020-22033.patch: Backport from upstream to fix
  a heap-based Buffer Overflow Vulnerability exists at
  libavfilter/vf_vmafmotion.c in convolution_y_8bit()
  (CVE-2020-22033) and buffer overflow vulnerability in
  convolution_y_10bit() in libavfilter/vf_vmafmotion.c
  (CVE-2020-22019) (bsc#1186615, bsc#1186597).
- Add ffmpeg-CVE-2020-22034.patch: Backport from upstream to fix
  a heap-based Buffer Overflow vulnerability exists at
  libavfilter/vf_floodfill.c (bsc#1186616).
- Add ffmpeg-CVE-2020-20451.patch: Backport from upstream to fix
  denial of service issue due to resource management errors via
  fftools/cmdutils.c (bsc#1186658).
- Add ffmpeg-CVE-2020-20448.patch: Backport from upstream to fix
  divide by zero issue via libavcodec/ratecontrol.c
  (bsc#1186660).
- Add ffmpeg-CVE-2020-22038.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the ff_v4l2_m2m_create_context function in v4l2_m2m.c
  (bsc#1186757).
- Add ffmpeg-CVE-2020-22039.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the inavi_add_ientry function (bsc#1186758).
- Add ffmpeg-CVE-2020-22043.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak at
  the fifo_alloc_common function in libavutil/fifo.c
  (bsc#1186762).
- Add ffmpeg-CVE-2020-22044.patch: Backport from upstream to fix
  denial of service vulnerability exists due to a memory leak in
  the url_open_dyn_buf_internal function in
  libavformat/aviobuf.c (bsc#1186763).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1625659200">- Add ffmpeg-CVE-2019-9721.patch: Backport from upstream to fix
  denial of service in the subtitle decoder in handle_open_brace
  from libavcodec/htmlsubtitles.c (bsc#1129714).
- Add ffmpeg-CVE-2020-22046.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the avpriv_float_dsp_allocl function in
  libavutil/float_dsp.c (bsc#1186849).
- Add ffmpeg-CVE-2020-22048.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the ff_frame_pool_get function in framepool.c
  (bsc#1186859).
- Add ffmpeg-CVE-2020-22049.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the wtvfile_open_sector function in wtvdec.c
  (bsc#1186861).
- Add ffmpeg-CVE-2020-22054.patch: Backport from upstream to fix
  a denial of service vulnerability exists in FFmpeg 4.2 due to
  a memory leak in the av_dict_set function in dict.c
  (bsc#1186863).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1628769600">- Add ffmpeg-CVE-2020-21688.patch: Backport from upstream to fix
  a heap-use-after-free in the av_freep function in libavutil/mem.c
  of FFmpeg 4.2 allows attackers to execute arbitrary code
  (bsc#1189348).
- Add ffmpeg-CVE-2020-21697.patch: Backport from upstream to fix
  a heap-use-after-free in the mpeg_mux_write_packet function in
  libavformat/mpegenc.c of FFmpeg 4.2 allows to cause a denial of
  service (DOS) via a crafted avi file (bsc#1189350).
- Add ffmpeg-CVE-2021-38114.patch: Backport from upstream to fix
  the return value of the init_vlc function is not checked
  (bsc#1189142).</changelog>
</package>
<package pkgid="eceb62eeb52ecc73f22d104ca872f237d1594a6075d97ec8d6280bb3f4d4a7a1" name="file" arch="aarch64">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="d0a898bb4aabc7e2b040bcf926021ce00f3251fc0a5b930c7dc14eebc01fcc01" name="file" arch="ppc64le">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="09cf555388c3d8d4b758ff96c5af771a840a89a483fe8d2c3e24ca27eccfb79b" name="file" arch="s390x">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="44303a6824535d8430a3ec42a591c76658af5af30492d9f40046613b1e2d7f90" name="file" arch="src">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="274a693a9d9d7a945338046dbc7ccf08e15590045c96c003cdd4db3c8cfa7420" name="file" arch="x86_64">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="9f4bff0d090865c7ab2397b096b8a0cd2371ee2d351b67d91ae98f77b0bc2e5e" name="file-devel-32bit" arch="x86_64">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="95de00263d36920103a4cc2be7196cb121c1ecb0c0b28a7856469ed4ad23ec88" name="file-devel" arch="aarch64">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="861438d2398def261fd26907b649e1da43908d87bd1be69f9f775022fcda84ca" name="file-devel" arch="ppc64le">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="cd0579abc2baee30f732243b9029c0f4d72fdf7d3e15c1e91fa2bea0634c4f44" name="file-devel" arch="s390x">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="8651e975a6a7b0cbe5a344de70ef67d7dbb95ed3337ff6ef4f360ca5b0fe2daa" name="file-devel" arch="x86_64">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="6bd9157135ec29974403280efa16a01cdde03e62bce6780d6a84a4b886a7a1dc" name="file-magic" arch="noarch">
  <version epoch="0" ver="5.32" rel="7.14.1"/>
  <changelog author="werner@suse.de" date="1471521600">- Add patch file-5.28-compress.patch
  to fix crash as found in build system</changelog>
  <changelog author="meissner@suse.com" date="1472040000">- file-magic is architecture independend, no need for a baselibs
  package.</changelog>
  <changelog author="dimstar@opensuse.org" date="1472040001">- Fix boo#995089:
  * Do not attempt to produce a file-magic-32bit package: there is
    nothing arch-dependant in this package (for completeness, this
    was already fixed just before by Marcus)
  * Fix baselibs.conf for libmagic1-32bit to require file-magic
    instead of file-magic-32bit.
  * Build file-magic as noarch on openSUSE &gt;= 1200 (where rpm is
    new enough to support this).</changelog>
  <changelog author="jeffm@suse.com" date="1476964800">- Add patch file-5.28-btrfs-image.dif
  to add support for files output by btrfs-image.</changelog>
  <changelog author="werner@suse.de" date="1479988800">- Update to file version 5.29
  * der getlength overflow (Jonas Wagner)
  * multiple magic file load failure (Christoph Biedl)
  * CDF parsing improvements (Guy Helmer)
  * Add support for signed indirect offsets
  * cat /dev/null | file - should print empty (Christoph Biedl)
  * Bump string size from 64 to 96.
  * PR/556: Fix separators on annotations.
- Remove patch file-5.28-compress.patch now upstream
- Rename patch file-5.28.dif which becomes now file-5.29.dif</changelog>
  <changelog author="werner@suse.de" date="1480507200">- Modify patch file-5.29.dif that is
  replace colon with dot in offset (boo#1012779)</changelog>
  <changelog author="werner@suse.de" date="1488456000">- Update to file version 5.30
  * If we exceeded the offset in a search return no match
    (Christoph Biedl)
  * Be more lenient on corrupt CDF files (Christoph Biedl)
  * pacify ubsan sign extension (oss-fuzz/524)
  * off by one in cdf parsing (PR/593)
  * report debugging sections in elf (PR/591)
  * Allow @@@ in extensions
  * Add missing overflow check in der magic (Jonas Wagner)
- Mofify the patches
    file-5.16-ocloexec.patch
    file-5.19-biorad.dif
    file-5.28-btrfs-image.dif
- Rename patch file-5.29.dif to file-5.30.dif
- Add upstream patches
    file-5.30-150735.patch
    file-5.30-3c60e5.patch</changelog>
  <changelog author="werner@suse.de" date="1495627200">- Update to file version 5.31
  * remove trailing spaces from magic files
  * refactor is_tar
  * better bounds checks for cdf
- Remove patches now upstream
  * file-5.30-150735.patch
  * file-5.30-3c60e5.patch
- Rename patch file-5.30.dif which becomes file-5.31.dif
- Modify the patches
  * file-4.24-autoconf.dif
  * file-5.14-tex.dif
  * file-5.16-ocloexec.patch
  * file-5.19-printf.dif
  * file-5.23-endian.patch</changelog>
  <changelog author="coolo@suse.com" date="1496664000">- add file-5.31-fix-tga.dif upstream commited after I reported
  a failure in File::Unpack's test suite</changelog>
  <changelog author="werner@suse.de" date="1505304000">- Update to file version 5.32
  * Always reset state in {file,buffer}_apprentice (Krzysztof Wilczynski)
  * Fix always true condition (Thomas Jarosch)
  * pickier parsing of numeric values in magic files.
  * PR/615 add magic_getflags()
- This release fix the bug bsc#1056838 for CVE-2017-1000249
- Remove patch file-5.31-fix-tga.dif as now upstream
- Rename patch file-5.31.dif which now becomes file-5.32.dif
- Modify the patches
  * file-5.16-ocloexec.patch
  * file-5.19-biorad.dif
  * file-5.19-printf.dif
  * file-5.23-endian.patch
  * file-5.28-btrfs-image.dif</changelog>
  <changelog author="jmatejek@suse.com" date="1506427200">- remove python build instructions from master spec file, move completely
  into python-magic.spec</changelog>
  <changelog author="jengelh@inai.de" date="1507464000">- Update package summaries. Replace old RPM constructs.
- Remove --with-pic which is useless with --disable-static.
- Edit pre_checkin.sh to remove dead python3 file.</changelog>
  <changelog author="werner@suse.de" date="1516622400">- Add patch file-5.32-ncurses-6.1.patch to support extend magic
  format for new ncurses 6.1</changelog>
  <changelog author="fvogt@suse.com" date="1519300800">- Use %license (boo#1082318)</changelog>
  <changelog author="werner@suse.de" date="1528804800">- Add patch file-a642587a9c.patch for bsc#1096974, bsc#1096984, and
  CVE-2018-10360 -- Avoid reading past the end of buffer</changelog>
  <changelog author="werner@suse.de" date="1550750400">- Add patch 0002-PR-62-spinpx-limit-size-of-file_printable.patch to
  fix bsc#1126117, bsc#1126118, and bsc#1126119 for CVE-2019-8905,
  CVE-2019-8906, and CVE-2019-8907</changelog>
  <changelog author="werner@suse.de" date="1571745600">- Add temporary patch CVE-2019-18218-46a8443f.patch from upstream
  to fix bsc#1154661 -- heap-based buffer overflow in cdf_read_property_info in cdf.c</changelog>
  <changelog author="schwab@suse.de" date="1586865600">- file-5.24-nitpick.dif: remove obsolete patch (bsc#1169512)
- file-secure_getenv.patch: refresh</changelog>
  <changelog author="werner@suse.de" date="1600430400">- Add patchfix_of_backport_PR-62.patch as previous backport caused
  a shorten output of the elf interprter (bsc#1176123)</changelog>
  <changelog author="werner@suse.de" date="1631016000">- Add patch bsc1189996-9fbe768a.patch to fix bsc#1189996</changelog>
</package>
<package pkgid="d757156eddfd7995b07a921844319939af4570d5cf0e1f68d6eb6e5d35b8b9a0" name="file-roller" arch="aarch64">
  <version epoch="0" ver="3.32.5" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1532347200">- Help translation-update-upstream finding the right gettext domain
  name: pass "po %{name}" to the call.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1532779200">- Update to version 3.29.1:
  + New features and user visible changes: Removed app menu.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1533038400">- Update to version 3.29.90:
  + Restored app menu.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535457600">- Update to version 3.29.91:
  + Bugs fixed:
  - Fixed loading of .epub and .crx files.
  - Path traversal vulnerability. Do not extract files with
    relative paths (bgo#794337).
  + Updated translations.
- Refresh patches with quilt, use autosetup macro.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 3.30.0:
  + Updated translations.
- Remove lang package from recommended package as it already
  supplements main package (same effect, it's redundant).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 3.30.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546516800">- Update to version 3.31.1:
  + Removed the application menu.
  + Updated application icon.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546948800">- Update to version 3.31.2:
  + Improved app icon.
  + Overwrite dialog: added button to skip all existing files when
    extracting.
  + Use G_DECLARE_TYPE boilerplate.
  + Updated translations.
- Disable file-roller-3.4-change-archiver-priority.patch: Needs
  rebase.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550232000">- Update to version 3.31.90:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550491200">- Update to version 3.31.91:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551787200">- Update to version 3.31.92:
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1552392000">- Rebase file-roller-3.4-change-archiver-priority.patch
  (boo#1128813).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552564800">- Update to version 3.32.0:
  + Updated translations.
- Rebase patches with refresh_patches service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 3.32.2:
  + Bugs fixed: Prevents CTRL+F to be activated twice for a single
    key press.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574510400">- Update to version 3.32.3:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581768000">- Update to version 3.32.4:
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1585915200">- Add gcc-fno-common-fix.patch in order to fix boo#1160390.</changelog>
  <changelog author="mgorse@suse.com" date="1589284800">- Update to version 3.32.5 (boo#1171486):
  + libarchive: do not follow external links when extracting files
    (boo#1169428 CVE-2020-11736).
  + libarchive: overwrite symbolic links as well if requested by
    the user.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1622030400">- Add 0001-Fix-use-after-free-in-error-message-reporting.patch:
  Prevent segmentation fault while displaying error message from
  libarchive. (glgo#GNOME/file-roller!48, bsc#1186435)</changelog>
</package>
<package pkgid="0ab5a261d943f6fa1904e103b8db5d688fa6c73e798b5d015c7d9522d2777319" name="file-roller" arch="ppc64le">
  <version epoch="0" ver="3.32.5" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1532347200">- Help translation-update-upstream finding the right gettext domain
  name: pass "po %{name}" to the call.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1532779200">- Update to version 3.29.1:
  + New features and user visible changes: Removed app menu.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1533038400">- Update to version 3.29.90:
  + Restored app menu.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535457600">- Update to version 3.29.91:
  + Bugs fixed:
  - Fixed loading of .epub and .crx files.
  - Path traversal vulnerability. Do not extract files with
    relative paths (bgo#794337).
  + Updated translations.
- Refresh patches with quilt, use autosetup macro.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 3.30.0:
  + Updated translations.
- Remove lang package from recommended package as it already
  supplements main package (same effect, it's redundant).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 3.30.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546516800">- Update to version 3.31.1:
  + Removed the application menu.
  + Updated application icon.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546948800">- Update to version 3.31.2:
  + Improved app icon.
  + Overwrite dialog: added button to skip all existing files when
    extracting.
  + Use G_DECLARE_TYPE boilerplate.
  + Updated translations.
- Disable file-roller-3.4-change-archiver-priority.patch: Needs
  rebase.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550232000">- Update to version 3.31.90:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550491200">- Update to version 3.31.91:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551787200">- Update to version 3.31.92:
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1552392000">- Rebase file-roller-3.4-change-archiver-priority.patch
  (boo#1128813).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552564800">- Update to version 3.32.0:
  + Updated translations.
- Rebase patches with refresh_patches service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 3.32.2:
  + Bugs fixed: Prevents CTRL+F to be activated twice for a single
    key press.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574510400">- Update to version 3.32.3:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581768000">- Update to version 3.32.4:
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1585915200">- Add gcc-fno-common-fix.patch in order to fix boo#1160390.</changelog>
  <changelog author="mgorse@suse.com" date="1589284800">- Update to version 3.32.5 (boo#1171486):
  + libarchive: do not follow external links when extracting files
    (boo#1169428 CVE-2020-11736).
  + libarchive: overwrite symbolic links as well if requested by
    the user.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1622030400">- Add 0001-Fix-use-after-free-in-error-message-reporting.patch:
  Prevent segmentation fault while displaying error message from
  libarchive. (glgo#GNOME/file-roller!48, bsc#1186435)</changelog>
</package>
<package pkgid="1feacdb9cc8ea89a543ae99f89891686fc19ded5b7476452add62349fc815edc" name="file-roller" arch="s390x">
  <version epoch="0" ver="3.32.5" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1532347200">- Help translation-update-upstream finding the right gettext domain
  name: pass "po %{name}" to the call.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1532779200">- Update to version 3.29.1:
  + New features and user visible changes: Removed app menu.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1533038400">- Update to version 3.29.90:
  + Restored app menu.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535457600">- Update to version 3.29.91:
  + Bugs fixed:
  - Fixed loading of .epub and .crx files.
  - Path traversal vulnerability. Do not extract files with
    relative paths (bgo#794337).
  + Updated translations.
- Refresh patches with quilt, use autosetup macro.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 3.30.0:
  + Updated translations.
- Remove lang package from recommended package as it already
  supplements main package (same effect, it's redundant).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 3.30.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546516800">- Update to version 3.31.1:
  + Removed the application menu.
  + Updated application icon.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546948800">- Update to version 3.31.2:
  + Improved app icon.
  + Overwrite dialog: added button to skip all existing files when
    extracting.
  + Use G_DECLARE_TYPE boilerplate.
  + Updated translations.
- Disable file-roller-3.4-change-archiver-priority.patch: Needs
  rebase.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550232000">- Update to version 3.31.90:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550491200">- Update to version 3.31.91:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551787200">- Update to version 3.31.92:
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1552392000">- Rebase file-roller-3.4-change-archiver-priority.patch
  (boo#1128813).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552564800">- Update to version 3.32.0:
  + Updated translations.
- Rebase patches with refresh_patches service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 3.32.2:
  + Bugs fixed: Prevents CTRL+F to be activated twice for a single
    key press.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574510400">- Update to version 3.32.3:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581768000">- Update to version 3.32.4:
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1585915200">- Add gcc-fno-common-fix.patch in order to fix boo#1160390.</changelog>
  <changelog author="mgorse@suse.com" date="1589284800">- Update to version 3.32.5 (boo#1171486):
  + libarchive: do not follow external links when extracting files
    (boo#1169428 CVE-2020-11736).
  + libarchive: overwrite symbolic links as well if requested by
    the user.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1622030400">- Add 0001-Fix-use-after-free-in-error-message-reporting.patch:
  Prevent segmentation fault while displaying error message from
  libarchive. (glgo#GNOME/file-roller!48, bsc#1186435)</changelog>
</package>
<package pkgid="8e0ae68ae647e5d14dba1b8078beec4d7cfc229873bdd36163040317792834b3" name="file-roller" arch="src">
  <version epoch="0" ver="3.32.5" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1532347200">- Help translation-update-upstream finding the right gettext domain
  name: pass "po %{name}" to the call.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1532779200">- Update to version 3.29.1:
  + New features and user visible changes: Removed app menu.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1533038400">- Update to version 3.29.90:
  + Restored app menu.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535457600">- Update to version 3.29.91:
  + Bugs fixed:
  - Fixed loading of .epub and .crx files.
  - Path traversal vulnerability. Do not extract files with
    relative paths (bgo#794337).
  + Updated translations.
- Refresh patches with quilt, use autosetup macro.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 3.30.0:
  + Updated translations.
- Remove lang package from recommended package as it already
  supplements main package (same effect, it's redundant).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 3.30.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546516800">- Update to version 3.31.1:
  + Removed the application menu.
  + Updated application icon.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546948800">- Update to version 3.31.2:
  + Improved app icon.
  + Overwrite dialog: added button to skip all existing files when
    extracting.
  + Use G_DECLARE_TYPE boilerplate.
  + Updated translations.
- Disable file-roller-3.4-change-archiver-priority.patch: Needs
  rebase.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550232000">- Update to version 3.31.90:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550491200">- Update to version 3.31.91:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551787200">- Update to version 3.31.92:
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1552392000">- Rebase file-roller-3.4-change-archiver-priority.patch
  (boo#1128813).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552564800">- Update to version 3.32.0:
  + Updated translations.
- Rebase patches with refresh_patches service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 3.32.2:
  + Bugs fixed: Prevents CTRL+F to be activated twice for a single
    key press.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574510400">- Update to version 3.32.3:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581768000">- Update to version 3.32.4:
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1585915200">- Add gcc-fno-common-fix.patch in order to fix boo#1160390.</changelog>
  <changelog author="mgorse@suse.com" date="1589284800">- Update to version 3.32.5 (boo#1171486):
  + libarchive: do not follow external links when extracting files
    (boo#1169428 CVE-2020-11736).
  + libarchive: overwrite symbolic links as well if requested by
    the user.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1622030400">- Add 0001-Fix-use-after-free-in-error-message-reporting.patch:
  Prevent segmentation fault while displaying error message from
  libarchive. (glgo#GNOME/file-roller!48, bsc#1186435)</changelog>
</package>
<package pkgid="4569b4a5c92da64e1e8014dd28dd9d2ec2147a41c1a5ad788c052ce4a2f9d4c2" name="file-roller" arch="x86_64">
  <version epoch="0" ver="3.32.5" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1532347200">- Help translation-update-upstream finding the right gettext domain
  name: pass "po %{name}" to the call.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1532779200">- Update to version 3.29.1:
  + New features and user visible changes: Removed app menu.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1533038400">- Update to version 3.29.90:
  + Restored app menu.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535457600">- Update to version 3.29.91:
  + Bugs fixed:
  - Fixed loading of .epub and .crx files.
  - Path traversal vulnerability. Do not extract files with
    relative paths (bgo#794337).
  + Updated translations.
- Refresh patches with quilt, use autosetup macro.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 3.30.0:
  + Updated translations.
- Remove lang package from recommended package as it already
  supplements main package (same effect, it's redundant).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 3.30.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546516800">- Update to version 3.31.1:
  + Removed the application menu.
  + Updated application icon.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546948800">- Update to version 3.31.2:
  + Improved app icon.
  + Overwrite dialog: added button to skip all existing files when
    extracting.
  + Use G_DECLARE_TYPE boilerplate.
  + Updated translations.
- Disable file-roller-3.4-change-archiver-priority.patch: Needs
  rebase.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550232000">- Update to version 3.31.90:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550491200">- Update to version 3.31.91:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551787200">- Update to version 3.31.92:
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1552392000">- Rebase file-roller-3.4-change-archiver-priority.patch
  (boo#1128813).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552564800">- Update to version 3.32.0:
  + Updated translations.
- Rebase patches with refresh_patches service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 3.32.2:
  + Bugs fixed: Prevents CTRL+F to be activated twice for a single
    key press.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574510400">- Update to version 3.32.3:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581768000">- Update to version 3.32.4:
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1585915200">- Add gcc-fno-common-fix.patch in order to fix boo#1160390.</changelog>
  <changelog author="mgorse@suse.com" date="1589284800">- Update to version 3.32.5 (boo#1171486):
  + libarchive: do not follow external links when extracting files
    (boo#1169428 CVE-2020-11736).
  + libarchive: overwrite symbolic links as well if requested by
    the user.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1622030400">- Add 0001-Fix-use-after-free-in-error-message-reporting.patch:
  Prevent segmentation fault while displaying error message from
  libarchive. (glgo#GNOME/file-roller!48, bsc#1186435)</changelog>
</package>
<package pkgid="390997270ee9c86f1457ef17e9ca46a018675283787c9ec73eaa90dc381f6346" name="file-roller-lang" arch="noarch">
  <version epoch="0" ver="3.32.5" rel="3.3.1"/>
  <changelog author="dimstar@opensuse.org" date="1532347200">- Help translation-update-upstream finding the right gettext domain
  name: pass "po %{name}" to the call.</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1532779200">- Update to version 3.29.1:
  + New features and user visible changes: Removed app menu.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1533038400">- Update to version 3.29.90:
  + Restored app menu.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535457600">- Update to version 3.29.91:
  + Bugs fixed:
  - Fixed loading of .epub and .crx files.
  - Path traversal vulnerability. Do not extract files with
    relative paths (bgo#794337).
  + Updated translations.
- Refresh patches with quilt, use autosetup macro.</changelog>
  <changelog author="antoine.belvire@opensuse.org" date="1536494400">- Update to version 3.30.0:
  + Updated translations.
- Remove lang package from recommended package as it already
  supplements main package (same effect, it's redundant).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1537963200">- Update to version 3.30.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546516800">- Update to version 3.31.1:
  + Removed the application menu.
  + Updated application icon.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1546948800">- Update to version 3.31.2:
  + Improved app icon.
  + Overwrite dialog: added button to skip all existing files when
    extracting.
  + Use G_DECLARE_TYPE boilerplate.
  + Updated translations.
- Disable file-roller-3.4-change-archiver-priority.patch: Needs
  rebase.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550232000">- Update to version 3.31.90:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1550491200">- Update to version 3.31.91:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1551787200">- Update to version 3.31.92:
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1552392000">- Rebase file-roller-3.4-change-archiver-priority.patch
  (boo#1128813).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1552564800">- Update to version 3.32.0:
  + Updated translations.
- Rebase patches with refresh_patches service.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1554897600">- Update to version 3.32.1:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1568030400">- Update to version 3.32.2:
  + Bugs fixed: Prevents CTRL+F to be activated twice for a single
    key press.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574510400">- Update to version 3.32.3:
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581768000">- Update to version 3.32.4:
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1585915200">- Add gcc-fno-common-fix.patch in order to fix boo#1160390.</changelog>
  <changelog author="mgorse@suse.com" date="1589284800">- Update to version 3.32.5 (boo#1171486):
  + libarchive: do not follow external links when extracting files
    (boo#1169428 CVE-2020-11736).
  + libarchive: overwrite symbolic links as well if requested by
    the user.
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1622030400">- Add 0001-Fix-use-after-free-in-error-message-reporting.patch:
  Prevent segmentation fault while displaying error message from
  libarchive. (glgo#GNOME/file-roller!48, bsc#1186435)</changelog>
</package>
<package pkgid="6e9c88e1de132e2bfca2e57928333a2c4d16af074a5cbde867cda15263b3eb74" name="finch" arch="aarch64">
  <version epoch="0" ver="2.13.0" rel="12.3.1"/>
  <changelog author="fezhang@suse.com" date="1467633600">- Update to GNOME 3.20.2  Fate#318572
  + Drop pidgin-CVE-2014-3695 (bsc#902409): fixed upstream.
  + Drop pidgin-CVE-2014-3696 (bsc#902410): fixed upstream.
  + Drop pidgin-CVE-2014-3698 (bsc#902408): fixed upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1469188800">- Drop additional pkgconfig require (already implicitly detected),
  but explicitly buildrequire it for /usr/lib/rpm/pkgconfigdeps.sh.</changelog>
  <changelog author="fezhang@suse.com" date="1479816000">- Add pidgin-sasl-skip-external.patch:
  Backport upstream commit 6106566. Makes Freenode and other
  servers that prefer SASL EXTERNAL fingerprint authentication
  work again (bsc#1009974).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481112000">- Build with GStreamer 1.x on SLE 12 SP2.
- Apply pidgin-use-default-alsa.patch for SLE 12+ only properly.
- Provide libpurple-branding-upstream for SLE 11 as well.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481198400">- Make libpurple require libpurple-branding.
- Correctly remove *.so files for plugins
  (fixes devel-file-in-non-devel-package).
- Rename libpurple-meanwhile to libpurple-plugin-sametime.
- Remove generation of a plugin list to package, simply add it all
  in %files with exclusions.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1489147200">- Update to version 2.12.0 (FATE#323136):
  + libpurple:
  - Fix an out of bounds memory read in
    purple_markup_unescape_entity (CVE-2017-2640, bsc#1028835).
  - Fix the use of uninitialised memory if running
    non-debug-enabled versions of glib.
  - Update AIM dev and dist ID's to new ones that were assigned
    by AOL.
  - TLS certificate verification now uses SHA-256 checksums.
  - Fix the SASL external auth for Freenode (boo#1009974).
  - Remove the MSN protocol plugin. It has been unusable and
    dormant for some time.
  - Remove the Mxit protocol plugin. The service was closed at
    the end ofSeptember 2016.
  - Remove the MySpaceIM protocol plugin. The service has been
    defunct for a long time (pidgin.im#15356).
  - Remove the Yahoo! protocol plugin. Yahoo has completely
    reimplemented their protocol, so this version is no longer
    operable as of August 5th, 2016.
  - Remove the Facebook (XMPP) account option. According to
    https://developers.facebook.com/docs/chat the XMPP Chat API
    service ended April 30th, 2015.
  - Fix gnutls certificate validation errors that mainly
    affected Google.
  + General:
  - Replace instances of d.pidgin.im with developer.pidgin.im and
    update the urls to use https (pidgin.im#17036).
  + IRC:
  - Fix an issue of messages being silently cut off at 500
    characters. Large messages are now split into parts and sent
    one by one (pidgin.im#4753).
- Rebase pidgin-nonblock-common.patch.
- Remove pidgin-sasl-skip-external.patch.
- Remove pidgin-NLD-smiley-theme.tar.bz2, deprecated.
- Remove pidgin-Tango-smiley-theme.tar.bz2, deprecated</changelog>
  <changelog author="tchvatal@suse.com" date="1500724800">- Drop dependency over silc-toolkit-devel as we want to remove
  it from the distribution</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Explicitly require python2</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1510056000">- Correct the licence to GPL-2.0.</changelog>
  <changelog author="fezhang@suse.com" date="1511265600">- Add purple-import-empathy Recommends for SLE15 (FATE#322984).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1514548800">- Remove pidgin-crash-missing-gst-registry.patch: is useless now
  and is potentially harmful.
- Merge pidgin-nonblock-common2.patch to
  pidgin-nonblock-common.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Update pidgin-ncurses-6.0-accessors.patch to cope with ncurses
  enabling opaque-panels. Pidgin should not access internal
  structures of ncurses.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520337601">- Drop support for SLE 11 and openSUSE older than 42.x.
- Remove pidgin-gnome-keyring.patch: was only useful for SLE 11.</changelog>
  <changelog author="mgorse@suse.com" date="1520337602">- Add pidgin-2.10.11-purple-remote-python3.patch: port
  purple-remote to python 3 (bsc#1084147).
- Export PYTHON=python3 in %build.
- Adjust scripts to invoke python3, not python2.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520596800">- Update to version 2.13.0:
  + libpurple:
  * Unified string comparison.
  * Properlly shell escape URI's when opening them.
  * Fix a one byte buffer overread in function
    purple_markup_linkify.
  * Fix an issue were utf8 was incorrectly truncated which could
    lead to crashes as we were potentially feeding garbage into
    glib/gtk.
  + libgnt:
  * Partially fix building against curses 6.0 with opaque
    structs set (pidgin.im#16764).
  * Fix a crash when resizing the window (pidgin.im#16680).
  + General:
  * Fix a bashism in autotools (pidgin.im#16836).
  + XMPP:
  * Show XEP-0066 OOB URLs in any message, not just headlines.
  * Fix a user after free (pidgin.im#17200).
  * Remove pipelining from BOSH connections (pidgin.im#17025).
  * Don't try to TLS already secured BOSH connections
    (pidgin.im#17270).
  + IRC:
  * Fix "Registration timeout" on SASL auth with InspIRCd
    servers (and possibly others not based on
    charybdis/ratbox/ircd-seven).
  * Fix issues with plugins that modify outgoing messages (such
    as the custom PART/QUIT feature of the IRC More plugin).
  * Fix IRC buffer handling (pidgin.im#12562).
  * Properly handle AUTHENTICATE as a normal command with server
    prefix.
  * Fix a crash caused by a use after free of the MOTD.
  * Fix an out of bounds read in irc_nick_skip_mode.
  * Fix a write of a single byte before the start of a buffer in
    irc_parse_ctcp.
  + Pidgin:
  * Better support for dark themes (pidgin.im#12572).
  * Fix IPv6 links by not escaping []'s. (pidgin.im#16391).
  * Only write buddy icons to the cache if they're not already
    cached.
  * Rejoin persistent chats after reconnect (pidgin.im#15687).
  * Make the WIN32 Transparency plugin work on all platforms
    (pidgin.im#3124).
  * Ensure search results buttons are labelled.
  * Fix matching unicode emoticons (pidgin.im#17232).
  * Correctly update mute/unmute status when the remote side
    mutes/unmutes us (pidgin.im#17273).
  * Rework the status icon blinking to not use deprecated API
    (pidgin.im#17174).
  * Do not allow adding a buddy to protocols that don't have an
    add_buddy callback.
  + Finch:
  * Fix handling of search results (pidgin.im#17238).
  + Voice &amp; Video:
  * Port backend-fs to newer api for farstream relay-info
    property (pidgin.im#17274).
- Rebase pidgin-ncurses-6.0-accessors.patch.
- Remove pidgin-2.10.11-purple-remote-python3.patch: fixed
  upstream.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Instead of removing the libjabber.so, liboscar.so symlinks, move
  them to the devel package.</changelog>
  <changelog author="fezhang@suse.com" date="1523534400">- Add pidgin-enable-sni-gnutls.patch: Enable SNI for gnutls to
  avoid SSL handshake failure, patch written by Tiago Herrmann
  (therrmann@suse.com) (bsc#1086439, pidgin.im#17300).</changelog>
  <changelog author="dimstar@opensuse.org" date="1523966400">- Drop pkgconfig(NetworkManager) BuildRequires and Requires: this
  legacy symbol is no longer maintained and pidgin is not yet
  ready to move to libnm. As a side-effect, we no longer depend on
  NM for all situations, even if the system were to run wicked.
- Replace --enable-nm configure parameter with --disable-nm.</changelog>
  <changelog author="fezhang@suse.com" date="1571745600">- Add pidgin-Leaky-deprecation-clean-ups.patch: Fix warnings of
  deprecation of GParameter that result in build failures of
  plugins that build with -Werror (pidgin.im#17415).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624536000">- Add pidgin-add-no_proxy-support.patch: add support of no_proxy
  environment variable. (jsc#SLE-17111, pidgin.im#17518)</changelog>
</package>
<package pkgid="15abc76cc6a6414af4379499068086ee1f4845de210477e413e5adaa64bc9eb2" name="finch" arch="ppc64le">
  <version epoch="0" ver="2.13.0" rel="12.3.1"/>
  <changelog author="fezhang@suse.com" date="1467633600">- Update to GNOME 3.20.2  Fate#318572
  + Drop pidgin-CVE-2014-3695 (bsc#902409): fixed upstream.
  + Drop pidgin-CVE-2014-3696 (bsc#902410): fixed upstream.
  + Drop pidgin-CVE-2014-3698 (bsc#902408): fixed upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1469188800">- Drop additional pkgconfig require (already implicitly detected),
  but explicitly buildrequire it for /usr/lib/rpm/pkgconfigdeps.sh.</changelog>
  <changelog author="fezhang@suse.com" date="1479816000">- Add pidgin-sasl-skip-external.patch:
  Backport upstream commit 6106566. Makes Freenode and other
  servers that prefer SASL EXTERNAL fingerprint authentication
  work again (bsc#1009974).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481112000">- Build with GStreamer 1.x on SLE 12 SP2.
- Apply pidgin-use-default-alsa.patch for SLE 12+ only properly.
- Provide libpurple-branding-upstream for SLE 11 as well.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481198400">- Make libpurple require libpurple-branding.
- Correctly remove *.so files for plugins
  (fixes devel-file-in-non-devel-package).
- Rename libpurple-meanwhile to libpurple-plugin-sametime.
- Remove generation of a plugin list to package, simply add it all
  in %files with exclusions.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1489147200">- Update to version 2.12.0 (FATE#323136):
  + libpurple:
  - Fix an out of bounds memory read in
    purple_markup_unescape_entity (CVE-2017-2640, bsc#1028835).
  - Fix the use of uninitialised memory if running
    non-debug-enabled versions of glib.
  - Update AIM dev and dist ID's to new ones that were assigned
    by AOL.
  - TLS certificate verification now uses SHA-256 checksums.
  - Fix the SASL external auth for Freenode (boo#1009974).
  - Remove the MSN protocol plugin. It has been unusable and
    dormant for some time.
  - Remove the Mxit protocol plugin. The service was closed at
    the end ofSeptember 2016.
  - Remove the MySpaceIM protocol plugin. The service has been
    defunct for a long time (pidgin.im#15356).
  - Remove the Yahoo! protocol plugin. Yahoo has completely
    reimplemented their protocol, so this version is no longer
    operable as of August 5th, 2016.
  - Remove the Facebook (XMPP) account option. According to
    https://developers.facebook.com/docs/chat the XMPP Chat API
    service ended April 30th, 2015.
  - Fix gnutls certificate validation errors that mainly
    affected Google.
  + General:
  - Replace instances of d.pidgin.im with developer.pidgin.im and
    update the urls to use https (pidgin.im#17036).
  + IRC:
  - Fix an issue of messages being silently cut off at 500
    characters. Large messages are now split into parts and sent
    one by one (pidgin.im#4753).
- Rebase pidgin-nonblock-common.patch.
- Remove pidgin-sasl-skip-external.patch.
- Remove pidgin-NLD-smiley-theme.tar.bz2, deprecated.
- Remove pidgin-Tango-smiley-theme.tar.bz2, deprecated</changelog>
  <changelog author="tchvatal@suse.com" date="1500724800">- Drop dependency over silc-toolkit-devel as we want to remove
  it from the distribution</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Explicitly require python2</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1510056000">- Correct the licence to GPL-2.0.</changelog>
  <changelog author="fezhang@suse.com" date="1511265600">- Add purple-import-empathy Recommends for SLE15 (FATE#322984).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1514548800">- Remove pidgin-crash-missing-gst-registry.patch: is useless now
  and is potentially harmful.
- Merge pidgin-nonblock-common2.patch to
  pidgin-nonblock-common.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Update pidgin-ncurses-6.0-accessors.patch to cope with ncurses
  enabling opaque-panels. Pidgin should not access internal
  structures of ncurses.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520337601">- Drop support for SLE 11 and openSUSE older than 42.x.
- Remove pidgin-gnome-keyring.patch: was only useful for SLE 11.</changelog>
  <changelog author="mgorse@suse.com" date="1520337602">- Add pidgin-2.10.11-purple-remote-python3.patch: port
  purple-remote to python 3 (bsc#1084147).
- Export PYTHON=python3 in %build.
- Adjust scripts to invoke python3, not python2.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520596800">- Update to version 2.13.0:
  + libpurple:
  * Unified string comparison.
  * Properlly shell escape URI's when opening them.
  * Fix a one byte buffer overread in function
    purple_markup_linkify.
  * Fix an issue were utf8 was incorrectly truncated which could
    lead to crashes as we were potentially feeding garbage into
    glib/gtk.
  + libgnt:
  * Partially fix building against curses 6.0 with opaque
    structs set (pidgin.im#16764).
  * Fix a crash when resizing the window (pidgin.im#16680).
  + General:
  * Fix a bashism in autotools (pidgin.im#16836).
  + XMPP:
  * Show XEP-0066 OOB URLs in any message, not just headlines.
  * Fix a user after free (pidgin.im#17200).
  * Remove pipelining from BOSH connections (pidgin.im#17025).
  * Don't try to TLS already secured BOSH connections
    (pidgin.im#17270).
  + IRC:
  * Fix "Registration timeout" on SASL auth with InspIRCd
    servers (and possibly others not based on
    charybdis/ratbox/ircd-seven).
  * Fix issues with plugins that modify outgoing messages (such
    as the custom PART/QUIT feature of the IRC More plugin).
  * Fix IRC buffer handling (pidgin.im#12562).
  * Properly handle AUTHENTICATE as a normal command with server
    prefix.
  * Fix a crash caused by a use after free of the MOTD.
  * Fix an out of bounds read in irc_nick_skip_mode.
  * Fix a write of a single byte before the start of a buffer in
    irc_parse_ctcp.
  + Pidgin:
  * Better support for dark themes (pidgin.im#12572).
  * Fix IPv6 links by not escaping []'s. (pidgin.im#16391).
  * Only write buddy icons to the cache if they're not already
    cached.
  * Rejoin persistent chats after reconnect (pidgin.im#15687).
  * Make the WIN32 Transparency plugin work on all platforms
    (pidgin.im#3124).
  * Ensure search results buttons are labelled.
  * Fix matching unicode emoticons (pidgin.im#17232).
  * Correctly update mute/unmute status when the remote side
    mutes/unmutes us (pidgin.im#17273).
  * Rework the status icon blinking to not use deprecated API
    (pidgin.im#17174).
  * Do not allow adding a buddy to protocols that don't have an
    add_buddy callback.
  + Finch:
  * Fix handling of search results (pidgin.im#17238).
  + Voice &amp; Video:
  * Port backend-fs to newer api for farstream relay-info
    property (pidgin.im#17274).
- Rebase pidgin-ncurses-6.0-accessors.patch.
- Remove pidgin-2.10.11-purple-remote-python3.patch: fixed
  upstream.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Instead of removing the libjabber.so, liboscar.so symlinks, move
  them to the devel package.</changelog>
  <changelog author="fezhang@suse.com" date="1523534400">- Add pidgin-enable-sni-gnutls.patch: Enable SNI for gnutls to
  avoid SSL handshake failure, patch written by Tiago Herrmann
  (therrmann@suse.com) (bsc#1086439, pidgin.im#17300).</changelog>
  <changelog author="dimstar@opensuse.org" date="1523966400">- Drop pkgconfig(NetworkManager) BuildRequires and Requires: this
  legacy symbol is no longer maintained and pidgin is not yet
  ready to move to libnm. As a side-effect, we no longer depend on
  NM for all situations, even if the system were to run wicked.
- Replace --enable-nm configure parameter with --disable-nm.</changelog>
  <changelog author="fezhang@suse.com" date="1571745600">- Add pidgin-Leaky-deprecation-clean-ups.patch: Fix warnings of
  deprecation of GParameter that result in build failures of
  plugins that build with -Werror (pidgin.im#17415).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624536000">- Add pidgin-add-no_proxy-support.patch: add support of no_proxy
  environment variable. (jsc#SLE-17111, pidgin.im#17518)</changelog>
</package>
<package pkgid="9d5341297fa7604cebe878d1a7318cd8dbc13ab2603e7cbc822f43aa3b626b9c" name="finch" arch="s390x">
  <version epoch="0" ver="2.13.0" rel="12.3.1"/>
  <changelog author="fezhang@suse.com" date="1467633600">- Update to GNOME 3.20.2  Fate#318572
  + Drop pidgin-CVE-2014-3695 (bsc#902409): fixed upstream.
  + Drop pidgin-CVE-2014-3696 (bsc#902410): fixed upstream.
  + Drop pidgin-CVE-2014-3698 (bsc#902408): fixed upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1469188800">- Drop additional pkgconfig require (already implicitly detected),
  but explicitly buildrequire it for /usr/lib/rpm/pkgconfigdeps.sh.</changelog>
  <changelog author="fezhang@suse.com" date="1479816000">- Add pidgin-sasl-skip-external.patch:
  Backport upstream commit 6106566. Makes Freenode and other
  servers that prefer SASL EXTERNAL fingerprint authentication
  work again (bsc#1009974).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481112000">- Build with GStreamer 1.x on SLE 12 SP2.
- Apply pidgin-use-default-alsa.patch for SLE 12+ only properly.
- Provide libpurple-branding-upstream for SLE 11 as well.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481198400">- Make libpurple require libpurple-branding.
- Correctly remove *.so files for plugins
  (fixes devel-file-in-non-devel-package).
- Rename libpurple-meanwhile to libpurple-plugin-sametime.
- Remove generation of a plugin list to package, simply add it all
  in %files with exclusions.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1489147200">- Update to version 2.12.0 (FATE#323136):
  + libpurple:
  - Fix an out of bounds memory read in
    purple_markup_unescape_entity (CVE-2017-2640, bsc#1028835).
  - Fix the use of uninitialised memory if running
    non-debug-enabled versions of glib.
  - Update AIM dev and dist ID's to new ones that were assigned
    by AOL.
  - TLS certificate verification now uses SHA-256 checksums.
  - Fix the SASL external auth for Freenode (boo#1009974).
  - Remove the MSN protocol plugin. It has been unusable and
    dormant for some time.
  - Remove the Mxit protocol plugin. The service was closed at
    the end ofSeptember 2016.
  - Remove the MySpaceIM protocol plugin. The service has been
    defunct for a long time (pidgin.im#15356).
  - Remove the Yahoo! protocol plugin. Yahoo has completely
    reimplemented their protocol, so this version is no longer
    operable as of August 5th, 2016.
  - Remove the Facebook (XMPP) account option. According to
    https://developers.facebook.com/docs/chat the XMPP Chat API
    service ended April 30th, 2015.
  - Fix gnutls certificate validation errors that mainly
    affected Google.
  + General:
  - Replace instances of d.pidgin.im with developer.pidgin.im and
    update the urls to use https (pidgin.im#17036).
  + IRC:
  - Fix an issue of messages being silently cut off at 500
    characters. Large messages are now split into parts and sent
    one by one (pidgin.im#4753).
- Rebase pidgin-nonblock-common.patch.
- Remove pidgin-sasl-skip-external.patch.
- Remove pidgin-NLD-smiley-theme.tar.bz2, deprecated.
- Remove pidgin-Tango-smiley-theme.tar.bz2, deprecated</changelog>
  <changelog author="tchvatal@suse.com" date="1500724800">- Drop dependency over silc-toolkit-devel as we want to remove
  it from the distribution</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Explicitly require python2</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1510056000">- Correct the licence to GPL-2.0.</changelog>
  <changelog author="fezhang@suse.com" date="1511265600">- Add purple-import-empathy Recommends for SLE15 (FATE#322984).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1514548800">- Remove pidgin-crash-missing-gst-registry.patch: is useless now
  and is potentially harmful.
- Merge pidgin-nonblock-common2.patch to
  pidgin-nonblock-common.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Update pidgin-ncurses-6.0-accessors.patch to cope with ncurses
  enabling opaque-panels. Pidgin should not access internal
  structures of ncurses.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520337601">- Drop support for SLE 11 and openSUSE older than 42.x.
- Remove pidgin-gnome-keyring.patch: was only useful for SLE 11.</changelog>
  <changelog author="mgorse@suse.com" date="1520337602">- Add pidgin-2.10.11-purple-remote-python3.patch: port
  purple-remote to python 3 (bsc#1084147).
- Export PYTHON=python3 in %build.
- Adjust scripts to invoke python3, not python2.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520596800">- Update to version 2.13.0:
  + libpurple:
  * Unified string comparison.
  * Properlly shell escape URI's when opening them.
  * Fix a one byte buffer overread in function
    purple_markup_linkify.
  * Fix an issue were utf8 was incorrectly truncated which could
    lead to crashes as we were potentially feeding garbage into
    glib/gtk.
  + libgnt:
  * Partially fix building against curses 6.0 with opaque
    structs set (pidgin.im#16764).
  * Fix a crash when resizing the window (pidgin.im#16680).
  + General:
  * Fix a bashism in autotools (pidgin.im#16836).
  + XMPP:
  * Show XEP-0066 OOB URLs in any message, not just headlines.
  * Fix a user after free (pidgin.im#17200).
  * Remove pipelining from BOSH connections (pidgin.im#17025).
  * Don't try to TLS already secured BOSH connections
    (pidgin.im#17270).
  + IRC:
  * Fix "Registration timeout" on SASL auth with InspIRCd
    servers (and possibly others not based on
    charybdis/ratbox/ircd-seven).
  * Fix issues with plugins that modify outgoing messages (such
    as the custom PART/QUIT feature of the IRC More plugin).
  * Fix IRC buffer handling (pidgin.im#12562).
  * Properly handle AUTHENTICATE as a normal command with server
    prefix.
  * Fix a crash caused by a use after free of the MOTD.
  * Fix an out of bounds read in irc_nick_skip_mode.
  * Fix a write of a single byte before the start of a buffer in
    irc_parse_ctcp.
  + Pidgin:
  * Better support for dark themes (pidgin.im#12572).
  * Fix IPv6 links by not escaping []'s. (pidgin.im#16391).
  * Only write buddy icons to the cache if they're not already
    cached.
  * Rejoin persistent chats after reconnect (pidgin.im#15687).
  * Make the WIN32 Transparency plugin work on all platforms
    (pidgin.im#3124).
  * Ensure search results buttons are labelled.
  * Fix matching unicode emoticons (pidgin.im#17232).
  * Correctly update mute/unmute status when the remote side
    mutes/unmutes us (pidgin.im#17273).
  * Rework the status icon blinking to not use deprecated API
    (pidgin.im#17174).
  * Do not allow adding a buddy to protocols that don't have an
    add_buddy callback.
  + Finch:
  * Fix handling of search results (pidgin.im#17238).
  + Voice &amp; Video:
  * Port backend-fs to newer api for farstream relay-info
    property (pidgin.im#17274).
- Rebase pidgin-ncurses-6.0-accessors.patch.
- Remove pidgin-2.10.11-purple-remote-python3.patch: fixed
  upstream.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Instead of removing the libjabber.so, liboscar.so symlinks, move
  them to the devel package.</changelog>
  <changelog author="fezhang@suse.com" date="1523534400">- Add pidgin-enable-sni-gnutls.patch: Enable SNI for gnutls to
  avoid SSL handshake failure, patch written by Tiago Herrmann
  (therrmann@suse.com) (bsc#1086439, pidgin.im#17300).</changelog>
  <changelog author="dimstar@opensuse.org" date="1523966400">- Drop pkgconfig(NetworkManager) BuildRequires and Requires: this
  legacy symbol is no longer maintained and pidgin is not yet
  ready to move to libnm. As a side-effect, we no longer depend on
  NM for all situations, even if the system were to run wicked.
- Replace --enable-nm configure parameter with --disable-nm.</changelog>
  <changelog author="fezhang@suse.com" date="1571745600">- Add pidgin-Leaky-deprecation-clean-ups.patch: Fix warnings of
  deprecation of GParameter that result in build failures of
  plugins that build with -Werror (pidgin.im#17415).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624536000">- Add pidgin-add-no_proxy-support.patch: add support of no_proxy
  environment variable. (jsc#SLE-17111, pidgin.im#17518)</changelog>
</package>
<package pkgid="a2559cac1ca60d120c7f19564d9c74bcd9c6221ba9972e5137b91efea66751a2" name="finch" arch="x86_64">
  <version epoch="0" ver="2.13.0" rel="12.3.1"/>
  <changelog author="fezhang@suse.com" date="1467633600">- Update to GNOME 3.20.2  Fate#318572
  + Drop pidgin-CVE-2014-3695 (bsc#902409): fixed upstream.
  + Drop pidgin-CVE-2014-3696 (bsc#902410): fixed upstream.
  + Drop pidgin-CVE-2014-3698 (bsc#902408): fixed upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1469188800">- Drop additional pkgconfig require (already implicitly detected),
  but explicitly buildrequire it for /usr/lib/rpm/pkgconfigdeps.sh.</changelog>
  <changelog author="fezhang@suse.com" date="1479816000">- Add pidgin-sasl-skip-external.patch:
  Backport upstream commit 6106566. Makes Freenode and other
  servers that prefer SASL EXTERNAL fingerprint authentication
  work again (bsc#1009974).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481112000">- Build with GStreamer 1.x on SLE 12 SP2.
- Apply pidgin-use-default-alsa.patch for SLE 12+ only properly.
- Provide libpurple-branding-upstream for SLE 11 as well.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481198400">- Make libpurple require libpurple-branding.
- Correctly remove *.so files for plugins
  (fixes devel-file-in-non-devel-package).
- Rename libpurple-meanwhile to libpurple-plugin-sametime.
- Remove generation of a plugin list to package, simply add it all
  in %files with exclusions.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1489147200">- Update to version 2.12.0 (FATE#323136):
  + libpurple:
  - Fix an out of bounds memory read in
    purple_markup_unescape_entity (CVE-2017-2640, bsc#1028835).
  - Fix the use of uninitialised memory if running
    non-debug-enabled versions of glib.
  - Update AIM dev and dist ID's to new ones that were assigned
    by AOL.
  - TLS certificate verification now uses SHA-256 checksums.
  - Fix the SASL external auth for Freenode (boo#1009974).
  - Remove the MSN protocol plugin. It has been unusable and
    dormant for some time.
  - Remove the Mxit protocol plugin. The service was closed at
    the end ofSeptember 2016.
  - Remove the MySpaceIM protocol plugin. The service has been
    defunct for a long time (pidgin.im#15356).
  - Remove the Yahoo! protocol plugin. Yahoo has completely
    reimplemented their protocol, so this version is no longer
    operable as of August 5th, 2016.
  - Remove the Facebook (XMPP) account option. According to
    https://developers.facebook.com/docs/chat the XMPP Chat API
    service ended April 30th, 2015.
  - Fix gnutls certificate validation errors that mainly
    affected Google.
  + General:
  - Replace instances of d.pidgin.im with developer.pidgin.im and
    update the urls to use https (pidgin.im#17036).
  + IRC:
  - Fix an issue of messages being silently cut off at 500
    characters. Large messages are now split into parts and sent
    one by one (pidgin.im#4753).
- Rebase pidgin-nonblock-common.patch.
- Remove pidgin-sasl-skip-external.patch.
- Remove pidgin-NLD-smiley-theme.tar.bz2, deprecated.
- Remove pidgin-Tango-smiley-theme.tar.bz2, deprecated</changelog>
  <changelog author="tchvatal@suse.com" date="1500724800">- Drop dependency over silc-toolkit-devel as we want to remove
  it from the distribution</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Explicitly require python2</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1510056000">- Correct the licence to GPL-2.0.</changelog>
  <changelog author="fezhang@suse.com" date="1511265600">- Add purple-import-empathy Recommends for SLE15 (FATE#322984).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1514548800">- Remove pidgin-crash-missing-gst-registry.patch: is useless now
  and is potentially harmful.
- Merge pidgin-nonblock-common2.patch to
  pidgin-nonblock-common.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Update pidgin-ncurses-6.0-accessors.patch to cope with ncurses
  enabling opaque-panels. Pidgin should not access internal
  structures of ncurses.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520337601">- Drop support for SLE 11 and openSUSE older than 42.x.
- Remove pidgin-gnome-keyring.patch: was only useful for SLE 11.</changelog>
  <changelog author="mgorse@suse.com" date="1520337602">- Add pidgin-2.10.11-purple-remote-python3.patch: port
  purple-remote to python 3 (bsc#1084147).
- Export PYTHON=python3 in %build.
- Adjust scripts to invoke python3, not python2.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520596800">- Update to version 2.13.0:
  + libpurple:
  * Unified string comparison.
  * Properlly shell escape URI's when opening them.
  * Fix a one byte buffer overread in function
    purple_markup_linkify.
  * Fix an issue were utf8 was incorrectly truncated which could
    lead to crashes as we were potentially feeding garbage into
    glib/gtk.
  + libgnt:
  * Partially fix building against curses 6.0 with opaque
    structs set (pidgin.im#16764).
  * Fix a crash when resizing the window (pidgin.im#16680).
  + General:
  * Fix a bashism in autotools (pidgin.im#16836).
  + XMPP:
  * Show XEP-0066 OOB URLs in any message, not just headlines.
  * Fix a user after free (pidgin.im#17200).
  * Remove pipelining from BOSH connections (pidgin.im#17025).
  * Don't try to TLS already secured BOSH connections
    (pidgin.im#17270).
  + IRC:
  * Fix "Registration timeout" on SASL auth with InspIRCd
    servers (and possibly others not based on
    charybdis/ratbox/ircd-seven).
  * Fix issues with plugins that modify outgoing messages (such
    as the custom PART/QUIT feature of the IRC More plugin).
  * Fix IRC buffer handling (pidgin.im#12562).
  * Properly handle AUTHENTICATE as a normal command with server
    prefix.
  * Fix a crash caused by a use after free of the MOTD.
  * Fix an out of bounds read in irc_nick_skip_mode.
  * Fix a write of a single byte before the start of a buffer in
    irc_parse_ctcp.
  + Pidgin:
  * Better support for dark themes (pidgin.im#12572).
  * Fix IPv6 links by not escaping []'s. (pidgin.im#16391).
  * Only write buddy icons to the cache if they're not already
    cached.
  * Rejoin persistent chats after reconnect (pidgin.im#15687).
  * Make the WIN32 Transparency plugin work on all platforms
    (pidgin.im#3124).
  * Ensure search results buttons are labelled.
  * Fix matching unicode emoticons (pidgin.im#17232).
  * Correctly update mute/unmute status when the remote side
    mutes/unmutes us (pidgin.im#17273).
  * Rework the status icon blinking to not use deprecated API
    (pidgin.im#17174).
  * Do not allow adding a buddy to protocols that don't have an
    add_buddy callback.
  + Finch:
  * Fix handling of search results (pidgin.im#17238).
  + Voice &amp; Video:
  * Port backend-fs to newer api for farstream relay-info
    property (pidgin.im#17274).
- Rebase pidgin-ncurses-6.0-accessors.patch.
- Remove pidgin-2.10.11-purple-remote-python3.patch: fixed
  upstream.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Instead of removing the libjabber.so, liboscar.so symlinks, move
  them to the devel package.</changelog>
  <changelog author="fezhang@suse.com" date="1523534400">- Add pidgin-enable-sni-gnutls.patch: Enable SNI for gnutls to
  avoid SSL handshake failure, patch written by Tiago Herrmann
  (therrmann@suse.com) (bsc#1086439, pidgin.im#17300).</changelog>
  <changelog author="dimstar@opensuse.org" date="1523966400">- Drop pkgconfig(NetworkManager) BuildRequires and Requires: this
  legacy symbol is no longer maintained and pidgin is not yet
  ready to move to libnm. As a side-effect, we no longer depend on
  NM for all situations, even if the system were to run wicked.
- Replace --enable-nm configure parameter with --disable-nm.</changelog>
  <changelog author="fezhang@suse.com" date="1571745600">- Add pidgin-Leaky-deprecation-clean-ups.patch: Fix warnings of
  deprecation of GParameter that result in build failures of
  plugins that build with -Werror (pidgin.im#17415).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624536000">- Add pidgin-add-no_proxy-support.patch: add support of no_proxy
  environment variable. (jsc#SLE-17111, pidgin.im#17518)</changelog>
</package>
<package pkgid="2f29c2754419cb339dc9ac8704989020cd1573d3355fea27cfb773bb1d1ad032" name="finch-devel" arch="aarch64">
  <version epoch="0" ver="2.13.0" rel="12.3.1"/>
  <changelog author="fezhang@suse.com" date="1467633600">- Update to GNOME 3.20.2  Fate#318572
  + Drop pidgin-CVE-2014-3695 (bsc#902409): fixed upstream.
  + Drop pidgin-CVE-2014-3696 (bsc#902410): fixed upstream.
  + Drop pidgin-CVE-2014-3698 (bsc#902408): fixed upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1469188800">- Drop additional pkgconfig require (already implicitly detected),
  but explicitly buildrequire it for /usr/lib/rpm/pkgconfigdeps.sh.</changelog>
  <changelog author="fezhang@suse.com" date="1479816000">- Add pidgin-sasl-skip-external.patch:
  Backport upstream commit 6106566. Makes Freenode and other
  servers that prefer SASL EXTERNAL fingerprint authentication
  work again (bsc#1009974).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481112000">- Build with GStreamer 1.x on SLE 12 SP2.
- Apply pidgin-use-default-alsa.patch for SLE 12+ only properly.
- Provide libpurple-branding-upstream for SLE 11 as well.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481198400">- Make libpurple require libpurple-branding.
- Correctly remove *.so files for plugins
  (fixes devel-file-in-non-devel-package).
- Rename libpurple-meanwhile to libpurple-plugin-sametime.
- Remove generation of a plugin list to package, simply add it all
  in %files with exclusions.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1489147200">- Update to version 2.12.0 (FATE#323136):
  + libpurple:
  - Fix an out of bounds memory read in
    purple_markup_unescape_entity (CVE-2017-2640, bsc#1028835).
  - Fix the use of uninitialised memory if running
    non-debug-enabled versions of glib.
  - Update AIM dev and dist ID's to new ones that were assigned
    by AOL.
  - TLS certificate verification now uses SHA-256 checksums.
  - Fix the SASL external auth for Freenode (boo#1009974).
  - Remove the MSN protocol plugin. It has been unusable and
    dormant for some time.
  - Remove the Mxit protocol plugin. The service was closed at
    the end ofSeptember 2016.
  - Remove the MySpaceIM protocol plugin. The service has been
    defunct for a long time (pidgin.im#15356).
  - Remove the Yahoo! protocol plugin. Yahoo has completely
    reimplemented their protocol, so this version is no longer
    operable as of August 5th, 2016.
  - Remove the Facebook (XMPP) account option. According to
    https://developers.facebook.com/docs/chat the XMPP Chat API
    service ended April 30th, 2015.
  - Fix gnutls certificate validation errors that mainly
    affected Google.
  + General:
  - Replace instances of d.pidgin.im with developer.pidgin.im and
    update the urls to use https (pidgin.im#17036).
  + IRC:
  - Fix an issue of messages being silently cut off at 500
    characters. Large messages are now split into parts and sent
    one by one (pidgin.im#4753).
- Rebase pidgin-nonblock-common.patch.
- Remove pidgin-sasl-skip-external.patch.
- Remove pidgin-NLD-smiley-theme.tar.bz2, deprecated.
- Remove pidgin-Tango-smiley-theme.tar.bz2, deprecated</changelog>
  <changelog author="tchvatal@suse.com" date="1500724800">- Drop dependency over silc-toolkit-devel as we want to remove
  it from the distribution</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Explicitly require python2</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1510056000">- Correct the licence to GPL-2.0.</changelog>
  <changelog author="fezhang@suse.com" date="1511265600">- Add purple-import-empathy Recommends for SLE15 (FATE#322984).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1514548800">- Remove pidgin-crash-missing-gst-registry.patch: is useless now
  and is potentially harmful.
- Merge pidgin-nonblock-common2.patch to
  pidgin-nonblock-common.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Update pidgin-ncurses-6.0-accessors.patch to cope with ncurses
  enabling opaque-panels. Pidgin should not access internal
  structures of ncurses.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520337601">- Drop support for SLE 11 and openSUSE older than 42.x.
- Remove pidgin-gnome-keyring.patch: was only useful for SLE 11.</changelog>
  <changelog author="mgorse@suse.com" date="1520337602">- Add pidgin-2.10.11-purple-remote-python3.patch: port
  purple-remote to python 3 (bsc#1084147).
- Export PYTHON=python3 in %build.
- Adjust scripts to invoke python3, not python2.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520596800">- Update to version 2.13.0:
  + libpurple:
  * Unified string comparison.
  * Properlly shell escape URI's when opening them.
  * Fix a one byte buffer overread in function
    purple_markup_linkify.
  * Fix an issue were utf8 was incorrectly truncated which could
    lead to crashes as we were potentially feeding garbage into
    glib/gtk.
  + libgnt:
  * Partially fix building against curses 6.0 with opaque
    structs set (pidgin.im#16764).
  * Fix a crash when resizing the window (pidgin.im#16680).
  + General:
  * Fix a bashism in autotools (pidgin.im#16836).
  + XMPP:
  * Show XEP-0066 OOB URLs in any message, not just headlines.
  * Fix a user after free (pidgin.im#17200).
  * Remove pipelining from BOSH connections (pidgin.im#17025).
  * Don't try to TLS already secured BOSH connections
    (pidgin.im#17270).
  + IRC:
  * Fix "Registration timeout" on SASL auth with InspIRCd
    servers (and possibly others not based on
    charybdis/ratbox/ircd-seven).
  * Fix issues with plugins that modify outgoing messages (such
    as the custom PART/QUIT feature of the IRC More plugin).
  * Fix IRC buffer handling (pidgin.im#12562).
  * Properly handle AUTHENTICATE as a normal command with server
    prefix.
  * Fix a crash caused by a use after free of the MOTD.
  * Fix an out of bounds read in irc_nick_skip_mode.
  * Fix a write of a single byte before the start of a buffer in
    irc_parse_ctcp.
  + Pidgin:
  * Better support for dark themes (pidgin.im#12572).
  * Fix IPv6 links by not escaping []'s. (pidgin.im#16391).
  * Only write buddy icons to the cache if they're not already
    cached.
  * Rejoin persistent chats after reconnect (pidgin.im#15687).
  * Make the WIN32 Transparency plugin work on all platforms
    (pidgin.im#3124).
  * Ensure search results buttons are labelled.
  * Fix matching unicode emoticons (pidgin.im#17232).
  * Correctly update mute/unmute status when the remote side
    mutes/unmutes us (pidgin.im#17273).
  * Rework the status icon blinking to not use deprecated API
    (pidgin.im#17174).
  * Do not allow adding a buddy to protocols that don't have an
    add_buddy callback.
  + Finch:
  * Fix handling of search results (pidgin.im#17238).
  + Voice &amp; Video:
  * Port backend-fs to newer api for farstream relay-info
    property (pidgin.im#17274).
- Rebase pidgin-ncurses-6.0-accessors.patch.
- Remove pidgin-2.10.11-purple-remote-python3.patch: fixed
  upstream.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Instead of removing the libjabber.so, liboscar.so symlinks, move
  them to the devel package.</changelog>
  <changelog author="fezhang@suse.com" date="1523534400">- Add pidgin-enable-sni-gnutls.patch: Enable SNI for gnutls to
  avoid SSL handshake failure, patch written by Tiago Herrmann
  (therrmann@suse.com) (bsc#1086439, pidgin.im#17300).</changelog>
  <changelog author="dimstar@opensuse.org" date="1523966400">- Drop pkgconfig(NetworkManager) BuildRequires and Requires: this
  legacy symbol is no longer maintained and pidgin is not yet
  ready to move to libnm. As a side-effect, we no longer depend on
  NM for all situations, even if the system were to run wicked.
- Replace --enable-nm configure parameter with --disable-nm.</changelog>
  <changelog author="fezhang@suse.com" date="1571745600">- Add pidgin-Leaky-deprecation-clean-ups.patch: Fix warnings of
  deprecation of GParameter that result in build failures of
  plugins that build with -Werror (pidgin.im#17415).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624536000">- Add pidgin-add-no_proxy-support.patch: add support of no_proxy
  environment variable. (jsc#SLE-17111, pidgin.im#17518)</changelog>
</package>
<package pkgid="bbe55d640ca956c6d6817bdbe95f2173acf947b7210425500dfedba8af1084f6" name="finch-devel" arch="ppc64le">
  <version epoch="0" ver="2.13.0" rel="12.3.1"/>
  <changelog author="fezhang@suse.com" date="1467633600">- Update to GNOME 3.20.2  Fate#318572
  + Drop pidgin-CVE-2014-3695 (bsc#902409): fixed upstream.
  + Drop pidgin-CVE-2014-3696 (bsc#902410): fixed upstream.
  + Drop pidgin-CVE-2014-3698 (bsc#902408): fixed upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1469188800">- Drop additional pkgconfig require (already implicitly detected),
  but explicitly buildrequire it for /usr/lib/rpm/pkgconfigdeps.sh.</changelog>
  <changelog author="fezhang@suse.com" date="1479816000">- Add pidgin-sasl-skip-external.patch:
  Backport upstream commit 6106566. Makes Freenode and other
  servers that prefer SASL EXTERNAL fingerprint authentication
  work again (bsc#1009974).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481112000">- Build with GStreamer 1.x on SLE 12 SP2.
- Apply pidgin-use-default-alsa.patch for SLE 12+ only properly.
- Provide libpurple-branding-upstream for SLE 11 as well.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481198400">- Make libpurple require libpurple-branding.
- Correctly remove *.so files for plugins
  (fixes devel-file-in-non-devel-package).
- Rename libpurple-meanwhile to libpurple-plugin-sametime.
- Remove generation of a plugin list to package, simply add it all
  in %files with exclusions.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1489147200">- Update to version 2.12.0 (FATE#323136):
  + libpurple:
  - Fix an out of bounds memory read in
    purple_markup_unescape_entity (CVE-2017-2640, bsc#1028835).
  - Fix the use of uninitialised memory if running
    non-debug-enabled versions of glib.
  - Update AIM dev and dist ID's to new ones that were assigned
    by AOL.
  - TLS certificate verification now uses SHA-256 checksums.
  - Fix the SASL external auth for Freenode (boo#1009974).
  - Remove the MSN protocol plugin. It has been unusable and
    dormant for some time.
  - Remove the Mxit protocol plugin. The service was closed at
    the end ofSeptember 2016.
  - Remove the MySpaceIM protocol plugin. The service has been
    defunct for a long time (pidgin.im#15356).
  - Remove the Yahoo! protocol plugin. Yahoo has completely
    reimplemented their protocol, so this version is no longer
    operable as of August 5th, 2016.
  - Remove the Facebook (XMPP) account option. According to
    https://developers.facebook.com/docs/chat the XMPP Chat API
    service ended April 30th, 2015.
  - Fix gnutls certificate validation errors that mainly
    affected Google.
  + General:
  - Replace instances of d.pidgin.im with developer.pidgin.im and
    update the urls to use https (pidgin.im#17036).
  + IRC:
  - Fix an issue of messages being silently cut off at 500
    characters. Large messages are now split into parts and sent
    one by one (pidgin.im#4753).
- Rebase pidgin-nonblock-common.patch.
- Remove pidgin-sasl-skip-external.patch.
- Remove pidgin-NLD-smiley-theme.tar.bz2, deprecated.
- Remove pidgin-Tango-smiley-theme.tar.bz2, deprecated</changelog>
  <changelog author="tchvatal@suse.com" date="1500724800">- Drop dependency over silc-toolkit-devel as we want to remove
  it from the distribution</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Explicitly require python2</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1510056000">- Correct the licence to GPL-2.0.</changelog>
  <changelog author="fezhang@suse.com" date="1511265600">- Add purple-import-empathy Recommends for SLE15 (FATE#322984).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1514548800">- Remove pidgin-crash-missing-gst-registry.patch: is useless now
  and is potentially harmful.
- Merge pidgin-nonblock-common2.patch to
  pidgin-nonblock-common.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Update pidgin-ncurses-6.0-accessors.patch to cope with ncurses
  enabling opaque-panels. Pidgin should not access internal
  structures of ncurses.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520337601">- Drop support for SLE 11 and openSUSE older than 42.x.
- Remove pidgin-gnome-keyring.patch: was only useful for SLE 11.</changelog>
  <changelog author="mgorse@suse.com" date="1520337602">- Add pidgin-2.10.11-purple-remote-python3.patch: port
  purple-remote to python 3 (bsc#1084147).
- Export PYTHON=python3 in %build.
- Adjust scripts to invoke python3, not python2.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520596800">- Update to version 2.13.0:
  + libpurple:
  * Unified string comparison.
  * Properlly shell escape URI's when opening them.
  * Fix a one byte buffer overread in function
    purple_markup_linkify.
  * Fix an issue were utf8 was incorrectly truncated which could
    lead to crashes as we were potentially feeding garbage into
    glib/gtk.
  + libgnt:
  * Partially fix building against curses 6.0 with opaque
    structs set (pidgin.im#16764).
  * Fix a crash when resizing the window (pidgin.im#16680).
  + General:
  * Fix a bashism in autotools (pidgin.im#16836).
  + XMPP:
  * Show XEP-0066 OOB URLs in any message, not just headlines.
  * Fix a user after free (pidgin.im#17200).
  * Remove pipelining from BOSH connections (pidgin.im#17025).
  * Don't try to TLS already secured BOSH connections
    (pidgin.im#17270).
  + IRC:
  * Fix "Registration timeout" on SASL auth with InspIRCd
    servers (and possibly others not based on
    charybdis/ratbox/ircd-seven).
  * Fix issues with plugins that modify outgoing messages (such
    as the custom PART/QUIT feature of the IRC More plugin).
  * Fix IRC buffer handling (pidgin.im#12562).
  * Properly handle AUTHENTICATE as a normal command with server
    prefix.
  * Fix a crash caused by a use after free of the MOTD.
  * Fix an out of bounds read in irc_nick_skip_mode.
  * Fix a write of a single byte before the start of a buffer in
    irc_parse_ctcp.
  + Pidgin:
  * Better support for dark themes (pidgin.im#12572).
  * Fix IPv6 links by not escaping []'s. (pidgin.im#16391).
  * Only write buddy icons to the cache if they're not already
    cached.
  * Rejoin persistent chats after reconnect (pidgin.im#15687).
  * Make the WIN32 Transparency plugin work on all platforms
    (pidgin.im#3124).
  * Ensure search results buttons are labelled.
  * Fix matching unicode emoticons (pidgin.im#17232).
  * Correctly update mute/unmute status when the remote side
    mutes/unmutes us (pidgin.im#17273).
  * Rework the status icon blinking to not use deprecated API
    (pidgin.im#17174).
  * Do not allow adding a buddy to protocols that don't have an
    add_buddy callback.
  + Finch:
  * Fix handling of search results (pidgin.im#17238).
  + Voice &amp; Video:
  * Port backend-fs to newer api for farstream relay-info
    property (pidgin.im#17274).
- Rebase pidgin-ncurses-6.0-accessors.patch.
- Remove pidgin-2.10.11-purple-remote-python3.patch: fixed
  upstream.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Instead of removing the libjabber.so, liboscar.so symlinks, move
  them to the devel package.</changelog>
  <changelog author="fezhang@suse.com" date="1523534400">- Add pidgin-enable-sni-gnutls.patch: Enable SNI for gnutls to
  avoid SSL handshake failure, patch written by Tiago Herrmann
  (therrmann@suse.com) (bsc#1086439, pidgin.im#17300).</changelog>
  <changelog author="dimstar@opensuse.org" date="1523966400">- Drop pkgconfig(NetworkManager) BuildRequires and Requires: this
  legacy symbol is no longer maintained and pidgin is not yet
  ready to move to libnm. As a side-effect, we no longer depend on
  NM for all situations, even if the system were to run wicked.
- Replace --enable-nm configure parameter with --disable-nm.</changelog>
  <changelog author="fezhang@suse.com" date="1571745600">- Add pidgin-Leaky-deprecation-clean-ups.patch: Fix warnings of
  deprecation of GParameter that result in build failures of
  plugins that build with -Werror (pidgin.im#17415).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624536000">- Add pidgin-add-no_proxy-support.patch: add support of no_proxy
  environment variable. (jsc#SLE-17111, pidgin.im#17518)</changelog>
</package>
<package pkgid="ad999988b2ca3c21bf1a481d807fad95149f948c6f61a9fc316b06df71b6bb16" name="finch-devel" arch="s390x">
  <version epoch="0" ver="2.13.0" rel="12.3.1"/>
  <changelog author="fezhang@suse.com" date="1467633600">- Update to GNOME 3.20.2  Fate#318572
  + Drop pidgin-CVE-2014-3695 (bsc#902409): fixed upstream.
  + Drop pidgin-CVE-2014-3696 (bsc#902410): fixed upstream.
  + Drop pidgin-CVE-2014-3698 (bsc#902408): fixed upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1469188800">- Drop additional pkgconfig require (already implicitly detected),
  but explicitly buildrequire it for /usr/lib/rpm/pkgconfigdeps.sh.</changelog>
  <changelog author="fezhang@suse.com" date="1479816000">- Add pidgin-sasl-skip-external.patch:
  Backport upstream commit 6106566. Makes Freenode and other
  servers that prefer SASL EXTERNAL fingerprint authentication
  work again (bsc#1009974).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481112000">- Build with GStreamer 1.x on SLE 12 SP2.
- Apply pidgin-use-default-alsa.patch for SLE 12+ only properly.
- Provide libpurple-branding-upstream for SLE 11 as well.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481198400">- Make libpurple require libpurple-branding.
- Correctly remove *.so files for plugins
  (fixes devel-file-in-non-devel-package).
- Rename libpurple-meanwhile to libpurple-plugin-sametime.
- Remove generation of a plugin list to package, simply add it all
  in %files with exclusions.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1489147200">- Update to version 2.12.0 (FATE#323136):
  + libpurple:
  - Fix an out of bounds memory read in
    purple_markup_unescape_entity (CVE-2017-2640, bsc#1028835).
  - Fix the use of uninitialised memory if running
    non-debug-enabled versions of glib.
  - Update AIM dev and dist ID's to new ones that were assigned
    by AOL.
  - TLS certificate verification now uses SHA-256 checksums.
  - Fix the SASL external auth for Freenode (boo#1009974).
  - Remove the MSN protocol plugin. It has been unusable and
    dormant for some time.
  - Remove the Mxit protocol plugin. The service was closed at
    the end ofSeptember 2016.
  - Remove the MySpaceIM protocol plugin. The service has been
    defunct for a long time (pidgin.im#15356).
  - Remove the Yahoo! protocol plugin. Yahoo has completely
    reimplemented their protocol, so this version is no longer
    operable as of August 5th, 2016.
  - Remove the Facebook (XMPP) account option. According to
    https://developers.facebook.com/docs/chat the XMPP Chat API
    service ended April 30th, 2015.
  - Fix gnutls certificate validation errors that mainly
    affected Google.
  + General:
  - Replace instances of d.pidgin.im with developer.pidgin.im and
    update the urls to use https (pidgin.im#17036).
  + IRC:
  - Fix an issue of messages being silently cut off at 500
    characters. Large messages are now split into parts and sent
    one by one (pidgin.im#4753).
- Rebase pidgin-nonblock-common.patch.
- Remove pidgin-sasl-skip-external.patch.
- Remove pidgin-NLD-smiley-theme.tar.bz2, deprecated.
- Remove pidgin-Tango-smiley-theme.tar.bz2, deprecated</changelog>
  <changelog author="tchvatal@suse.com" date="1500724800">- Drop dependency over silc-toolkit-devel as we want to remove
  it from the distribution</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Explicitly require python2</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1510056000">- Correct the licence to GPL-2.0.</changelog>
  <changelog author="fezhang@suse.com" date="1511265600">- Add purple-import-empathy Recommends for SLE15 (FATE#322984).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1514548800">- Remove pidgin-crash-missing-gst-registry.patch: is useless now
  and is potentially harmful.
- Merge pidgin-nonblock-common2.patch to
  pidgin-nonblock-common.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Update pidgin-ncurses-6.0-accessors.patch to cope with ncurses
  enabling opaque-panels. Pidgin should not access internal
  structures of ncurses.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520337601">- Drop support for SLE 11 and openSUSE older than 42.x.
- Remove pidgin-gnome-keyring.patch: was only useful for SLE 11.</changelog>
  <changelog author="mgorse@suse.com" date="1520337602">- Add pidgin-2.10.11-purple-remote-python3.patch: port
  purple-remote to python 3 (bsc#1084147).
- Export PYTHON=python3 in %build.
- Adjust scripts to invoke python3, not python2.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520596800">- Update to version 2.13.0:
  + libpurple:
  * Unified string comparison.
  * Properlly shell escape URI's when opening them.
  * Fix a one byte buffer overread in function
    purple_markup_linkify.
  * Fix an issue were utf8 was incorrectly truncated which could
    lead to crashes as we were potentially feeding garbage into
    glib/gtk.
  + libgnt:
  * Partially fix building against curses 6.0 with opaque
    structs set (pidgin.im#16764).
  * Fix a crash when resizing the window (pidgin.im#16680).
  + General:
  * Fix a bashism in autotools (pidgin.im#16836).
  + XMPP:
  * Show XEP-0066 OOB URLs in any message, not just headlines.
  * Fix a user after free (pidgin.im#17200).
  * Remove pipelining from BOSH connections (pidgin.im#17025).
  * Don't try to TLS already secured BOSH connections
    (pidgin.im#17270).
  + IRC:
  * Fix "Registration timeout" on SASL auth with InspIRCd
    servers (and possibly others not based on
    charybdis/ratbox/ircd-seven).
  * Fix issues with plugins that modify outgoing messages (such
    as the custom PART/QUIT feature of the IRC More plugin).
  * Fix IRC buffer handling (pidgin.im#12562).
  * Properly handle AUTHENTICATE as a normal command with server
    prefix.
  * Fix a crash caused by a use after free of the MOTD.
  * Fix an out of bounds read in irc_nick_skip_mode.
  * Fix a write of a single byte before the start of a buffer in
    irc_parse_ctcp.
  + Pidgin:
  * Better support for dark themes (pidgin.im#12572).
  * Fix IPv6 links by not escaping []'s. (pidgin.im#16391).
  * Only write buddy icons to the cache if they're not already
    cached.
  * Rejoin persistent chats after reconnect (pidgin.im#15687).
  * Make the WIN32 Transparency plugin work on all platforms
    (pidgin.im#3124).
  * Ensure search results buttons are labelled.
  * Fix matching unicode emoticons (pidgin.im#17232).
  * Correctly update mute/unmute status when the remote side
    mutes/unmutes us (pidgin.im#17273).
  * Rework the status icon blinking to not use deprecated API
    (pidgin.im#17174).
  * Do not allow adding a buddy to protocols that don't have an
    add_buddy callback.
  + Finch:
  * Fix handling of search results (pidgin.im#17238).
  + Voice &amp; Video:
  * Port backend-fs to newer api for farstream relay-info
    property (pidgin.im#17274).
- Rebase pidgin-ncurses-6.0-accessors.patch.
- Remove pidgin-2.10.11-purple-remote-python3.patch: fixed
  upstream.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Instead of removing the libjabber.so, liboscar.so symlinks, move
  them to the devel package.</changelog>
  <changelog author="fezhang@suse.com" date="1523534400">- Add pidgin-enable-sni-gnutls.patch: Enable SNI for gnutls to
  avoid SSL handshake failure, patch written by Tiago Herrmann
  (therrmann@suse.com) (bsc#1086439, pidgin.im#17300).</changelog>
  <changelog author="dimstar@opensuse.org" date="1523966400">- Drop pkgconfig(NetworkManager) BuildRequires and Requires: this
  legacy symbol is no longer maintained and pidgin is not yet
  ready to move to libnm. As a side-effect, we no longer depend on
  NM for all situations, even if the system were to run wicked.
- Replace --enable-nm configure parameter with --disable-nm.</changelog>
  <changelog author="fezhang@suse.com" date="1571745600">- Add pidgin-Leaky-deprecation-clean-ups.patch: Fix warnings of
  deprecation of GParameter that result in build failures of
  plugins that build with -Werror (pidgin.im#17415).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624536000">- Add pidgin-add-no_proxy-support.patch: add support of no_proxy
  environment variable. (jsc#SLE-17111, pidgin.im#17518)</changelog>
</package>
<package pkgid="f1bca16ef4f09a5d4e47509697eb4c6a4b4145f37f53b40fe514481240555fe9" name="finch-devel" arch="x86_64">
  <version epoch="0" ver="2.13.0" rel="12.3.1"/>
  <changelog author="fezhang@suse.com" date="1467633600">- Update to GNOME 3.20.2  Fate#318572
  + Drop pidgin-CVE-2014-3695 (bsc#902409): fixed upstream.
  + Drop pidgin-CVE-2014-3696 (bsc#902410): fixed upstream.
  + Drop pidgin-CVE-2014-3698 (bsc#902408): fixed upstream.</changelog>
  <changelog author="jengelh@inai.de" date="1469188800">- Drop additional pkgconfig require (already implicitly detected),
  but explicitly buildrequire it for /usr/lib/rpm/pkgconfigdeps.sh.</changelog>
  <changelog author="fezhang@suse.com" date="1479816000">- Add pidgin-sasl-skip-external.patch:
  Backport upstream commit 6106566. Makes Freenode and other
  servers that prefer SASL EXTERNAL fingerprint authentication
  work again (bsc#1009974).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481112000">- Build with GStreamer 1.x on SLE 12 SP2.
- Apply pidgin-use-default-alsa.patch for SLE 12+ only properly.
- Provide libpurple-branding-upstream for SLE 11 as well.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1481198400">- Make libpurple require libpurple-branding.
- Correctly remove *.so files for plugins
  (fixes devel-file-in-non-devel-package).
- Rename libpurple-meanwhile to libpurple-plugin-sametime.
- Remove generation of a plugin list to package, simply add it all
  in %files with exclusions.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1489147200">- Update to version 2.12.0 (FATE#323136):
  + libpurple:
  - Fix an out of bounds memory read in
    purple_markup_unescape_entity (CVE-2017-2640, bsc#1028835).
  - Fix the use of uninitialised memory if running
    non-debug-enabled versions of glib.
  - Update AIM dev and dist ID's to new ones that were assigned
    by AOL.
  - TLS certificate verification now uses SHA-256 checksums.
  - Fix the SASL external auth for Freenode (boo#1009974).
  - Remove the MSN protocol plugin. It has been unusable and
    dormant for some time.
  - Remove the Mxit protocol plugin. The service was closed at
    the end ofSeptember 2016.
  - Remove the MySpaceIM protocol plugin. The service has been
    defunct for a long time (pidgin.im#15356).
  - Remove the Yahoo! protocol plugin. Yahoo has completely
    reimplemented their protocol, so this version is no longer
    operable as of August 5th, 2016.
  - Remove the Facebook (XMPP) account option. According to
    https://developers.facebook.com/docs/chat the XMPP Chat API
    service ended April 30th, 2015.
  - Fix gnutls certificate validation errors that mainly
    affected Google.
  + General:
  - Replace instances of d.pidgin.im with developer.pidgin.im and
    update the urls to use https (pidgin.im#17036).
  + IRC:
  - Fix an issue of messages being silently cut off at 500
    characters. Large messages are now split into parts and sent
    one by one (pidgin.im#4753).
- Rebase pidgin-nonblock-common.patch.
- Remove pidgin-sasl-skip-external.patch.
- Remove pidgin-NLD-smiley-theme.tar.bz2, deprecated.
- Remove pidgin-Tango-smiley-theme.tar.bz2, deprecated</changelog>
  <changelog author="tchvatal@suse.com" date="1500724800">- Drop dependency over silc-toolkit-devel as we want to remove
  it from the distribution</changelog>
  <changelog author="mpluskal@suse.com" date="1509624000">- Explicitly require python2</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1510056000">- Correct the licence to GPL-2.0.</changelog>
  <changelog author="fezhang@suse.com" date="1511265600">- Add purple-import-empathy Recommends for SLE15 (FATE#322984).</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1514548800">- Remove pidgin-crash-missing-gst-registry.patch: is useless now
  and is potentially harmful.
- Merge pidgin-nonblock-common2.patch to
  pidgin-nonblock-common.patch.</changelog>
  <changelog author="dimstar@opensuse.org" date="1520337600">- Update pidgin-ncurses-6.0-accessors.patch to cope with ncurses
  enabling opaque-panels. Pidgin should not access internal
  structures of ncurses.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520337601">- Drop support for SLE 11 and openSUSE older than 42.x.
- Remove pidgin-gnome-keyring.patch: was only useful for SLE 11.</changelog>
  <changelog author="mgorse@suse.com" date="1520337602">- Add pidgin-2.10.11-purple-remote-python3.patch: port
  purple-remote to python 3 (bsc#1084147).
- Export PYTHON=python3 in %build.
- Adjust scripts to invoke python3, not python2.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1520596800">- Update to version 2.13.0:
  + libpurple:
  * Unified string comparison.
  * Properlly shell escape URI's when opening them.
  * Fix a one byte buffer overread in function
    purple_markup_linkify.
  * Fix an issue were utf8 was incorrectly truncated which could
    lead to crashes as we were potentially feeding garbage into
    glib/gtk.
  + libgnt:
  * Partially fix building against curses 6.0 with opaque
    structs set (pidgin.im#16764).
  * Fix a crash when resizing the window (pidgin.im#16680).
  + General:
  * Fix a bashism in autotools (pidgin.im#16836).
  + XMPP:
  * Show XEP-0066 OOB URLs in any message, not just headlines.
  * Fix a user after free (pidgin.im#17200).
  * Remove pipelining from BOSH connections (pidgin.im#17025).
  * Don't try to TLS already secured BOSH connections
    (pidgin.im#17270).
  + IRC:
  * Fix "Registration timeout" on SASL auth with InspIRCd
    servers (and possibly others not based on
    charybdis/ratbox/ircd-seven).
  * Fix issues with plugins that modify outgoing messages (such
    as the custom PART/QUIT feature of the IRC More plugin).
  * Fix IRC buffer handling (pidgin.im#12562).
  * Properly handle AUTHENTICATE as a normal command with server
    prefix.
  * Fix a crash caused by a use after free of the MOTD.
  * Fix an out of bounds read in irc_nick_skip_mode.
  * Fix a write of a single byte before the start of a buffer in
    irc_parse_ctcp.
  + Pidgin:
  * Better support for dark themes (pidgin.im#12572).
  * Fix IPv6 links by not escaping []'s. (pidgin.im#16391).
  * Only write buddy icons to the cache if they're not already
    cached.
  * Rejoin persistent chats after reconnect (pidgin.im#15687).
  * Make the WIN32 Transparency plugin work on all platforms
    (pidgin.im#3124).
  * Ensure search results buttons are labelled.
  * Fix matching unicode emoticons (pidgin.im#17232).
  * Correctly update mute/unmute status when the remote side
    mutes/unmutes us (pidgin.im#17273).
  * Rework the status icon blinking to not use deprecated API
    (pidgin.im#17174).
  * Do not allow adding a buddy to protocols that don't have an
    add_buddy callback.
  + Finch:
  * Fix handling of search results (pidgin.im#17238).
  + Voice &amp; Video:
  * Port backend-fs to newer api for farstream relay-info
    property (pidgin.im#17274).
- Rebase pidgin-ncurses-6.0-accessors.patch.
- Remove pidgin-2.10.11-purple-remote-python3.patch: fixed
  upstream.</changelog>
  <changelog author="sor.alexei@meowr.ru" date="1521115200">- Instead of removing the libjabber.so, liboscar.so symlinks, move
  them to the devel package.</changelog>
  <changelog author="fezhang@suse.com" date="1523534400">- Add pidgin-enable-sni-gnutls.patch: Enable SNI for gnutls to
  avoid SSL handshake failure, patch written by Tiago Herrmann
  (therrmann@suse.com) (bsc#1086439, pidgin.im#17300).</changelog>
  <changelog author="dimstar@opensuse.org" date="1523966400">- Drop pkgconfig(NetworkManager) BuildRequires and Requires: this
  legacy symbol is no longer maintained and pidgin is not yet
  ready to move to libnm. As a side-effect, we no longer depend on
  NM for all situations, even if the system were to run wicked.
- Replace --enable-nm configure parameter with --disable-nm.</changelog>
  <changelog author="fezhang@suse.com" date="1571745600">- Add pidgin-Leaky-deprecation-clean-ups.patch: Fix warnings of
  deprecation of GParameter that result in build failures of
  plugins that build with -Werror (pidgin.im#17415).</changelog>
  <changelog author="alynx.zhou@suse.com" date="1624536000">- Add pidgin-add-no_proxy-support.patch: add support of no_proxy
  environment variable. (jsc#SLE-17111, pidgin.im#17518)</changelog>
</package>
<package pkgid="650a14681c78624704c73464aaa513776c672a71aa9e6d47e89efc3865f517be" name="flatpak" arch="aarch64">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="5afd644b01318226545e39cb46ba6985d86e5022c82e8df0063236a1ec38ef7b" name="flatpak" arch="ppc64le">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="2dbbaf3b638fb61ee9d3a165d23dfe6886fca980683923c9ba582bbe1273e3c8" name="flatpak" arch="s390x">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="f67213856053a068bedf08a12f7991d65b4a2cede4bd6cb4b31df558a208ccfb" name="flatpak" arch="src">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="179b0a8438c84b94321f9fb0785f3643e0d343e4f3bbfbe018bfa6c08f5aaaee" name="flatpak" arch="x86_64">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="f19c1e042b4e40bc7ffd7e7abfbd6273e085922c15de8f90db2c42cb4723406d" name="flatpak-devel" arch="aarch64">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="40bfeeeacff8069fd1a70a13cf8d4364fe8e2ef64b5f05d3286cd7bb978bb36c" name="flatpak-devel" arch="ppc64le">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="cf011e08938ff13ecef1f41ba4ac26da2f525b854d4312dc9d01b343c1c2b59c" name="flatpak-devel" arch="s390x">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="79b8273a76670e8e1ce76d8a532f2e963304906c43987177b6286c6480b392b9" name="flatpak-devel" arch="x86_64">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="52508f2017399018b0768e2d3c901a720f490275ed6318afb4bdd8f5aa80938d" name="flatpak-zsh-completion" arch="aarch64">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="91fdc722843a26591e8e65e7c322eb31b148103bfeb9f766c5aa34274fbea73c" name="flatpak-zsh-completion" arch="ppc64le">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="0bb081d2f68d0b96332b506d5be4a6a338d27f80c4758d9bc72189e3d2dadd44" name="flatpak-zsh-completion" arch="s390x">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="e78c6beb1f206f789f3c9d671fff05af78c8c85a6aa31fdce7a4a74ea2e80a47" name="flatpak-zsh-completion" arch="x86_64">
  <version epoch="0" ver="1.10.5" rel="4.9.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1581854400">- Drop obsolete _servicedata file.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174400">- Update to version 1.6.3:
  + The main change in this version is a fix for a regression in
    the progress calculation for applications using extra-data.
    Additionally the bundled version of bubblewrap is updated to
    0.4.1 which fixes a security issue in some cases. See
    GHSA-j2qp-rvxj-43vj for details.
  + Don't break if users primary gid is not in the nsswitch
    database
  + Fix crash in flatpak repair if no remotes are configured
  + Some updates to the oci authenticator
  + Retry downloads of extra data
  + Updated translations.</changelog>
  <changelog author="alarrosa@suse.com" date="1586174401">- Require bubblewrap 0.4.1</changelog>
  <changelog author="yfjiang@suse.com" date="1589803200">- When SLE uses GNOME desktop environment, GNOME Software is
  automatically started to provide key update features. During the
  startup, it setups flatpak repository so that related features
  can function properly. In a system environment of no flatpak
  repository has ever been setup before, this triggers
  "org.freedesktop.Flatpak.modify-repo" polkit action.
  Therefore in systems which use a restrictive security policy
  (eg. SLES) for the aforementioned policy action, a polkit
  authentication dialog will pop up without any user interaction
  for the first time login. This is not user friendly.
  This submission creates /var/lib/flatpak/repo at package
  installation to avoid such a confusing authentication pop-up, at
  nearly 0 cost of security compromise (bsc#1169619, bsc#1170416).</changelog>
  <changelog author="yfjiang@suse.com" date="1592308800">- Create a skeleton flatpak repo using "flatpak remotes" instead
  of a manually created directory (bsc#1172316, bsc#1169619,
  bsc#1170416).</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1593086400">- Update to version 1.6.4:
  + This release backports some of the OCI authenticator fixes from
    the 1.7 series, and should now be able to host flatpak images
    on e.g. docker hub.
  + Other changes:
  - Fix a use-after free in libflatpak.
  - Don't list p2p downgrades in list of available updates.</changelog>
  <changelog author="callumjfarmer13@gmail.com" date="1594123200">- Fixes for %_libexecdir changing to /usr/libexec</changelog>
  <changelog author="alarrosa@suse.com" date="1594382400">- Update to version 1.8.1:
  * Avoid calling authenticator in update if ref didn't change
  * Don't fail transaction if ref is already installed (after
    transaction start)
  * Fix flatpak run handling of userns in the --device=all case
  * Fix handling of extensions from different remotes
  * Fix flatpak run --no-session-bus
  * Updated translations
- Update to version 1.8.0:
  * FlatpakTransaction has a new signal "install-authenticator"
    which clients can handle to install authenticators needed for
    the transaction. This is done in the CLI commands.
  * We now always expose the host timezone data, allowing us the
    expose the host /etc/localtime in a way that works better,
    fixing several apps that had timezone issues.
  * Fix flatpak enter which didn't work in some cases.
  * We now ship a systemd unit (not installed by default) to
    automatically detect plugged in usb sticks with sideload repos.
  * By default we no longer install the gdm env.d file, as the
    systemd generators work better.
  * create-usb now exports partial commits by default
  * Fix handling of docker media types in oci remotes
  * Fix subjects in remote-info --log output
- Remove source file used to generate a flatpak user on the system
  since it's now included by upstream:
  * system-user-flatpak.conf</changelog>
  <changelog author="dimstar@opensuse.org" date="1597838400">- Fix invalid usage of %{_libexecdir} to reference systemd
  directories.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1598097600">- Update to version 1.8.2:
  + Added validation of collection id settings for remotes.
  + Fix seccomp filters on s390.
  + Robustness fixes to the spawn portal.
  + Fix support for masking update in the system installation.
  + Better support for distros with uncommon models of merged /usr.
  + Cache responses from localed/AccountService.
  + Fix hangs in cases where xdg-dbus-proxy fails to start.
  + Fix double-free in cups socket detection.
  + OCI authenticator now doesn't ask for auth in case of http
    errors.</changelog>
  <changelog author="dimstar@opensuse.org" date="1606132800">- Update to version 1.8.3:
  + Fixed progress reporting for OCI and extra-data.
  + The in-memory summary cache is more efficient.
  + Fixed authentication getting stuck in a loop in some cases.
  + Fixed authentication error reporting.
  + We now extract OCI info for runtimes as well as apps.
  + Fixed crash if anonymous authentication fails and -y is
    specified.
  + flatpak info now only looks at the specified installation if
    one is specified.
  + Better error reporting for server HTTP errors during download.
  + Uninstall now removes applications before the runtime it
    depends on.
  + Fixed test-suite to pass with the latest OSTree version.
  + Fixed dbus environment variables in flatpak enter.
  + Avoid updating metadata from the remote when uninstalling.
  + Fixed error message handling in various places.
  + FlatpakTransaction now verifies all passed in refs to avoid.
  + potential issues with invalid names.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1608033600">- Enable LTO (boo#1133124) as gobject-introspection works fine with LTO.</changelog>
  <changelog author="fcrozat@suse.com" date="1609329600">- Move flatpak-bisect and flatpak-coredumpctl to devel subpackage,
  allow to remove python3 dependency on main package.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610020800">- Update to version 1.8.4:
  + Fix support for ppc64.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712000">- Update to version 1.8.5 (CVE-2021-21261):
  + This is a security update that fixes a sandbox escape where a
    malicious application can execute code outside the sandbox by
    controlling the environment of the "flatpak run" command when
    spawning a sub-sandbox (boo#1180996)</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1610712001">- Update to version 1.10.0:
  + The major new feature in this series compared to 1.8 is the
    support for the new repo format which should make updates
    faster and download less data.
  + The systemd generator snippets now call flatpak
  - -print-updated-env in place of a bunch of shell for better
    login performance.
  + The .profile snippets now disable GVfs when calling flatpak to
    avoid spawning a gvfs daemon when logging in via ssh.
  + Build fixes for GCC 11.
  + Flatpak now finds the pulseaudio sockets better in uncommon
    configurations.
  + Sandboxes with network access it now also has access to the
    systemd-resolved socket to do dns lookups.
  + Flatpak supports unsetting env vars in the sandbox using
  - -unset-env, and --env=FOO= now sets FOO to the empty string
    instead of unsetting it.
  + Similarly the spawn portal has an option to unset an env var.
  + The spawn portal now has an option to share the pid namespace
    with the sub-sandbox.</changelog>
  <changelog author="andreas.stieger@gmx.de" date="1611489600">- Update to version 1.10.1:
  + Fix flatpak build on systems with setuid bwrap
  + Fix some compiler warnings
  + Fix crash on updating apps with no deploy data
  + Updated translations.
- Remove deprecated texinfo packaging macros.
- Switch to upstream release tarball.</changelog>
  <changelog author="alarrosa@suse.com" date="1611835200">- Flatpak only requires glib 2.44, not 2.60
- Update ostree version required to 2020.8</changelog>
  <changelog author="alarrosa@suse.com" date="1615377600">-  Update to version 1.10.2:
  + This is a security update which fixes a potential attack where
    a flatpak application could use custom formated .desktop files
    to gain access to files on the host system.
  + Fix memory leaks
  + Some test fixes
  + Documentation updates
  + G_BEGIN/END_DECLS added to library headders for c++ use
  + Fix for X11 cookies on OpenSUSE
  + Spawn portal better handles non-utf8 filenames</changelog>
  <changelog author="alarrosa@suse.com" date="1633953600">- Update to version 1.10.5:
  * The security fix in the 1.12.1 release failed when used with
    some older versions of libseccomp (that don't know about the
    new syscalls).
- Update to version 1.10.4:
  * This release fixes a security vulnerability in the portal
    support. Some recently added syscalls were not blocked by the
    seccomp rules which allowed the application to create
    sub-sandboxes which can confuse the sandboxing verification
    mechanisms of the portal. This has been fixed by extending the
    seccomp rules.
    For details, see:
    https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4q
    (boo#1191507, CVE-2021-41133)
  * OCI now use the pax tar format which handles large files better than gnutar
  * Fix the parental control checks for root
- Update to version 1.10.3:
  * This is a maintenance update with various bug fixes backported
    from 1.11.x.
  * Don't inherit an unusual $XDG_RUNTIME_DIR setting into the
    sandbox, fixing a regression introduced when CVE-2021-21261 was
    fixed in 1.8.5 and 1.10.0
  * Fix various memory and file descriptor leaks, in particular
    with flatpak-spawn --env=...
  * Fix fd confusion in flatpak-spawn --env=... --forward-fd=...,
    resolving a regression introduced in 1.8.5 and 1.10.0
  * Fix deploys of local remotes in system-helper, possibly
    involving newer GLib versions
  * Fix test failures on non-x86_64 systems
  * create-usb: Skip copying extra-data flatpaks
  * Improve test coverage on Debian derivatives by ensuring /sbin
    is in tests' PATH</changelog>
</package>
<package pkgid="43c0ec30426bf54cc18afe247225cd01ef405dced001b8082dff5933c77d1990" name="fltk" arch="src">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="pgajdos@suse.cz" date="1282824000">- update to 1.1.10
  changes since rc3
  - Widgets now remove stale entries from the default callback
    queue when they are deleted (STR #2302)
  - Fixed selection bug in Fl_Int_Input (STR #2292)
  for all changes see the /usr/share/doc/packages/fltk/CHANGES</changelog>
  <changelog author="pgajdos@novell.com" date="1310385600">- updated to 1.3.0:
  * Added UTF-8 Unicode support throughout FLTK and Fluid
  * Added Fl_Tree widget for hierarchical views
  * Added Fl_Table widget for widget layout
  * Added Fl_Native_Filechooser as a widget and global options
  * etc., see CHANGES
  * removed upstreamed and unneeded patches</changelog>
  <changelog author="jengelh@medozas.de" date="1316347200">- Apply packaging guidelines (remove redundant/obsolete
  tags/sections from specfile, etc.)
- Implement baselibs config</changelog>
  <changelog author="pgajdos@suse.com" date="1324468800">- fixed linking library with as-needed [bnc#736410]
  * as-needed.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1324555200">- buildrequires automake</changelog>
  <changelog author="coolo@suse.com" date="1329739200">- let the devel package buildrequire xorg-x11-devel</changelog>
  <changelog author="coolo@suse.com" date="1343304000">- buildrequires on specific library sonames is breaking build</changelog>
  <changelog author="pgajdos@suse.com" date="1353412800">- updated to 1.3.1:
  - Fixed utf_strncasecmp and utf_strcasecmp
  - Moved all inline constructors into source file to avoid bad DLLs
  - Fixed Fl_Widget::copy_label() and Fl_Window::copy_label() when
    called with the old label() (STR #2836)
  - Fixed Fl_Input_::maximum_size() documentation and replace() method
    to honor maximum_size() as number of allowed characters (STR #2747).
  - Fixed a potential crash if Fl_Double_Window::flush() was called
    before show()
  - Fixed regression (in FLTK 1.3.0) that could clear a radio
    button by using the keyboard (space or shortcut) (STR #2748)
  - Fixed fl_pie() drawing too small on X11 (STR #2703)
  - Fixed Fl_Menu issue with unusual menu flags (STR #2680)
  - Fixed Windows DLL import of fl_xid() (STR #2670)
  - Added Fl::screen_work_area() functions that compute the work area
    of a screen. These functions improve the positioning of menus.
    Changed Fl::x(), Fl::y(), Fl::w(), Fl::h() functions
    to return the origin and size of the work area of the main screen
    (STR #2695 + 2697)
  - Created the FL_SCREEN_CONFIGURATION_CHANGED event that is triggered
    when a screen is added, removed, moved or when resolution is changed
    (STR #2600)
  - Improved the description of page size and orientation by
    Fl_PostScript_File_Device.
  - Added support for horizontal wheel movement under X11 and MSWindows Vista
    and above (STR #2644).
    1.3.1 ABI FEATURES
    (To enable the following ABI features, put: #define FLTK_ABI_VERSION 10301
    at the top of your FL/Enumerations.H and rebuild FLTK and your app)
  - Fl_Tree optimized to support large trees (eg. 100k items):
    Added _next_sibling and _prev_sibling to Fl_Tree_Item class,
    and support methods.</changelog>
  <changelog author="reddwarf@opensuse.org" date="1357819200">- updated to 1.3.2:
  - Removed unnecessary drawing calls (STR #2898)
  - Fixed regression in FLTK 1.3.1 for unbundled Mac OS FLTK applications that
    did not appear in dock nor have a menu bar (STR #2890).
  - Fl_Table::clear() now calls table-&gt;clear() for consistency. (STR #2889)
  - Fixed Fl_Scroll widget that fails under Mac OS X 10.8 and retina display (STR #2887).
  - Prevents scrollbars from drawing when widget is sized too small to be visible (STR #2886).
  - Documented how to make a Mac OS X FLTK application launchable by dropping files on its icon.
  - Fixed a Mac-specific issue appeared with OS 10.8 (Mountain Lion): long delay before
    opening when the application is started by dragging a file on the application icon.
  - Fixed use of PNG image from im-memory data (STR #2884).
  - Added static Fl_RGB_Image::max_size(size_t) to limit the maximum memory size allowed to
    RGB images (STR #2881).
- add fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch to avoid adding unneeded libraries
  to the link command of dependent packages. Those libraries didn't even need to be installed.
- remove automake BuildRequire
- substitute %if crazyness for pkgconfig() style BuildRequires
- correct libfltk1 group
- get rid of the fltk package which only contained duplicated doc files, probably by a packaging accident
- add fltk-1.3.2-verbose_build.patch
- add fltk-1.3.2-underlinking-patch
- remove fltk-as-needed.patch (integrated into fltk-1.3.2-underlinking-patch)
- don't add -fno-strict-aliasing to CFLAGS. Upstream already does that
- don't set glflags and fltkflags for make. I don't see it doing anything useful</changelog>
  <changelog author="pgajdos@suse.com" date="1359115200">- by previous change, files of fltk maint package was moved to
  fltk-devel, keeping fltk empty; thus:
  * libfltk1 obsoletes fltk
  * fltk-devel provides fltk</changelog>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="35ff5fdaf2e6f251eab54bd3ca0e519327f1a51ea4fca1f0e360145b5b82bfdf" name="fltk-devel" arch="aarch64">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="7474a024c963e814b3c7b010fa47f34965a396228b4b4cf1e6a898ad9d5d038f" name="fltk-devel" arch="ppc64le">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="2efaf3b7b7adc69394d84cf459f00f2b5730e4386165d531693fae4fbb421f11" name="fltk-devel" arch="s390x">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="cd3e5e5d645f9237b6482d3e4e2059af5f5ab0b499a08bcd0633410a069f8adb" name="fltk-devel" arch="x86_64">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="2128e79eea7c460566dfbd0e64e48e5f7cd245609af792bcf0c96d6f4bce7b31" name="fltk-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="ce3859d4765d4927795474ba6917cc976e16c5bb66beceeae3e2a18167153cd2" name="fltk-devel-static" arch="aarch64">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="b11850947bd12707ec3d4430a75ca1e9a760214c849934583546c3fd314e0367" name="fltk-devel-static" arch="ppc64le">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="4ef9b451813326bbd09591196fd66f0d7d21125a6698b3743c066c600cb1d9d9" name="fltk-devel-static" arch="s390x">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="f271dc8b5eaf55f3df2919f00b6d47f113a89faa58c7100f5aca3d8e7de1cc2a" name="fltk-devel-static" arch="x86_64">
  <version epoch="0" ver="1.3.4" rel="5.3.1"/>
  <changelog author="jw@suse.com" date="1362484800">- added a fltk-devel-static subpackage to transport libfltk*.a
  as needed by Documentation:Tools/flpsed.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1414238400">- Correct -devel package dependencies
  * /usr/include/FL/x*.H needs x11 headers
  * /usr/include/FL/gl*.H needs gl headers.</changelog>
  <changelog author="p.drouand@gmail.com" date="1421150400">- Update to version 1.3.3
  +Very much changes; please have a look on CHANGES file
- Remove fltk-1.3.2-underlinking.patch; merged upstream</changelog>
  <changelog author="dimstar@opensuse.org" date="1422273600">- Add fltk-1.3.3-do-not-use-internal-ABI.patch: do not use internal
  function Fl_XFont_On_Demand::value(), which changes ABI based on
  the configuration. Add a fl_core_font() getter for the same.</changelog>
  <changelog author="pgajdos@suse.com" date="1479729600">- updated to 1.3.4: see CHANGES
- remove fltk-1.3.3-do-not-use-internal-ABI.patch (upstreamed)</changelog>
  <changelog author="dimstar@opensuse.org" date="1486641600">- Explicitly package %{_docdir}/fltk-devel in order to fix build
  with RPM 4.13.0.</changelog>
  <changelog author="tchvatal@suse.com" date="1500292800">- Drop patch fltk-1.3.2-do_not_add_unneeded_extra_dependencies.patch
  as upstream closed the ticked stating it is wrong
- Add patch fltk-1.3.4-fltk_config.patch</changelog>
  <changelog author="jengelh@inai.de" date="1500984000">- Trim description, drop TM/R marks according to guidelines.</changelog>
  <changelog author="pgajdos@suse.com" date="1517227200">- added xcursor dependency [bsc#1077881]</changelog>
  <changelog author="matthias.gerstner@suse.com" date="1619179200">- explicitly pass -fPIC and -pie via CFLAGS and LDFLAGS to make /usr/bin/fluid
  an position-independent executable. fltk by default passed -fPIC but not
  - pie, which breaks our gcc-PIE profile. (bsc#1184122).</changelog>
</package>
<package pkgid="7102cdb6db50fbc86f41a9e5ba440bcb870c89996f2b6134d91a46f578eea008" name="fonttosfnt" arch="aarch64">
  <version epoch="0" ver="1.1.0" rel="3.3.1"/>
  <changelog author="vuntz@opensuse.org" date="1334318400">- Split fonttosfnt from xorg-x11. Initial version: 1.0.4.</changelog>
  <changelog author="zaitor@opensuse.org" date="1496232000">- Update to version 1.0.5+20170126.aead36f:
  * config:
  - Replace deprecated AM_CONFIG_HEADER with AC_CONFIG_HEADERS.
  - Move man pages into their own directory.
  - Add missing AC_CONFIG_SRCDIR.
  * man:
  - Remove trailing spaces and tabs.
  - Replace hard coded man page section with substitution
    strings.
  * configure: Drop AM_MAINTAINER_MODE.
  * autogen.sh:
  - Honor NOCONFIGURE=1.
  - Use exec instead of waiting for configure to finish.
  - Use quoted string variables.
  - Add default patch prefix.
- Switch to source service git checkout.
- Following the above, add libtool BuildRequires, and pass
  NOCONFIGURE=1 ./autogen.sh: Needed now that we build from a git
  checkout.
- Add pkgconfig(xorg-macros) BuildRequires: New dependency.
- Stop packaging ChangeLog and NEWS, dropped upstream.</changelog>
  <changelog author="sndirsch@suse.com" date="1534507200">- Update to version 1.0.5
  * Is it a bird? is it a plane? No it's a fonttofs.. fontstof..
    fonttofn... it's a release of the tool that wraps a bitmap
    font into a truetype wrapper! Bringing you the last 9 years
    of exciting changes including ansification and lots of
    autotools cleanup changes, because that is how we rolled 7
    years ago. (Almost) no source files were harmed in the
    making of this release.
- get rid of _service/_servicedata files</changelog>
  <changelog author="sndirsch@suse.com" date="1578398400">- Update to version 1.1.0
  * Update README for gitlab migration
  * Update configure.ac bug URL for gitlab migration
  * Correct a string literal
  * Mention .otb as an extension
  * Accept a BDF font on stdin
  * Avoid undefined behaviour
  * Round font size to integer value when reading bitmap font
  * Mark vsprintf_alloc as printf-like function
  * check for freetype NULL atoms
  * let freetype handle ISO-8859-1 mapping
  * allow ISO-646.1991-IRV as well, adobe standard for bdf</changelog>
  <changelog author="alarrosa@suse.com" date="1598356800">- Add patches from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/7
  to fix metrics (boo#1174895):
  * 0001-don-t-add-arbitrary-number-to-the-glypth-metrics.patch
  * 0002-use-zero-lineGap-sTypoDescender-should-be-negative.patch
  * 0003-truncate-foundry-if-there-is-no-known-abbreviation.patch
  * 0004-remove-now-obsolete-comment-too.patch
  * 0005-correctly-set-OS2-fsSelection-for-italic-and-bold-fo.patch
  * 0006-use-standard-C-rounding-functions.patch
  * 0007-use-more-properties-according-to-XLFD.patch
  * 0008-use-design-metrics-in-eblc-instead-of-calculated-met.patch
  * 0009-provide-version-5-OS-2-table.patch
  * 0010-Add-warnings-when-wrapping-multiple-fonts-and-on-PCF.patch
  * 0011-move-metrics-calculation-to-write.c.patch
  * 0012-calculate-capHeight-and-xHeight-as-recommended.patch
  * 0013-fix-sign-of-sTypoDescender.patch
  * 0014-use-PIXEL_SIZE-to-calculate-lineGap.patch
- Use %license</changelog>
  <changelog author="alarrosa@suse.com" date="1600776000">- Add more patches from upstream's master branch:
  * 0015-Fix-incorrect-error-handling-in-macTime.patch
  * 0016-Fix-uninitialised-memory-write.patch
  * 0017-Guess-Regular-style-for-Medium-Weight.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1604664000">- Add patch from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/11
  to fix more metric calculations (boo#1174895):
  * 0001-1em-is-font-size-not-heigh.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1608552000">- Add changes to make this effectively the same as fonttosfnt 1.2.1:
  * 0022-writeFile-avoid-file-leak-on-errors.patch
- At some point in the past, the following patches from 1.2.0 were also added:
  * 0018-remove-leftover-debug-printf.patch
  * 0019-handle-empty-foundry-encoded-as-NULL.patch
  * 0020-fix-sign-of-calculated-descent.patch
  * 0021-Fall-back-to-using-FONT-property-as-family-name.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1628164800">- Add patch making this effectively the same as fonttosfnt 1.2.2:
  * 0023-Fail-if-ftell-fails.patch</changelog>
</package>
<package pkgid="a362a25a0bb2c287044fdea7f1fd29336c73262c506cb98cb7b1b239af39035b" name="fonttosfnt" arch="ppc64le">
  <version epoch="0" ver="1.1.0" rel="3.3.1"/>
  <changelog author="vuntz@opensuse.org" date="1334318400">- Split fonttosfnt from xorg-x11. Initial version: 1.0.4.</changelog>
  <changelog author="zaitor@opensuse.org" date="1496232000">- Update to version 1.0.5+20170126.aead36f:
  * config:
  - Replace deprecated AM_CONFIG_HEADER with AC_CONFIG_HEADERS.
  - Move man pages into their own directory.
  - Add missing AC_CONFIG_SRCDIR.
  * man:
  - Remove trailing spaces and tabs.
  - Replace hard coded man page section with substitution
    strings.
  * configure: Drop AM_MAINTAINER_MODE.
  * autogen.sh:
  - Honor NOCONFIGURE=1.
  - Use exec instead of waiting for configure to finish.
  - Use quoted string variables.
  - Add default patch prefix.
- Switch to source service git checkout.
- Following the above, add libtool BuildRequires, and pass
  NOCONFIGURE=1 ./autogen.sh: Needed now that we build from a git
  checkout.
- Add pkgconfig(xorg-macros) BuildRequires: New dependency.
- Stop packaging ChangeLog and NEWS, dropped upstream.</changelog>
  <changelog author="sndirsch@suse.com" date="1534507200">- Update to version 1.0.5
  * Is it a bird? is it a plane? No it's a fonttofs.. fontstof..
    fonttofn... it's a release of the tool that wraps a bitmap
    font into a truetype wrapper! Bringing you the last 9 years
    of exciting changes including ansification and lots of
    autotools cleanup changes, because that is how we rolled 7
    years ago. (Almost) no source files were harmed in the
    making of this release.
- get rid of _service/_servicedata files</changelog>
  <changelog author="sndirsch@suse.com" date="1578398400">- Update to version 1.1.0
  * Update README for gitlab migration
  * Update configure.ac bug URL for gitlab migration
  * Correct a string literal
  * Mention .otb as an extension
  * Accept a BDF font on stdin
  * Avoid undefined behaviour
  * Round font size to integer value when reading bitmap font
  * Mark vsprintf_alloc as printf-like function
  * check for freetype NULL atoms
  * let freetype handle ISO-8859-1 mapping
  * allow ISO-646.1991-IRV as well, adobe standard for bdf</changelog>
  <changelog author="alarrosa@suse.com" date="1598356800">- Add patches from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/7
  to fix metrics (boo#1174895):
  * 0001-don-t-add-arbitrary-number-to-the-glypth-metrics.patch
  * 0002-use-zero-lineGap-sTypoDescender-should-be-negative.patch
  * 0003-truncate-foundry-if-there-is-no-known-abbreviation.patch
  * 0004-remove-now-obsolete-comment-too.patch
  * 0005-correctly-set-OS2-fsSelection-for-italic-and-bold-fo.patch
  * 0006-use-standard-C-rounding-functions.patch
  * 0007-use-more-properties-according-to-XLFD.patch
  * 0008-use-design-metrics-in-eblc-instead-of-calculated-met.patch
  * 0009-provide-version-5-OS-2-table.patch
  * 0010-Add-warnings-when-wrapping-multiple-fonts-and-on-PCF.patch
  * 0011-move-metrics-calculation-to-write.c.patch
  * 0012-calculate-capHeight-and-xHeight-as-recommended.patch
  * 0013-fix-sign-of-sTypoDescender.patch
  * 0014-use-PIXEL_SIZE-to-calculate-lineGap.patch
- Use %license</changelog>
  <changelog author="alarrosa@suse.com" date="1600776000">- Add more patches from upstream's master branch:
  * 0015-Fix-incorrect-error-handling-in-macTime.patch
  * 0016-Fix-uninitialised-memory-write.patch
  * 0017-Guess-Regular-style-for-Medium-Weight.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1604664000">- Add patch from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/11
  to fix more metric calculations (boo#1174895):
  * 0001-1em-is-font-size-not-heigh.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1608552000">- Add changes to make this effectively the same as fonttosfnt 1.2.1:
  * 0022-writeFile-avoid-file-leak-on-errors.patch
- At some point in the past, the following patches from 1.2.0 were also added:
  * 0018-remove-leftover-debug-printf.patch
  * 0019-handle-empty-foundry-encoded-as-NULL.patch
  * 0020-fix-sign-of-calculated-descent.patch
  * 0021-Fall-back-to-using-FONT-property-as-family-name.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1628164800">- Add patch making this effectively the same as fonttosfnt 1.2.2:
  * 0023-Fail-if-ftell-fails.patch</changelog>
</package>
<package pkgid="b11a44ab2faf67d6d7e45afe6c9c07583120bded1a37da9cfdb0bf11dae8d6d9" name="fonttosfnt" arch="s390x">
  <version epoch="0" ver="1.1.0" rel="3.3.1"/>
  <changelog author="vuntz@opensuse.org" date="1334318400">- Split fonttosfnt from xorg-x11. Initial version: 1.0.4.</changelog>
  <changelog author="zaitor@opensuse.org" date="1496232000">- Update to version 1.0.5+20170126.aead36f:
  * config:
  - Replace deprecated AM_CONFIG_HEADER with AC_CONFIG_HEADERS.
  - Move man pages into their own directory.
  - Add missing AC_CONFIG_SRCDIR.
  * man:
  - Remove trailing spaces and tabs.
  - Replace hard coded man page section with substitution
    strings.
  * configure: Drop AM_MAINTAINER_MODE.
  * autogen.sh:
  - Honor NOCONFIGURE=1.
  - Use exec instead of waiting for configure to finish.
  - Use quoted string variables.
  - Add default patch prefix.
- Switch to source service git checkout.
- Following the above, add libtool BuildRequires, and pass
  NOCONFIGURE=1 ./autogen.sh: Needed now that we build from a git
  checkout.
- Add pkgconfig(xorg-macros) BuildRequires: New dependency.
- Stop packaging ChangeLog and NEWS, dropped upstream.</changelog>
  <changelog author="sndirsch@suse.com" date="1534507200">- Update to version 1.0.5
  * Is it a bird? is it a plane? No it's a fonttofs.. fontstof..
    fonttofn... it's a release of the tool that wraps a bitmap
    font into a truetype wrapper! Bringing you the last 9 years
    of exciting changes including ansification and lots of
    autotools cleanup changes, because that is how we rolled 7
    years ago. (Almost) no source files were harmed in the
    making of this release.
- get rid of _service/_servicedata files</changelog>
  <changelog author="sndirsch@suse.com" date="1578398400">- Update to version 1.1.0
  * Update README for gitlab migration
  * Update configure.ac bug URL for gitlab migration
  * Correct a string literal
  * Mention .otb as an extension
  * Accept a BDF font on stdin
  * Avoid undefined behaviour
  * Round font size to integer value when reading bitmap font
  * Mark vsprintf_alloc as printf-like function
  * check for freetype NULL atoms
  * let freetype handle ISO-8859-1 mapping
  * allow ISO-646.1991-IRV as well, adobe standard for bdf</changelog>
  <changelog author="alarrosa@suse.com" date="1598356800">- Add patches from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/7
  to fix metrics (boo#1174895):
  * 0001-don-t-add-arbitrary-number-to-the-glypth-metrics.patch
  * 0002-use-zero-lineGap-sTypoDescender-should-be-negative.patch
  * 0003-truncate-foundry-if-there-is-no-known-abbreviation.patch
  * 0004-remove-now-obsolete-comment-too.patch
  * 0005-correctly-set-OS2-fsSelection-for-italic-and-bold-fo.patch
  * 0006-use-standard-C-rounding-functions.patch
  * 0007-use-more-properties-according-to-XLFD.patch
  * 0008-use-design-metrics-in-eblc-instead-of-calculated-met.patch
  * 0009-provide-version-5-OS-2-table.patch
  * 0010-Add-warnings-when-wrapping-multiple-fonts-and-on-PCF.patch
  * 0011-move-metrics-calculation-to-write.c.patch
  * 0012-calculate-capHeight-and-xHeight-as-recommended.patch
  * 0013-fix-sign-of-sTypoDescender.patch
  * 0014-use-PIXEL_SIZE-to-calculate-lineGap.patch
- Use %license</changelog>
  <changelog author="alarrosa@suse.com" date="1600776000">- Add more patches from upstream's master branch:
  * 0015-Fix-incorrect-error-handling-in-macTime.patch
  * 0016-Fix-uninitialised-memory-write.patch
  * 0017-Guess-Regular-style-for-Medium-Weight.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1604664000">- Add patch from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/11
  to fix more metric calculations (boo#1174895):
  * 0001-1em-is-font-size-not-heigh.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1608552000">- Add changes to make this effectively the same as fonttosfnt 1.2.1:
  * 0022-writeFile-avoid-file-leak-on-errors.patch
- At some point in the past, the following patches from 1.2.0 were also added:
  * 0018-remove-leftover-debug-printf.patch
  * 0019-handle-empty-foundry-encoded-as-NULL.patch
  * 0020-fix-sign-of-calculated-descent.patch
  * 0021-Fall-back-to-using-FONT-property-as-family-name.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1628164800">- Add patch making this effectively the same as fonttosfnt 1.2.2:
  * 0023-Fail-if-ftell-fails.patch</changelog>
</package>
<package pkgid="253dbb60092ac9e63824c12573514a087ea3cf2720a40674f03e125e85d3e4e6" name="fonttosfnt" arch="src">
  <version epoch="0" ver="1.1.0" rel="3.3.1"/>
  <changelog author="vuntz@opensuse.org" date="1334318400">- Split fonttosfnt from xorg-x11. Initial version: 1.0.4.</changelog>
  <changelog author="zaitor@opensuse.org" date="1496232000">- Update to version 1.0.5+20170126.aead36f:
  * config:
  - Replace deprecated AM_CONFIG_HEADER with AC_CONFIG_HEADERS.
  - Move man pages into their own directory.
  - Add missing AC_CONFIG_SRCDIR.
  * man:
  - Remove trailing spaces and tabs.
  - Replace hard coded man page section with substitution
    strings.
  * configure: Drop AM_MAINTAINER_MODE.
  * autogen.sh:
  - Honor NOCONFIGURE=1.
  - Use exec instead of waiting for configure to finish.
  - Use quoted string variables.
  - Add default patch prefix.
- Switch to source service git checkout.
- Following the above, add libtool BuildRequires, and pass
  NOCONFIGURE=1 ./autogen.sh: Needed now that we build from a git
  checkout.
- Add pkgconfig(xorg-macros) BuildRequires: New dependency.
- Stop packaging ChangeLog and NEWS, dropped upstream.</changelog>
  <changelog author="sndirsch@suse.com" date="1534507200">- Update to version 1.0.5
  * Is it a bird? is it a plane? No it's a fonttofs.. fontstof..
    fonttofn... it's a release of the tool that wraps a bitmap
    font into a truetype wrapper! Bringing you the last 9 years
    of exciting changes including ansification and lots of
    autotools cleanup changes, because that is how we rolled 7
    years ago. (Almost) no source files were harmed in the
    making of this release.
- get rid of _service/_servicedata files</changelog>
  <changelog author="sndirsch@suse.com" date="1578398400">- Update to version 1.1.0
  * Update README for gitlab migration
  * Update configure.ac bug URL for gitlab migration
  * Correct a string literal
  * Mention .otb as an extension
  * Accept a BDF font on stdin
  * Avoid undefined behaviour
  * Round font size to integer value when reading bitmap font
  * Mark vsprintf_alloc as printf-like function
  * check for freetype NULL atoms
  * let freetype handle ISO-8859-1 mapping
  * allow ISO-646.1991-IRV as well, adobe standard for bdf</changelog>
  <changelog author="alarrosa@suse.com" date="1598356800">- Add patches from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/7
  to fix metrics (boo#1174895):
  * 0001-don-t-add-arbitrary-number-to-the-glypth-metrics.patch
  * 0002-use-zero-lineGap-sTypoDescender-should-be-negative.patch
  * 0003-truncate-foundry-if-there-is-no-known-abbreviation.patch
  * 0004-remove-now-obsolete-comment-too.patch
  * 0005-correctly-set-OS2-fsSelection-for-italic-and-bold-fo.patch
  * 0006-use-standard-C-rounding-functions.patch
  * 0007-use-more-properties-according-to-XLFD.patch
  * 0008-use-design-metrics-in-eblc-instead-of-calculated-met.patch
  * 0009-provide-version-5-OS-2-table.patch
  * 0010-Add-warnings-when-wrapping-multiple-fonts-and-on-PCF.patch
  * 0011-move-metrics-calculation-to-write.c.patch
  * 0012-calculate-capHeight-and-xHeight-as-recommended.patch
  * 0013-fix-sign-of-sTypoDescender.patch
  * 0014-use-PIXEL_SIZE-to-calculate-lineGap.patch
- Use %license</changelog>
  <changelog author="alarrosa@suse.com" date="1600776000">- Add more patches from upstream's master branch:
  * 0015-Fix-incorrect-error-handling-in-macTime.patch
  * 0016-Fix-uninitialised-memory-write.patch
  * 0017-Guess-Regular-style-for-Medium-Weight.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1604664000">- Add patch from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/11
  to fix more metric calculations (boo#1174895):
  * 0001-1em-is-font-size-not-heigh.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1608552000">- Add changes to make this effectively the same as fonttosfnt 1.2.1:
  * 0022-writeFile-avoid-file-leak-on-errors.patch
- At some point in the past, the following patches from 1.2.0 were also added:
  * 0018-remove-leftover-debug-printf.patch
  * 0019-handle-empty-foundry-encoded-as-NULL.patch
  * 0020-fix-sign-of-calculated-descent.patch
  * 0021-Fall-back-to-using-FONT-property-as-family-name.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1628164800">- Add patch making this effectively the same as fonttosfnt 1.2.2:
  * 0023-Fail-if-ftell-fails.patch</changelog>
</package>
<package pkgid="bf516bbba920c59213b0c18feeea547c1843da0bb71978ec004213b4db5b9bbc" name="fonttosfnt" arch="x86_64">
  <version epoch="0" ver="1.1.0" rel="3.3.1"/>
  <changelog author="vuntz@opensuse.org" date="1334318400">- Split fonttosfnt from xorg-x11. Initial version: 1.0.4.</changelog>
  <changelog author="zaitor@opensuse.org" date="1496232000">- Update to version 1.0.5+20170126.aead36f:
  * config:
  - Replace deprecated AM_CONFIG_HEADER with AC_CONFIG_HEADERS.
  - Move man pages into their own directory.
  - Add missing AC_CONFIG_SRCDIR.
  * man:
  - Remove trailing spaces and tabs.
  - Replace hard coded man page section with substitution
    strings.
  * configure: Drop AM_MAINTAINER_MODE.
  * autogen.sh:
  - Honor NOCONFIGURE=1.
  - Use exec instead of waiting for configure to finish.
  - Use quoted string variables.
  - Add default patch prefix.
- Switch to source service git checkout.
- Following the above, add libtool BuildRequires, and pass
  NOCONFIGURE=1 ./autogen.sh: Needed now that we build from a git
  checkout.
- Add pkgconfig(xorg-macros) BuildRequires: New dependency.
- Stop packaging ChangeLog and NEWS, dropped upstream.</changelog>
  <changelog author="sndirsch@suse.com" date="1534507200">- Update to version 1.0.5
  * Is it a bird? is it a plane? No it's a fonttofs.. fontstof..
    fonttofn... it's a release of the tool that wraps a bitmap
    font into a truetype wrapper! Bringing you the last 9 years
    of exciting changes including ansification and lots of
    autotools cleanup changes, because that is how we rolled 7
    years ago. (Almost) no source files were harmed in the
    making of this release.
- get rid of _service/_servicedata files</changelog>
  <changelog author="sndirsch@suse.com" date="1578398400">- Update to version 1.1.0
  * Update README for gitlab migration
  * Update configure.ac bug URL for gitlab migration
  * Correct a string literal
  * Mention .otb as an extension
  * Accept a BDF font on stdin
  * Avoid undefined behaviour
  * Round font size to integer value when reading bitmap font
  * Mark vsprintf_alloc as printf-like function
  * check for freetype NULL atoms
  * let freetype handle ISO-8859-1 mapping
  * allow ISO-646.1991-IRV as well, adobe standard for bdf</changelog>
  <changelog author="alarrosa@suse.com" date="1598356800">- Add patches from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/7
  to fix metrics (boo#1174895):
  * 0001-don-t-add-arbitrary-number-to-the-glypth-metrics.patch
  * 0002-use-zero-lineGap-sTypoDescender-should-be-negative.patch
  * 0003-truncate-foundry-if-there-is-no-known-abbreviation.patch
  * 0004-remove-now-obsolete-comment-too.patch
  * 0005-correctly-set-OS2-fsSelection-for-italic-and-bold-fo.patch
  * 0006-use-standard-C-rounding-functions.patch
  * 0007-use-more-properties-according-to-XLFD.patch
  * 0008-use-design-metrics-in-eblc-instead-of-calculated-met.patch
  * 0009-provide-version-5-OS-2-table.patch
  * 0010-Add-warnings-when-wrapping-multiple-fonts-and-on-PCF.patch
  * 0011-move-metrics-calculation-to-write.c.patch
  * 0012-calculate-capHeight-and-xHeight-as-recommended.patch
  * 0013-fix-sign-of-sTypoDescender.patch
  * 0014-use-PIXEL_SIZE-to-calculate-lineGap.patch
- Use %license</changelog>
  <changelog author="alarrosa@suse.com" date="1600776000">- Add more patches from upstream's master branch:
  * 0015-Fix-incorrect-error-handling-in-macTime.patch
  * 0016-Fix-uninitialised-memory-write.patch
  * 0017-Guess-Regular-style-for-Medium-Weight.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1604664000">- Add patch from https://gitlab.freedesktop.org/xorg/app/fonttosfnt/-/merge_requests/11
  to fix more metric calculations (boo#1174895):
  * 0001-1em-is-font-size-not-heigh.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1608552000">- Add changes to make this effectively the same as fonttosfnt 1.2.1:
  * 0022-writeFile-avoid-file-leak-on-errors.patch
- At some point in the past, the following patches from 1.2.0 were also added:
  * 0018-remove-leftover-debug-printf.patch
  * 0019-handle-empty-foundry-encoded-as-NULL.patch
  * 0020-fix-sign-of-calculated-descent.patch
  * 0021-Fall-back-to-using-FONT-property-as-family-name.patch</changelog>
  <changelog author="alarrosa@suse.com" date="1628164800">- Add patch making this effectively the same as fonttosfnt 1.2.2:
  * 0023-Fail-if-ftell-fails.patch</changelog>
</package>
<package pkgid="ecf944fe9d508583016acc2723346b9828b58c7579273c4dce69da450874a19f" name="freeradius-server" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="5aef1f82c89f198bf37bfa3615d6d1c0b4a15a255b523dd508b99599175577f5" name="freeradius-server" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="4d80a38e2337867738beead9eb539919276f400c686cac9863d35e8170462806" name="freeradius-server" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="5136acc136a74bbc8fb9cb9f1e84ea60fa1853907af320e2e8c1672c7c148a42" name="freeradius-server" arch="src">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="be6f5fe56965004b9387d71a52dcefab68594f78dfd182e10f6733c3ef701459" name="freeradius-server" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="83d0d08c4461d93d1208611569da93b2705d5f77dec386ac89d53276fa8f12e3" name="freeradius-server-devel" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="d92d80c9a39a37e83231247aad9c3f72d8b9255839c96d54bcdfe2bcf3286bc8" name="freeradius-server-devel" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="c8459f3978f973ea1181540909cd3ebd4a1ac95c1e3521fd90c75cb5194e82d3" name="freeradius-server-devel" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="456695ed7bc534ee0d18ccefb6b5767c7b87d27730ab248fd43bb2d04dd9b385" name="freeradius-server-devel" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="932b81fc6aa88361b6ed0ea4538d54f13767b67e3c5597bcbb1eac2e5f634b58" name="freeradius-server-doc" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="7ca88bd7fb360695780344f060a7f3ccd2c153659fd3898a4afd647e4fadcfe3" name="freeradius-server-doc" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="e753393a4d31c6cab0888b1545a665ce7084729557aabc96502e61221f71f4a7" name="freeradius-server-doc" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="756346243d3e1cda908264451d9615d9cfab7600901e5766c5853fd9b76312c5" name="freeradius-server-doc" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="644a11fbc9d4df57e591e625871fae228a61420c7bdd64858bb078d93eaf4bd7" name="freeradius-server-krb5" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="5f51c4479b55819512fb0c911af10a62e9bbd15f9a144843e8730f18310a859c" name="freeradius-server-krb5" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="99636f37805fa30a8ce3b2fb79c7e9149025a20273007b4ce4747aa2bd6e6c72" name="freeradius-server-krb5" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="8cc10aab9f9a396c2b61ff2599da9ce3cc595aab202b78ca3cf78e8faf965986" name="freeradius-server-krb5" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="0a6220bbca13647da56feaba5f90dc5a911a079f96da16bf12b487257537a3bf" name="freeradius-server-ldap" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="396fbd1144258168ef04ef3d018e135c44f54b602d08428a889bcad1afe0eda1" name="freeradius-server-ldap" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="ef7998b1634cdd5785a11707dfc7fe25f233672e05a87e5e0adf68667227d473" name="freeradius-server-ldap" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="3a28375ea4ffcde1e19042d38c53dfde82f219319bee3ce2a2d7cd4a1ea6c5ba" name="freeradius-server-ldap" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="f96d507a9d4b4f1e1e25ad080951751b292141b1a7c3b04cb32830ef56386c2f" name="freeradius-server-libs" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="a9ea6fcbd79957ae67eaaf247453ff57ad6b939268baefe48f8d5f496928b499" name="freeradius-server-libs" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="963c0235df0681820b255cec8a19bc21660d66930b41d91015ee0706960ec9c2" name="freeradius-server-libs" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="477df48ed1fe1a333bc46d4cbb8503c386be8ce84006d02ce82f9702440d09bd" name="freeradius-server-libs" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="b9f969b52b7bdcdd58561e083c970abea1cb84615352137f8eb5630c9cd7f315" name="freeradius-server-mysql" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="99fe167138aadbb39e15b0d4d06d46e08aade38bd212888170aad1b0b8aaae18" name="freeradius-server-mysql" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="aea865f2490397a88b209a1282f6bc922f508d45df84fcbc4fbef13bd563a7dd" name="freeradius-server-mysql" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="4e0ef2edf33cb4588f9079012c8f6d3eb7c0827a4d11b0459586527c31c1fe4b" name="freeradius-server-mysql" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="e5f5057d4a12d5fbaa596ee0da5e5fc72041d499123c02e41de29d6a9b0ba8e3" name="freeradius-server-perl" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="c0af195d0e6f3002043947f8f252b8df520c5850e67c3cc050a79c12ab01c17f" name="freeradius-server-perl" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="9e05c74e08cd856219b6c4a802b92eba12f3cc259ea4e0ca2fb3b13432139e4c" name="freeradius-server-perl" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="87da8bb3a6b4914391dbefcaa2d65d2cc14a20e7de245fc4874b8da860a06247" name="freeradius-server-perl" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="7092a8fa1915cdb50503dd1f04907f9962e3618a7e9e4e114f7e75519a275fae" name="freeradius-server-postgresql" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="2d2e07db868e12cf70e9eaa4fa769aa04eff405d30644cb8688b08ffdc82623b" name="freeradius-server-postgresql" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="9a2bb07c42ea9cfb0e2e5771e9abfa6ea5e4b6ebc95fe3f7f78fda9e4d7ec7da" name="freeradius-server-postgresql" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="687b58f6e120fb24043bf4c0f227604fcb7621169c805dcf08a4b10f154d5334" name="freeradius-server-postgresql" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="30ac589d865fba79775dd097fc9cd79c5097963b284e4dc083af17dae4a0b263" name="freeradius-server-python3" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="f426d46c1ae1c64ddad289c6dad4c90cf060494e4f28ebdc12b93a254cfb1114" name="freeradius-server-python3" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="6c09459ae1782018dca18b7d13431d6ac6d39a43ab08bebff949b0afa0864ea3" name="freeradius-server-python3" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="6d8e70540a13871075081903fad301e3d3bbbe1752ab8bc853fc071718afeee9" name="freeradius-server-python3" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="ef89ef5db0a5dd0c126026a37b19314eae2b8512f524b73eec606bf4280bf881" name="freeradius-server-sqlite" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="97f1e83423951b036ccbc92144076f74314c2ff5204ba3d27a622c3cba3b48e4" name="freeradius-server-sqlite" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="8dcd6db1e20c5c3a4ad0e130d68eb2307d984f327206ab915a9b26fa7a404b7b" name="freeradius-server-sqlite" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="4fb945c478e90a8bf20ad46fc10ea36b91f21476bd75839f5d53c1fbe0533a6d" name="freeradius-server-sqlite" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="e3b83e3bab97dac22f75f7ec935dfabd8c4a6c1f1b5d7606d0059912fa9cd2d7" name="freeradius-server-utils" arch="aarch64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="c2561d4ea23c9b72faebbac6123f1ca9f72f0d81960d66b6f7f9adb30fc2d41a" name="freeradius-server-utils" arch="ppc64le">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="8a255dd939c36b4bb20b4a3cb7b40194b41ebd72481ad41c1f6c2f2c77670764" name="freeradius-server-utils" arch="s390x">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="90b9f598a3102aef3d303bf0dcfdf31f557d5b7e4aa3a11275cfc1107fcdbc55" name="freeradius-server-utils" arch="x86_64">
  <version epoch="0" ver="3.0.21" rel="3.9.1"/>
  <changelog author="kukuk@suse.de" date="1487592000">- Don't require insserv if we use systemd
- Remove require for unused fillup</changelog>
  <changelog author="michael@stroeder.com" date="1488801600">- removed obsolete freeradius-server-fix-cert-bootstrap.patch
  because recent /etc/raddb/certs/bootstrap simply works
- update to 3.0.13 (still FATE#322416)
  Feature improvements
  * Add dictionary.rfc7930.  Note that we do not implement
    the RFC.
  * Added 'cipher_server_preference' to mods-available/eap
    Patch from #1797.
  * OpenSSL 1.1.0 compatibility fixes.
  * rlm_perl: radiusd::xlat to evaluate xlat string
    within perl script
  * Allow authentication retry in winbind. Patch from
    Herwin Weststrate. See raddb/mods-available/mschap.
  * Added "recv-coa" method to rlm_rest.  It behaves the
    same as "authorize".
  * Document Trust Router tr_port option.  Patch from
    Stefan Paetow.
  * Update elasticsearch/logstash examples so that they work
    with elastic stack v5.  Patch from Matthew Newton.
  * Print information about packets, replies, and contents
    in the detail file reader.
  * Update abfab-tr policy.  Pull request #1893
    from Stefan Paetow.
  * Reject packets which contain User-Password and
    EAP-Message.
  * Add example for filtering Access-Challenge.
    See sites-enabled/default.
  * Pull symlink fixes from v4.0.x.  Fixes #1859.
  * Add systemd reload.  Not everything is reloaded, but
    some is.  Fixes #1662.
  * Better documentation for listen "ipaddr".  Fixes #1921
  * Add dictionary.cnergee, updated dictionary.nomadix.
  * radclient no longer needs -x to print statistics with -s.
  Bug fixes
  * Minor typos.  Fixes #1763
  * Fix typo in RPM build.  Closes #1767.
  * rlm_mschap check for password expiry only
    if password was correct.  Fixes #1762.
  * Update debian build.
  * update rlm_counter "man" page.  Fixes #1775.
  * Remove erroneous assert.  Fixes #1778.
  * fix mschap password change test.  Fixes #1792.
  * Cleanup config file on data remove.  Fixes #1795.
  * passwd module returns "notfound" if not found.
  * Check for old OpenSSL, and don't build rlm_eap_fast
    if it necessary.  Fixes #1803
  * Cleanup memory better after ldap version query.
    Patch from Aleksey Katargin.
  * Rename lt_* functions to avoid linker issues with
    libtool.  Fixes #1277
  * Many miscellaneous fixes and typos.
  * Allow long strings in %{%{foo} bar:-%{baz} blah".
    Fixes #1866
  * Fix filtering operators, along with more documentation and
    more tests for them.
  * Fix OpenSSL fixes.  Fixes #1876.
  * Finish SQL select queries even when SELECT returns no rows.
    Fixes #1879.
  * Set Module-Failure-Message for more EAP errors.
  * Correct typo in dictionary.rfc5580.  Fixes #1882
  * Remove obselete systemd syslog.target.
  * Client-Port-Balance load-balancing now uses client port.
  * Radrelay examples fixed from Alex Clouter.
  * Update systemd target.  Pull request #1896.
  * Trim starting whitespace in xlat strings.
  * Get MySQL result lengths using normal API.
  * suid down after fchown().  Fixes #1914.
  * Fix cases of comparing pointer to NUL character.  Fixes #1915.
  * OpenSSL v1.1 fixes.  Pull request #1921.
  * Better Handle v4/v6 host names.  Pull request #1919.
  * Remove "Auth-Type = System" from docs and examples.
  * Don't crash on malformed %{home_server}.  Fixes #1922
  * fix erroneous use of talloc destructor in rlm_eap
  * Issue trigger modules.sql.fail.  Fixes #1923
  * Document python_path gotcha's.  Fixes #1845
  * dlopen() the specific version of Python.  Fixes #1592</changelog>
  <changelog author="adam.majer@suse.de" date="1496059200">- update to 3.0.14 (still FATE#322416)
  Feature improvements
  * Enforce TLS client certificate expiration on session resumption,
    and Session-Timeout. See CVE-2017-9148 (bnc#1041445)
  * Updated dictionary.cisco.vpn3000, dictionary.patton
  * Added dictionary.dellemc
  * Lowered the log output for failed PEAP sessions.
  * ALlow utc in rlm_date.
  * The internal OpenSSL session cache has been disabled.
    Please see mods-available/eap
  * Update detail reader documentation.
  * Make outgoing RadSec connections non-blocking.
  * Add SQL backing to Moonshot-*-TargetedId generation.
  Bug Fixes
  * radtest uses Cleartext-Password for EAP, not User-Password.
  * Update documentation for mods-enabled/ linking.
  * Enhanced checks for moonshot salt.
  * Allow session resumption for RadSec connections.
  * Update "huntgroups" file to note that port ranges are not supported
  * Fix OpenSSL permissions issues on default key files.
  * Certificates are not required when PSK is used.
  * Allow SubjectAltName as first extension in cert.
  * Fixed talloc issue with TLS session resumption.
  * "&amp;Attr-26 := 0x01" now produces useful error messages.
  * Handle connection error in rlm_ldap_cacheable_groupobj.
  * Fix endian issues in DHCP.
  * Multiple minor fixes for Coverity complaints.
  * Handle unexpected regex.
  * Fix minor issues in dictionaries.
  * Fix typos and grammar. Patches from Alan Buxey.
  * Fix erroneous VP creation in rlm_preproces.
  * Fix MIB. Patch from Jeff Gehlbach.
  * Trust router updates from Alejandro Perez.
  * Allow build with LibreSSL.
  * Use correct packet for channel bindings.
  * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us
    a test license. Please see the git commit history for more info.
  * Fix incorrect length check in EAP-PWD. This may be exploitable.
  * Stop rotating session database files (radutmp, radwtmp) since
    these are not logfiles.
- freeradius-server-radiusd-logrotate.patch: updated</changelog>
  <changelog author="michael@stroeder.com" date="1500292800">- update to 3.0.15 with security fixes for
  issues found via fuzzing by Guido Vranken (bsc#1049086)
  https://freeradius.org/security/fuzzer-2017.html
  * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret()
  * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63
  * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax()
  * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes
  * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp()
  * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions()
  * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly
  * FR-AD-002 (v3) String lifetime issues in rlm_python
  * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare</changelog>
  <changelog author="varkoly@suse.com" date="1503662400">- bsc#1055679 - freeradius-server does not provide winbind/AD auth
  Added libwbclient-devel as buildrequires</changelog>
  <changelog author="adam.majer@suse.de" date="1505822400">- Fix permissions of radiusd.service (bnc#1053654)</changelog>
  <changelog author="michael@stroeder.com" date="1515672000">- update to 3.0.16
  Feature improvements
  * rlm_python now supports multiple lists.  From #2031.
  * Add trust router re-keying.  From #2007.
  * Add support for Samba / AD LDAP schema.
  See doc/schemas/ldap/samba/README.txt and
  doc/schemas/ldap/samba/
  * Add "tls_min_version" and "tls_max_version" to EAP module
  for Debian OpenSSL issues.
  * Better documentation for client certificates in PEAP and TTLS:
  it usually doesn't work.  Fixes #2068.
  * Distinguish login failure from AD unavailable.  Fixes #2069.
  * Update RH spec files.  Fixes #2070.
  * Run Post-Proxy-Type if all home servers are dead.
  Fixes #2072.
  * Print offending IP addresses when EAP sessions come from
  two upstream home servers, and rate-limit the messages.
  * Minor packaging updates.
  * Better documentation for rlm_rest.
  * EAP-FAST now has it's own "cipher_list", so that it is
  easier to configure.
  * EAP-FAST now forcibly disables TLS1.2, until such time
  as we implement the new keying mechanism from TLS1.2.
  * Add documentation for allow_expired_crl.
  * Update Debian logrotation.  #2093 and #2101.
  * DHCP relay can now drop responses.  #2095.
  * rlm_sqlippool can now assign Delegated-IPv6-Prefix.
  It also now can assign any IPv4 or IPv6 address.
  Based on patches from maximumG.  #2094.
  See raddb/mods-available/sqlippool for changes.
  * radeapclient can now use EAP-SIM-Ki to dynamically
  create the necessary triplets.
  * Explain why many LDAP connections are closed.
  Fixes #1969.
  * Debian build / package issues fixed by Matthew Newton.
  * dictionary.patton updates from Brice Schaffner.  Fixes #2137.
  * Added scripts to build "inner-server.pem", and updated
  mods-config/inner-eap and certs/README to match.
  * Added provisions for using an external CA.  See raddb/certs/
  * Include dhcpclient binary in freeradius-dhcp debian packge.
  Bug fixes
  * Bind the lifetime of program name and python path to the module
  FR-AD-002 (redone)
  * Pass correct statement length into sqlite3_prepare[_v2]
  FR-AD-003 (redone)
  * Allow 100-Continue responses with additional headers in rlm_rest.
  * fix corner case where detail files were not being locked
  correctly.
  * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group.
  Fixes #1947
  * Clean up exfile code.  Which should help to avoid issues
  with reading / writing 100's of detail files.
  * Fix build for winbind.  Patch from Alex Clouter.
  * Fix checkrad for Mikrotik.  Patch from Muchael Ducharme.
  * Fix home server stats lookup.  Patch from Phil Mayers.
  * Add libjson-c3 as an optional dependency.
  * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking
  against NSS, which breaks the server.  Fixes #2040.
  * rlm_python fixes.  Fixes #2041
  * Typos in "man" pages.  Fixes #2045
  * Expand "next" in %{%{...}:-%{...}}.  Fixes #2048
  * Don't add TLS attributes twice.  Fixes #2050.
  * Fix memory allocation in rlm_rest.  Fixes #2051.
  * Update trustrouter for new API. Fixes #2059.
  * Fix SQLite issues on FreeBSD.  Fixes #2060
  * Don't do debug logging of bad passwords.  Fixes #2064. (bsc#1099802)
  * More graceful handling of "die" in rlm_perl.  Fixes #2073.
  * Fix occasional crash when using
  cisco_accounting_username_bug = yes
  * EAP-FAST fixes from Isaac Boukris.
  [#2078], #2076, and #2082, #2126.
  * DHCP fixes, relay, #2092, add run-time check, #2028
  * Decode multiple RADIUS packets at a time in highly loaded
  RadSec connections.  Patch from Jan Tomasek.  #2106.
  * TunnelPassword is not "single value" in LDAP schema.
  Fixes #2061.
  * sql log now opens the expanded filename, not the input one.
  This was a regression introduced in 3.0.15.
  * Remove unnecessary UNIQUE constrain in Oracle schemas.
  * Fix SSL thread and locking issues when modules also use SSL.
  Fixes #2125 and #2129.
  * Re-add dhcpclient "raw packet" changes.  Patches from
  Nicolas Chaigne and Matthew Newton.  Fixes #2155.</changelog>
  <changelog author="michael@stroeder.com" date="1523966400">- update to 3.0.17
  Feature Improvements
  * Add CURLOPT_CAINFO. Patch from Nicolas C #2167.
  * "stats home server" now supports "src IPADDR", to specify home
  server also by source IP. Fixes #2169.
  * Add Dockerfiles for a selection of common systems.
  * Increase number of permitted file descriptors, for systems with many
  home servers.
  * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs
  Patch from Isaac Boukris. Fixes #2205.
  * Update main READMEs. Patches from Matthew Newton.
  * Added dictionary.mimosa.
  Bug Fixes
  * Don't call post-proxy twice when proxying to a virtual server.
  Matthew Newton, #2161.
  * Use "raw" string value for shared secrets and dynamic clients
  It now parses strings with backslashes and "special characters"
  correctly. Fixes #2168.
  * Fix RuntimeDirectory for RedHat, from Alan Buxey.
  * Relax checks in 'if' parser from Isaac Bourkis.
  * Minor cleanups for %{debug_attr:&amp;request} from Isaac Boukris.
  * Be more aggressive about cleaning up cached certificate attributes,
  due to deficiencies in OpenSSL. Reported by Nicolas Reich.
  * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall.
  * Fix double free in rlm_sql. Fixes #2180.
  * rlm_detail now writes empty Access-Accept packets.
  * rlm_python can now create tagged attributes.
  * Don't crash on duplicate realm + authhost / accthost
  * Allow partial certificate chain to trusted CA. Fixes #2162.
  * Treat SSL_read() returning zero as error. Fixes #2164.
  * detail writer now checks if the file was renamed or deleted.
  * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name.
  * RedHat Systemd updates. Fixes #2184.
  * Use correct API for State variable in rlm_securid.
  * Remove broken radclient option "-i".
  * Fix "users" file (and hints, etc). So that it does not get confused
  about entry ordering with multiple $INCLUDEs.
  * Fix rlm_sql to expand the un-escaped string, not the raw string.
  * Link default and inner-tunnel only if they exist. Fixes #2206.
  * Don't use both IP_PKTINFO and IP_SENDSRCADDR.
  * Always install signal handler for SIGINT (needed by Docker).
  * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs
  which are not self-signed will now be checked.
  * sqlippool now returns "fail" if it fails IP allocation.
  * Fix rlm_yubikey to look for correct attribute in replay attack check.</changelog>
  <changelog author="michael@stroeder.com" date="1530014400">- also fix ownership of /var/log/radius in systemd unit</changelog>
  <changelog author="adam.majer@suse.de" date="1530705600">- install license as %license instead of documentation</changelog>
  <changelog author="michael@stroeder.com" date="1551182400">- update to 3.0.18
  * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss.
  * Do-Not-Respond policies can now be set in the "post-auth" section.
  * Encode / Decode ADSL Forum DHCP options.
  * Fix module ordering issues. e.g. when "sqlippool" needs "sql".
  See the "instantiate" section of radiusd.conf.
  * Add Big Switch dictionary. Fixes #2252.
  * Add sql_session_start policy (raddb/policy.d/accounting)
  This minimizes race conditions when using Simultaneous-Use (#2257).
  * For rlm_perl, all variables are now tainted by default.
  See raddb/mods-available/perl, and the "perl_flags" configuration item.
  This change should only affect people who are using variables in
  insecure ways.
  * Allow "sqlcounter" module to be listed in "post-auth".
  * Add support for IPv6 attributes in SQL. Fixes #2280
  * The server is better at handling fail-over for outbound RadSec and
  TCP connections. Fixes #2284.
  * The server is now more aggressive about retrying failed outbound
  RadSec and TCP connections. Fixes #2284.
  * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list.
  * Add expansion for Radsec connections. "%{listen:TLS-...}" for
  TLS-Client-Cert-* and TLS-Cert-* attributes.
  * Add notes on running "ldapsearch" using the parameters from the LDAP module.
  * "ipaddr" attributes can now be cast to "integer" type attributes
  in an "update" section.
  * Move main thread queue to using atomic queues. This should help
  with contention in high load scenarios.
  * Add "recv_buff" setting to listeners. For more details,
  see sites-available/default.
  * The sqlippool module can now use attributes other than "Pool-Name"
  to assign IP pools. The "Pool-Name" attribute is still the default.
  * The "unpack" expansion can now unpack substrings.
  See mods-available/unpack for documentation and examples.
  * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair
  Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE.
  * Allow for &lt;instance&gt;-LDAP-UserDN. See mods-available/ldap for more information.
  * Add sanitizing of control list for moonshot. Fixes #2318.
  * Update rlm_sql_mysql to be compatible with MySQL 8
  Fixes https://bugs.launchpad.net/bugs/1795310.
  * Allow logging of only Access-Accept or Access-Reject messages
  See radiusd.conf, "auth_accept" and "auth_reject".
  * Removed Connect-Rate comparison. It was unused and broken.
  * Add dictionary.infinera.
  * Use OpenSSL HMAC functions instead of local ones.
  * Some SQL modules can now use "auto_escape" to escape unsafe strings
  See mods-config/sql/main/mysql/queries.conf.
  * Add wispr2date conversion in mods-available/date.
  * Implement dictionary-based handling in rlm_python.
  Fixes #2334 See mods-available/python for details.
  * Add support for SKIP LOCKED in sqlippool. This can improve performance
  by an order of magnitude or more.
  See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383
  * Allow PSK and certificates at the same time Except for TLS 1.3
  which does not support that.
  * Update docker scripts. Fixes #2306 Patch from Matthew Newton.
  * Add crypt xlat.
  * MySQL connections can now skip verifying the server certificate.
  Fixes #2481. See mods-available/sql.
  * Add better mechanism to detect MariaDB (Old MySQL).
  * Add RFC 7532 "bang path" support for realms Fixes #2492.
  * Update dictionary.ukerna documentation. Fixes #2493.
  * Add support for systemd service and watchdogs Fixes #2499.
  * Check for openss/rand.h, and allow building without OpenSSL engine.
  Patch from Eneas U de Queiroz Fixes #2517.
  * The default PosgtreSQL queries now use "ON CONFLICT" to better
  deal with issues. This requires PostgreSQL 9.5 or later.
  Please use a recent version of PostgreSQL, or edit the default
  queries to remove "ON CONFLICT".
  BUG FIXES
  * The session-state list is no longer cleaned in the inner-tunnel.
  This lets the outer Access-Reject section access session-state.
  * Fix typo in lock initialization for TLS sockets Found by Sergio NNX.
  * Add check for crash when home server down Fixes #2233.
  * Add username key for postauth table.
  * Better libpcap checks, when the header files or libraries are missing. Fixes #2245.
  * Allow building with old versions of OpenSSL Fixes #2247.
  * Allow non-FreeRADIUS State attributes to be used with the
  "session-state" list. i.e. State length != 16.
  * Be more aggressive about cleaning up zombie children when running in debug mode.
  * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries
  exporting LDAP API functions.
  * unlock files when asked to unlock them.
  * return error instead of asserting in map code.
  * Don't write 0 bytes to SSL. Fixes #2270.
  * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262.
  * Various dictionary cleanups and consistency checks Fixes #2281.
  * rlm_python has stronger thread locking to prevent reported issues.
  Performance may be affected.
  * Don't allow Message-Authenticator to overflow past the end of a large packet.
  * Fix crash in sqlippool when SQL server goes away Fixes #2300.
  * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303.
  * Fix crash with CoA packets/ Fixes #2304.
  * Fix crash in rlm_exec with CoA. Fixes #2328.
  * Print errors while parsing the log config, and don't quit when
  deprecated log settings are found.
  * Fix DHCP encoder xlat so that it can be used with a list of attributes.
  It previously only encoded the first member of the list,
  and now encodes all members.
  * The "expr" module now skips more whitespace.
  * Remove internal FreeRADIUS-Response-Delay attributes from
  attr_filter Access-Reject.
  * Don't send junk to redis when maximum args reached.
  * Small updates to IPv6 for accounting schema Fixes #2364.
  * Fix OpenDirectory integration in rlm_mschap.
  * Fix slow memory leak with dynamic clients.
  * Don't artificially truncate debug output for long strings.
  * Fix memory leak in EAP-PWD.
  * Fix crash in "hints" file with Fall-Through = yes.
  * Fix crash / timer issues with many CoA packets.
  * Fix attr_filter so that it does not treat vendor attributes of
  number 26 as Vendor-Specific.
  * Fix reconnect correctly in rlm_sql_mysql.
  * Fix rlm_cache to properly use Cache-TTL &lt; 0 Fixes #2485.
  * Fix rare occurance of bad xlat expansion.
  * Check for rare race condition when a proxy reply arrives too late.</changelog>
  <changelog author="adam.majer@suse.de" date="1551268800">- reformat changelog mostly by wrapping lines
- add missing bug numbers for security fixes</changelog>
  <changelog author="michael@stroeder.com" date="1554897600">- update to 3.0.19 (jira#SLE-5890)
  Feature improvements
  * Update dictionary.cisco
  * Update sqlippool to allow for stored procedures with
    PostgreSQL.  This increases performance substantially.
    Patch from Nathan Ward.  Fixes #2540.
  * Re-added "show client config" command to radmin.
  * Cleaned up mods-available/sql example so that it is
    easier to understand.
  * Added pfSense dictionary. Closes #2581
  * Update dictionary.h3c Closes #2592
  * Update elasticsearch/logstash config for v6.7.0.
  * EAP-PWD security fixes from Mathy Vanhoef. See
    http://freeradius.org/security/
    (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664)
  Bug fixes
  * Update dynamic_client module and server core so that
    the functionality works.  This has been broken since
    at least v2.
  * Fix crash in sqlippool due to escaping changes.
    Patch from Nathan Ward.  Fixes #2532, #2533.
  * Fix systemd notify, watchdog and unit files.
    Fixes #2541, #2499.
  * Fix erroneous length check in EAP-FAST.
  * Update documentation to remove old "ignore_null"
    configuration. Fixes #2578.
  * Fix default POD port. Should be 3799.  Fixes #2591
  * Correctly encode vendor-specific "encrypted" attributes.
    Fixes #2600</changelog>
  <changelog author="jcnengel@gmail.com" date="1577102400">- Add missing BuildRequire on samba-core-devel required for windbind
  support in rlm_mschap.</changelog>
  <changelog author="adam.majer@suse.de" date="1583928000">- Enable memcached driver on SLE15</changelog>
  <changelog author="adam.majer@suse.de" date="1584446400">- update to 3.0.20 (bsc#1146848)
  Feature Improvements
  * Added Force10 dictionary.
  * Update dictionary.hp with new attributes. #2690.
  * Update dictionary.aruba with new attributes. #2696.
  * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456)
  * Relax OpenSSL version checks, now that their API is both public, and stable.
  * Note that tls_min_version/tls_max_version also support "1.3"
    Since there is no standard yet for EAP with TLS 1.3, it will not work.
  * Added tripplite dictionary from #2760.
  * Switch to the async interface for rlm_sql_postgresql so that
    we can enforce query_timeout.
  * Added new LDAP option 'allow_dangling_group_ref'.
  * Updated documentation and functionality for EAP session caching
    See "cache" section of mods-available/eap.
  * Tighten systemd unit file security. Fixes #2637.
  * Disable TLS 1.0 and TLS 1.1 support in the default configuration
    We STRONGLY recommend doing this for all installations.
  * Add expansions for *outgoing* Radsec connections
    "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and
    TLS-Cert-* attributes. Fixes #2839.
  * Add %{listen:tls} which returns "yes" or "no" for
    TLS or non-TLS connections.
  * Update dictionary.lancom with new attributes. #2847.
  * Added rlm_sql_mongo. See raddb/mods-available/sql.
    Note that this module is experimental.
  * Added more documentation in sites-available/robust-proxy-accounting.
  * sqlippool now re-allocates unexpired leases, to prevent IP pool
    exhaustion when clients perform multiple reauthentication attempts
  * Add support to radmin keep the history in ~/.radmin_history.
  * Add support for ENV and LD_PRELOAD in radiusd.conf.
    See the new ENV sub-section of radiusd.conf.
  * Update dictionary.aptilo. #3002.
  * Update dictionary.airespace. #3039.
  * Add sites-available/coa-relay, which makes CoA easier #3045.
  * Add example stored procedure for IP Pools in MySQL
    See mods-config/sql/ippool/mysql/procedure.sql
  * Update dictionary.dhcp dictionary with the recent hardware types.
  * Add experimental rlm_python3. This should largely work
    the same as rlm_python, which was Python2 only.
  * Add Dockerfiles for Debian10 and CentOS8.
  * Add RPM spec file compatibility for RHEL/CentOS 8.
  * Notes on certificate constraints. See raddb/certs/server.cnf.
  * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585.
  Bug Fixes
  * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627
  * ERX-Acct-Request-Reason is "integer". Closes #2635.
  * Fix a slow memory leak in the file management code.
  * Try to fix file permissions if they get modified while
    the server is running
  * Fix slow memory leak with clients.
  * Fix request and connection timeouts in rlm_rest.
  * Fix systemd issues.
  * Fixes from clang analyzer.
  * Fix missing include for the dictionaries:
    alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn,
    audiocodes,avaya,bristol, columbia_university,freedhcp,garderos,
    infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus.
  * Fix internal sanity check when running with "-Xx".
  * Allow "inner-tunnel" virtual servers to work better
    with "accept" and "reject" policies.
  * Fix dictionary.huawei data types for
    Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address.
  * Framed-Interface-ID in postgresql/queries.conf is string,
    not inet Fixes #2817.
  * Fix rlm_cache to complain on unknown attributes in the "update"
    section of its configuration.
  * Add configure checks for -latomic. This helps on armel,
    mips and mipsel. Fixes #2828.
  * Add support to Oracle 19 and 18. Via #2857.
  * Add support for decoding tags in rlm_rest. Fixes #2848.
  * Use correct passwords when updating CRLs in raddb/certs/.
  * Properly separate "originate-coa" packets when accounting
    packets are read from the detail file reader.
  * Use the correct virtual server for pre/post-proxy.
  * radsqlrelay fixes backported from "master" branch
  * Fix DoS issues due to multithreaded BN_CTX access
    (bsc#1166847, CVE-2019-17185)
- disable python2 for SLE15 and Factory
- freeradius-server-enable-python3.patch: enable Python3 module
- freeradius-python3_patches.patch: backport python3 fixes from upstream
- freeradius-server-opensslversion.patch: updated</changelog>
  <changelog author="adam.majer@suse.de" date="1585051200">- update to 3.0.21 (jsc#SLE-11896)
  Feature Improvements
  * New stored procedure for allocating IPs with PostgreSQL
    Rates of 1500 IPs per second are now possible
    See raddb/mods-config/sql/ippool/postgresql/procedure.sql
  * Add SQL IP pool support for Microsoft SQL Server
    See raddb/mods-config/sql/ippool/mssql/
  * Added RCNTEC dictionary. Closes #3168.
  * Added Pica8 dictionary. Closes #3179.
  * Add TLS-Client-Cert-Valid-Since attribute holding not
    Before date Patch from Boris Lytochkin. Fixes #3157.
  * Generate attributes containing unknown OIDs See raddb/sites-available/tls
  * Update the WiMAX dictionary.
  * Added ability to rlm_python(Python2) show a stacktrace
    from errors. #2979.
  * Add WiFi Alliance Policy OIDs.
    See raddb/certs/xpextensions
  * radmin now shows coa stats, too.
  * Sample schema extensions for summarizing data in SQL
    See mods-config/sql/main/*/process-radacct.sql
  * Update dictionary.aerohive, dictionary.fortinet,
    dictionary.arista and dictionary.erx.
  * Added VAS Experts dictionary.
  * Many updates to RPM and jenkins builds from Matthew Newton.
  * Added %C (time now in seconds) and %c (microsecond component of now)
    back-ported from the "master" branch.
  * Add reload capability to systemd unit file in Debian and RedHat.
  * Increase timestamp precision in postauth to maximum supported by each
    database and simplify (and make more consistent between drivers)
    the timestamps in SQL queries by using expansions.
  * Option to set dictionary path in raduat script.
  Bug Fixes
  * Various fixes found by PVS-Studio.
  * Set permissions of certificates in bootstrap shell script Fixes #3132.
  * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141.
  * Skip processing proxy reply if there are no home servers available.
  * Update SQLite IPPool queries. Fixes #3177
  * rlm_sql_unixodbc fixes. Fixes #2822.
  * Fixes when building with LibreSSL.
  * Fix the rlm_python3 build. Note that this module is experimental. #3183.
  * The rlm_python should append the 'python_path' paths in 'sys.path'.
    It fixes the expected behavior to use the existing Python modules
    Fixes #3180.
  * Fix rlm_python to print the script errors properly.
  * Bound total query time for PostgreSQL. Fixes #3253.
  * Many fixes to Oracle sqlippool. It now does 500 IPs per second
    without any tuning. Fixes #3270.
  * Reference sqlippool by it's correct name. Fixes #3272.
  * Revert 3.0.20 patch which caused crashes on duplicate clients.
  * Update WiMAX-MSK attribute. Fixes #3280.
  * Fix crash when trying to access non-existant regex capture group.
  * Use timestamps (request or server) rather than SQL NOW()
    in accounting queries so that these are stable when replayed
    from a file buffer.
- freeradius-python3_patches.patch: upstreamed</changelog>
  <changelog author="adam.majer@suse.de" date="1598443200">- freeradius-server-radiusd-logrotate.patch: fix permissions in
  logrotate global section (bsc#1170505, bsc#1174905)</changelog>
  <changelog author="adam.majer@suse.de" date="1609761600">- freeradius-server-radiusd-logrotate.patch: move logrotate
  options into specific parts for each log as "global" options
  will persist past and clobber global options in the
  main logrotate config (bsc#1180525)</changelog>
  <changelog author="adam.majer@suse.de" date="1619438400">- logfile_secrets.patch: do not log passwords in logfiles (bsc#1184016)</changelog>
</package>
<package pkgid="a6ea09b4b832ab5842bf21a752bcf1bf7e7c4dbf8cd905b10bd1de18e65816d3" name="fribidi" arch="aarch64">
  <version epoch="0" ver="1.0.5" rel="3.3.1"/>
  <changelog author="coolo@novell.com" date="1272628800">- buildrequire pkg-config to fix provides</changelog>
  <changelog author="adam@mizerski.pl" date="1296993600">- update to 0.19.2
  * Update to Unicode Character Database 5.1.0</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="jengelh@inai.de" date="1405771200">- Utilize shared library package naming guidelines
- Drop Requires:pkg-config for fribidi-devel, it is implicit
  (due to .pc file being picked up by rpm find-requires)</changelog>
  <changelog author="ftake@geeko.jp" date="1410350400">- libfribidi-devel requires %{lname} = %{version}</changelog>
  <changelog author="i@marguerite.su" date="1415275200">- update version 0.19.6
  * Fix two minor bidi bugs.
  * Build with new libtool to support ppc64le.
- fix boo#903462: -enable-malloc to be thread safe</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1518868800">- Update to version 1.0.1:
  + Minor distribution related fixes.
- Changes from version 1.0.0:
  + Full isolate and parenthesis support as per Unicode 6.3 to
    Unicode 10.0.
  + To get access to the new algorithm calls to the function
    `fribidi_get_par_embedding_levels()` must be replaced with
    calls to `fribidi_get_par_embedding_levels_ex()`. These
    functions are not API compatible. Calling the older function
    will use default values for the new bracket properties and will
    sometimes yield non-complient results.
- Changes from version 0.19.7:
  + Disable thread-unsafe memory pool by default (fdo#79385).
  + Misc fixes.
- Update Url tag to https://github.com/fribidi/fribidi: the current
  Fribidi web page.
- Drop enable-malloc configure option: the thread safety problem is
  already fixed and it's not an available configure option anymore.
- Drop fdupes BuildRequires and its macro: it is no longer needed.</changelog>
  <changelog author="jengelh@inai.de" date="1518955200">- Trim redundancies in the description.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 1.0.5:
  + Updated unicode tables to version 11
  + Bugfix release - character tests were not running previously
  + Small speedup due to small arrays being allocated on the stack</changelog>
  <changelog author="zcjia@suse.com" date="1620820800">- Add fribidi-CVE-2019-18397.patch:
  Avoid buffer overflow. (bsc#1156260 CVE-2019-18397)</changelog>
</package>
<package pkgid="67f7ac3de54a501d3688652700ea618a2843418ed4490bcb8c66f3ee480e905f" name="fribidi" arch="ppc64le">
  <version epoch="0" ver="1.0.5" rel="3.3.1"/>
  <changelog author="coolo@novell.com" date="1272628800">- buildrequire pkg-config to fix provides</changelog>
  <changelog author="adam@mizerski.pl" date="1296993600">- update to 0.19.2
  * Update to Unicode Character Database 5.1.0</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="jengelh@inai.de" date="1405771200">- Utilize shared library package naming guidelines
- Drop Requires:pkg-config for fribidi-devel, it is implicit
  (due to .pc file being picked up by rpm find-requires)</changelog>
  <changelog author="ftake@geeko.jp" date="1410350400">- libfribidi-devel requires %{lname} = %{version}</changelog>
  <changelog author="i@marguerite.su" date="1415275200">- update version 0.19.6
  * Fix two minor bidi bugs.
  * Build with new libtool to support ppc64le.
- fix boo#903462: -enable-malloc to be thread safe</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1518868800">- Update to version 1.0.1:
  + Minor distribution related fixes.
- Changes from version 1.0.0:
  + Full isolate and parenthesis support as per Unicode 6.3 to
    Unicode 10.0.
  + To get access to the new algorithm calls to the function
    `fribidi_get_par_embedding_levels()` must be replaced with
    calls to `fribidi_get_par_embedding_levels_ex()`. These
    functions are not API compatible. Calling the older function
    will use default values for the new bracket properties and will
    sometimes yield non-complient results.
- Changes from version 0.19.7:
  + Disable thread-unsafe memory pool by default (fdo#79385).
  + Misc fixes.
- Update Url tag to https://github.com/fribidi/fribidi: the current
  Fribidi web page.
- Drop enable-malloc configure option: the thread safety problem is
  already fixed and it's not an available configure option anymore.
- Drop fdupes BuildRequires and its macro: it is no longer needed.</changelog>
  <changelog author="jengelh@inai.de" date="1518955200">- Trim redundancies in the description.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 1.0.5:
  + Updated unicode tables to version 11
  + Bugfix release - character tests were not running previously
  + Small speedup due to small arrays being allocated on the stack</changelog>
  <changelog author="zcjia@suse.com" date="1620820800">- Add fribidi-CVE-2019-18397.patch:
  Avoid buffer overflow. (bsc#1156260 CVE-2019-18397)</changelog>
</package>
<package pkgid="3ff55d6a4f1269401c99adb8f162b232f8c6b68527c7cd2a9b46f4e93ca9005a" name="fribidi" arch="s390x">
  <version epoch="0" ver="1.0.5" rel="3.3.1"/>
  <changelog author="coolo@novell.com" date="1272628800">- buildrequire pkg-config to fix provides</changelog>
  <changelog author="adam@mizerski.pl" date="1296993600">- update to 0.19.2
  * Update to Unicode Character Database 5.1.0</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="jengelh@inai.de" date="1405771200">- Utilize shared library package naming guidelines
- Drop Requires:pkg-config for fribidi-devel, it is implicit
  (due to .pc file being picked up by rpm find-requires)</changelog>
  <changelog author="ftake@geeko.jp" date="1410350400">- libfribidi-devel requires %{lname} = %{version}</changelog>
  <changelog author="i@marguerite.su" date="1415275200">- update version 0.19.6
  * Fix two minor bidi bugs.
  * Build with new libtool to support ppc64le.
- fix boo#903462: -enable-malloc to be thread safe</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1518868800">- Update to version 1.0.1:
  + Minor distribution related fixes.
- Changes from version 1.0.0:
  + Full isolate and parenthesis support as per Unicode 6.3 to
    Unicode 10.0.
  + To get access to the new algorithm calls to the function
    `fribidi_get_par_embedding_levels()` must be replaced with
    calls to `fribidi_get_par_embedding_levels_ex()`. These
    functions are not API compatible. Calling the older function
    will use default values for the new bracket properties and will
    sometimes yield non-complient results.
- Changes from version 0.19.7:
  + Disable thread-unsafe memory pool by default (fdo#79385).
  + Misc fixes.
- Update Url tag to https://github.com/fribidi/fribidi: the current
  Fribidi web page.
- Drop enable-malloc configure option: the thread safety problem is
  already fixed and it's not an available configure option anymore.
- Drop fdupes BuildRequires and its macro: it is no longer needed.</changelog>
  <changelog author="jengelh@inai.de" date="1518955200">- Trim redundancies in the description.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 1.0.5:
  + Updated unicode tables to version 11
  + Bugfix release - character tests were not running previously
  + Small speedup due to small arrays being allocated on the stack</changelog>
  <changelog author="zcjia@suse.com" date="1620820800">- Add fribidi-CVE-2019-18397.patch:
  Avoid buffer overflow. (bsc#1156260 CVE-2019-18397)</changelog>
</package>
<package pkgid="0fe64c650b6706417cf1e361ffd8717763b54b71ab1623c63556c3efe80a38f6" name="fribidi" arch="src">
  <version epoch="0" ver="1.0.5" rel="3.3.1"/>
  <changelog author="nashif@suse.de" date="1052740800">- package forgotten files</changelog>
  <changelog author="adrian@suse.de" date="1073736000">- add %run_ldconfig</changelog>
  <changelog author="mfabian@suse.de" date="1078833600">- Bugzilla #34267: fix this by adding the compiler option
  "-fno-strict-aliasing".</changelog>
  <changelog author="mls@suse.de" date="1138190400">- converted neededforbuild to BuildRequires</changelog>
  <changelog author="mfabian@suse.de" date="1141128000">- add "Provides: locale(ar,he)".</changelog>
  <changelog author="crrodriguez@suse.de" date="1199620800">- update to version 0.10.9
  * Fixed type sizes when stdint.h is not available.
  * Update to Unicode Character Database 5.0.0
  * Fixed type sizes on 64-bit architectures.
- disable static libraries
- remove libtool archive with empty dependency_libs
- do not require gtk2-devel for build as it is unused
- spec file cleanups</changelog>
  <changelog author="ro@suse.de" date="1207828800">- added baselibs.conf file to build xxbit packages
  for multilib support</changelog>
  <changelog author="olh@suse.de" date="1225368000">- obsolete old -XXbit packages (bnc#437293)</changelog>
  <changelog author="olh@suse.de" date="1228910400">- use Obsoletes: -XXbit only for ppc64 to help solver during distupgrade
  (bnc#437293)</changelog>
  <changelog author="jengelh@medozas.de" date="1261051200">- add baselibs.conf as a source</changelog>
  <changelog author="coolo@novell.com" date="1272628800">- buildrequire pkg-config to fix provides</changelog>
  <changelog author="adam@mizerski.pl" date="1296993600">- update to 0.19.2
  * Update to Unicode Character Database 5.1.0</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="jengelh@inai.de" date="1405771200">- Utilize shared library package naming guidelines
- Drop Requires:pkg-config for fribidi-devel, it is implicit
  (due to .pc file being picked up by rpm find-requires)</changelog>
  <changelog author="ftake@geeko.jp" date="1410350400">- libfribidi-devel requires %{lname} = %{version}</changelog>
  <changelog author="i@marguerite.su" date="1415275200">- update version 0.19.6
  * Fix two minor bidi bugs.
  * Build with new libtool to support ppc64le.
- fix boo#903462: -enable-malloc to be thread safe</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1518868800">- Update to version 1.0.1:
  + Minor distribution related fixes.
- Changes from version 1.0.0:
  + Full isolate and parenthesis support as per Unicode 6.3 to
    Unicode 10.0.
  + To get access to the new algorithm calls to the function
    `fribidi_get_par_embedding_levels()` must be replaced with
    calls to `fribidi_get_par_embedding_levels_ex()`. These
    functions are not API compatible. Calling the older function
    will use default values for the new bracket properties and will
    sometimes yield non-complient results.
- Changes from version 0.19.7:
  + Disable thread-unsafe memory pool by default (fdo#79385).
  + Misc fixes.
- Update Url tag to https://github.com/fribidi/fribidi: the current
  Fribidi web page.
- Drop enable-malloc configure option: the thread safety problem is
  already fixed and it's not an available configure option anymore.
- Drop fdupes BuildRequires and its macro: it is no longer needed.</changelog>
  <changelog author="jengelh@inai.de" date="1518955200">- Trim redundancies in the description.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 1.0.5:
  + Updated unicode tables to version 11
  + Bugfix release - character tests were not running previously
  + Small speedup due to small arrays being allocated on the stack</changelog>
  <changelog author="zcjia@suse.com" date="1620820800">- Add fribidi-CVE-2019-18397.patch:
  Avoid buffer overflow. (bsc#1156260 CVE-2019-18397)</changelog>
</package>
<package pkgid="b3e5f2b3a4b5274615a1c21ea6b61cbc1c1d14bdc3b8496b9f0c0c52d2f9e1bb" name="fribidi" arch="x86_64">
  <version epoch="0" ver="1.0.5" rel="3.3.1"/>
  <changelog author="coolo@novell.com" date="1272628800">- buildrequire pkg-config to fix provides</changelog>
  <changelog author="adam@mizerski.pl" date="1296993600">- update to 0.19.2
  * Update to Unicode Character Database 5.1.0</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="jengelh@inai.de" date="1405771200">- Utilize shared library package naming guidelines
- Drop Requires:pkg-config for fribidi-devel, it is implicit
  (due to .pc file being picked up by rpm find-requires)</changelog>
  <changelog author="ftake@geeko.jp" date="1410350400">- libfribidi-devel requires %{lname} = %{version}</changelog>
  <changelog author="i@marguerite.su" date="1415275200">- update version 0.19.6
  * Fix two minor bidi bugs.
  * Build with new libtool to support ppc64le.
- fix boo#903462: -enable-malloc to be thread safe</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1518868800">- Update to version 1.0.1:
  + Minor distribution related fixes.
- Changes from version 1.0.0:
  + Full isolate and parenthesis support as per Unicode 6.3 to
    Unicode 10.0.
  + To get access to the new algorithm calls to the function
    `fribidi_get_par_embedding_levels()` must be replaced with
    calls to `fribidi_get_par_embedding_levels_ex()`. These
    functions are not API compatible. Calling the older function
    will use default values for the new bracket properties and will
    sometimes yield non-complient results.
- Changes from version 0.19.7:
  + Disable thread-unsafe memory pool by default (fdo#79385).
  + Misc fixes.
- Update Url tag to https://github.com/fribidi/fribidi: the current
  Fribidi web page.
- Drop enable-malloc configure option: the thread safety problem is
  already fixed and it's not an available configure option anymore.
- Drop fdupes BuildRequires and its macro: it is no longer needed.</changelog>
  <changelog author="jengelh@inai.de" date="1518955200">- Trim redundancies in the description.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 1.0.5:
  + Updated unicode tables to version 11
  + Bugfix release - character tests were not running previously
  + Small speedup due to small arrays being allocated on the stack</changelog>
  <changelog author="zcjia@suse.com" date="1620820800">- Add fribidi-CVE-2019-18397.patch:
  Avoid buffer overflow. (bsc#1156260 CVE-2019-18397)</changelog>
</package>
<package pkgid="6ceb236da911c3701f29adf63c5064b69cd06dc9654e1afed8ec0fb0125c7ea9" name="fribidi-devel" arch="aarch64">
  <version epoch="0" ver="1.0.5" rel="3.3.1"/>
  <changelog author="coolo@novell.com" date="1272628800">- buildrequire pkg-config to fix provides</changelog>
  <changelog author="adam@mizerski.pl" date="1296993600">- update to 0.19.2
  * Update to Unicode Character Database 5.1.0</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="jengelh@inai.de" date="1405771200">- Utilize shared library package naming guidelines
- Drop Requires:pkg-config for fribidi-devel, it is implicit
  (due to .pc file being picked up by rpm find-requires)</changelog>
  <changelog author="ftake@geeko.jp" date="1410350400">- libfribidi-devel requires %{lname} = %{version}</changelog>
  <changelog author="i@marguerite.su" date="1415275200">- update version 0.19.6
  * Fix two minor bidi bugs.
  * Build with new libtool to support ppc64le.
- fix boo#903462: -enable-malloc to be thread safe</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1518868800">- Update to version 1.0.1:
  + Minor distribution related fixes.
- Changes from version 1.0.0:
  + Full isolate and parenthesis support as per Unicode 6.3 to
    Unicode 10.0.
  + To get access to the new algorithm calls to the function
    `fribidi_get_par_embedding_levels()` must be replaced with
    calls to `fribidi_get_par_embedding_levels_ex()`. These
    functions are not API compatible. Calling the older function
    will use default values for the new bracket properties and will
    sometimes yield non-complient results.
- Changes from version 0.19.7:
  + Disable thread-unsafe memory pool by default (fdo#79385).
  + Misc fixes.
- Update Url tag to https://github.com/fribidi/fribidi: the current
  Fribidi web page.
- Drop enable-malloc configure option: the thread safety problem is
  already fixed and it's not an available configure option anymore.
- Drop fdupes BuildRequires and its macro: it is no longer needed.</changelog>
  <changelog author="jengelh@inai.de" date="1518955200">- Trim redundancies in the description.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 1.0.5:
  + Updated unicode tables to version 11
  + Bugfix release - character tests were not running previously
  + Small speedup due to small arrays being allocated on the stack</changelog>
  <changelog author="zcjia@suse.com" date="1620820800">- Add fribidi-CVE-2019-18397.patch:
  Avoid buffer overflow. (bsc#1156260 CVE-2019-18397)</changelog>
</package>
<package pkgid="3ad8f6dce775a654546ecf9931ef0a73704dd3d00686ed5c60f31c71807f0c27" name="fribidi-devel" arch="ppc64le">
  <version epoch="0" ver="1.0.5" rel="3.3.1"/>
  <changelog author="coolo@novell.com" date="1272628800">- buildrequire pkg-config to fix provides</changelog>
  <changelog author="adam@mizerski.pl" date="1296993600">- update to 0.19.2
  * Update to Unicode Character Database 5.1.0</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="jengelh@inai.de" date="1405771200">- Utilize shared library package naming guidelines
- Drop Requires:pkg-config for fribidi-devel, it is implicit
  (due to .pc file being picked up by rpm find-requires)</changelog>
  <changelog author="ftake@geeko.jp" date="1410350400">- libfribidi-devel requires %{lname} = %{version}</changelog>
  <changelog author="i@marguerite.su" date="1415275200">- update version 0.19.6
  * Fix two minor bidi bugs.
  * Build with new libtool to support ppc64le.
- fix boo#903462: -enable-malloc to be thread safe</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1518868800">- Update to version 1.0.1:
  + Minor distribution related fixes.
- Changes from version 1.0.0:
  + Full isolate and parenthesis support as per Unicode 6.3 to
    Unicode 10.0.
  + To get access to the new algorithm calls to the function
    `fribidi_get_par_embedding_levels()` must be replaced with
    calls to `fribidi_get_par_embedding_levels_ex()`. These
    functions are not API compatible. Calling the older function
    will use default values for the new bracket properties and will
    sometimes yield non-complient results.
- Changes from version 0.19.7:
  + Disable thread-unsafe memory pool by default (fdo#79385).
  + Misc fixes.
- Update Url tag to https://github.com/fribidi/fribidi: the current
  Fribidi web page.
- Drop enable-malloc configure option: the thread safety problem is
  already fixed and it's not an available configure option anymore.
- Drop fdupes BuildRequires and its macro: it is no longer needed.</changelog>
  <changelog author="jengelh@inai.de" date="1518955200">- Trim redundancies in the description.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 1.0.5:
  + Updated unicode tables to version 11
  + Bugfix release - character tests were not running previously
  + Small speedup due to small arrays being allocated on the stack</changelog>
  <changelog author="zcjia@suse.com" date="1620820800">- Add fribidi-CVE-2019-18397.patch:
  Avoid buffer overflow. (bsc#1156260 CVE-2019-18397)</changelog>
</package>
<package pkgid="d4a92fdff7aa0dfebb951d6ff81590e7c96994964175e491794521cd6b394d4d" name="fribidi-devel" arch="s390x">
  <version epoch="0" ver="1.0.5" rel="3.3.1"/>
  <changelog author="coolo@novell.com" date="1272628800">- buildrequire pkg-config to fix provides</changelog>
  <changelog author="adam@mizerski.pl" date="1296993600">- update to 0.19.2
  * Update to Unicode Character Database 5.1.0</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="jengelh@inai.de" date="1405771200">- Utilize shared library package naming guidelines
- Drop Requires:pkg-config for fribidi-devel, it is implicit
  (due to .pc file being picked up by rpm find-requires)</changelog>
  <changelog author="ftake@geeko.jp" date="1410350400">- libfribidi-devel requires %{lname} = %{version}</changelog>
  <changelog author="i@marguerite.su" date="1415275200">- update version 0.19.6
  * Fix two minor bidi bugs.
  * Build with new libtool to support ppc64le.
- fix boo#903462: -enable-malloc to be thread safe</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1518868800">- Update to version 1.0.1:
  + Minor distribution related fixes.
- Changes from version 1.0.0:
  + Full isolate and parenthesis support as per Unicode 6.3 to
    Unicode 10.0.
  + To get access to the new algorithm calls to the function
    `fribidi_get_par_embedding_levels()` must be replaced with
    calls to `fribidi_get_par_embedding_levels_ex()`. These
    functions are not API compatible. Calling the older function
    will use default values for the new bracket properties and will
    sometimes yield non-complient results.
- Changes from version 0.19.7:
  + Disable thread-unsafe memory pool by default (fdo#79385).
  + Misc fixes.
- Update Url tag to https://github.com/fribidi/fribidi: the current
  Fribidi web page.
- Drop enable-malloc configure option: the thread safety problem is
  already fixed and it's not an available configure option anymore.
- Drop fdupes BuildRequires and its macro: it is no longer needed.</changelog>
  <changelog author="jengelh@inai.de" date="1518955200">- Trim redundancies in the description.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 1.0.5:
  + Updated unicode tables to version 11
  + Bugfix release - character tests were not running previously
  + Small speedup due to small arrays being allocated on the stack</changelog>
  <changelog author="zcjia@suse.com" date="1620820800">- Add fribidi-CVE-2019-18397.patch:
  Avoid buffer overflow. (bsc#1156260 CVE-2019-18397)</changelog>
</package>
<package pkgid="2e1817cd4cd7762c33a308aabb788579bd215a5d437b5d252609c6add551d48b" name="fribidi-devel" arch="x86_64">
  <version epoch="0" ver="1.0.5" rel="3.3.1"/>
  <changelog author="coolo@novell.com" date="1272628800">- buildrequire pkg-config to fix provides</changelog>
  <changelog author="adam@mizerski.pl" date="1296993600">- update to 0.19.2
  * Update to Unicode Character Database 5.1.0</changelog>
  <changelog author="mmeister@suse.com" date="1364299200">- Added url as source.
  Please see http://en.opensuse.org/SourceUrls</changelog>
  <changelog author="jengelh@inai.de" date="1405771200">- Utilize shared library package naming guidelines
- Drop Requires:pkg-config for fribidi-devel, it is implicit
  (due to .pc file being picked up by rpm find-requires)</changelog>
  <changelog author="ftake@geeko.jp" date="1410350400">- libfribidi-devel requires %{lname} = %{version}</changelog>
  <changelog author="i@marguerite.su" date="1415275200">- update version 0.19.6
  * Fix two minor bidi bugs.
  * Build with new libtool to support ppc64le.
- fix boo#903462: -enable-malloc to be thread safe</changelog>
  <changelog author="luc14n0@linuxmail.org" date="1518868800">- Update to version 1.0.1:
  + Minor distribution related fixes.
- Changes from version 1.0.0:
  + Full isolate and parenthesis support as per Unicode 6.3 to
    Unicode 10.0.
  + To get access to the new algorithm calls to the function
    `fribidi_get_par_embedding_levels()` must be replaced with
    calls to `fribidi_get_par_embedding_levels_ex()`. These
    functions are not API compatible. Calling the older function
    will use default values for the new bracket properties and will
    sometimes yield non-complient results.
- Changes from version 0.19.7:
  + Disable thread-unsafe memory pool by default (fdo#79385).
  + Misc fixes.
- Update Url tag to https://github.com/fribidi/fribidi: the current
  Fribidi web page.
- Drop enable-malloc configure option: the thread safety problem is
  already fixed and it's not an available configure option anymore.
- Drop fdupes BuildRequires and its macro: it is no longer needed.</changelog>
  <changelog author="jengelh@inai.de" date="1518955200">- Trim redundancies in the description.</changelog>
  <changelog author="sean@suspend.net" date="1540382400">- Update to version 1.0.5:
  + Updated unicode tables to version 11
  + Bugfix release - character tests were not running previously
  + Small speedup due to small arrays being allocated on the stack</changelog>
  <changelog author="zcjia@suse.com" date="1620820800">- Add fribidi-CVE-2019-18397.patch:
  Avoid buffer overflow. (bsc#1156260 CVE-2019-18397)</changelog>
</package>
<package pkgid="cb39a769d28f2a269fca9e704c975b09f2fe301c448125b874eb71e682b9f261" name="g3utils" arch="aarch64">
  <version epoch="0" ver="1.1.37" rel="3.11.2"/>
  <changelog author="ledest@gmail.com" date="1417089600">- fix bashisms in faxback.sh script
- add patches:
  * mgetty-1.1.36-fix-bashisms.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1422100800">- Add mgetty@.service and vgetty@.service (boo#914661)</changelog>
  <changelog author="mpluskal@suse.com" date="1422446400">- Require systemd-rpm-macros instead of systemd for building</changelog>
  <changelog author="mpluskal@suse.com" date="1456574400">- Use correct permissions for unit files (boo#968571)</changelog>
  <changelog author="kukuk@suse.de" date="1477483200">- Add PreReq for group uucp to sendfax package</changelog>
  <changelog author="tchvatal@suse.com" date="1496664000">- Cleanup a bit with spec-cleaner
- Remove few rpmlint warnings and reduce the deps to contain only
  what is needed
- Add patch to build with gcc7 0001-Fix-build-failure-with-gcc-7.patch
  bsc#1041290</changelog>
  <changelog author="sbrabec@suse.com" date="1496836800">- Update to version 1.1.37:
  * faxspool: implement "-t hh:mm-hh:mm" time-range syntax, add
  @DATE +&lt;format&gt;@ to faxheader processing
  * faxq: properly display queued jobs with time-range field
  * faxrunqd: correctly handle jobs running out of the end of their
  sent-time window.
  INCOMPATIBLE CHANGE: Changes handling of "-t hh:mm" to
  "from hh:mm to midnight"
  * microcom: improve read-from-device exception handling
  * sendfax: send NSF frame on reception,
  new option reset-after-fail
  * faxrunqd: enhance and clarify per-modem statistics
- New build fixes (mgetty-noroot.patch, mgetty-mkdir-p.patch).
- Update patches
  (mgetty-1.1.36-callback.patch -&gt; mgetty-1.1.37-callback.patch,
  mgetty-1.1.36-makefile.patch -&gt; mgetty-1.1.37-makefile.patch).</changelog>
  <changelog author="mcalabkova@suse.com" date="1537531200">- Added patches:
  * mgetty-fix-buffer-overflow.patch - upstream patch, sets maximum
  length of a string to prevent buffer overflow and thus possible
  command injection
  * mgetty-delete-obsolete.patch - upstream-based patch, deletes
  obsolete file contrib/scrts.c, which could cause buffer overflow
- Fixed bugs:
  * bsc#1108756 (CVE-2018-16745): Stack-based buffer overflow in
    fax_notify_mail() in faxrec.c
  * bsc#1108757 (CVE-2018-16744): Command injection in faxrec.c
  * bsc#1108762 (CVE-2018-16742): Stack-based buffer overflow in
    contrib/scrts.c triggered via command line parameter
  * bsc#1108761 (CVE-2018-16743): Stack-based buffer overflow with
    long username in contrib/next-login/login.c</changelog>
  <changelog author="mcalabkova@suse.com" date="1537531201">- Added patch mgetty-fax-block-code-injection.patch to fix
  bsc#1108752 (CVE-2018-16741): command injection in fax/faxq-helper.c</changelog>
  <changelog author="sbrabec@suse.com" date="1564488000">- Prevent crash on invalid PBM with negative dimensions
  (bsc#1142770, CVE-2019-1010190, mgetty-CVE-2019-1010190.patch).</changelog>
  <changelog author="meissner@suse.com" date="1580126400">- Fixed permission handling of faxq-helper. (bsc#1168170)
  - It is fax:trusted       4750 in "secure" mode.
  - Also is being checked and set correctly now.</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link /usr/bin/newslock as PIE (bsc#1184124).
  - Modified fixpie.patch</changelog>
</package>
<package pkgid="36a2678e1c80ba1324f4bc13a11d485acb08bc8a4352b1a25c17456167a13010" name="g3utils" arch="ppc64le">
  <version epoch="0" ver="1.1.37" rel="3.11.2"/>
  <changelog author="ledest@gmail.com" date="1417089600">- fix bashisms in faxback.sh script
- add patches:
  * mgetty-1.1.36-fix-bashisms.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1422100800">- Add mgetty@.service and vgetty@.service (boo#914661)</changelog>
  <changelog author="mpluskal@suse.com" date="1422446400">- Require systemd-rpm-macros instead of systemd for building</changelog>
  <changelog author="mpluskal@suse.com" date="1456574400">- Use correct permissions for unit files (boo#968571)</changelog>
  <changelog author="kukuk@suse.de" date="1477483200">- Add PreReq for group uucp to sendfax package</changelog>
  <changelog author="tchvatal@suse.com" date="1496664000">- Cleanup a bit with spec-cleaner
- Remove few rpmlint warnings and reduce the deps to contain only
  what is needed
- Add patch to build with gcc7 0001-Fix-build-failure-with-gcc-7.patch
  bsc#1041290</changelog>
  <changelog author="sbrabec@suse.com" date="1496836800">- Update to version 1.1.37:
  * faxspool: implement "-t hh:mm-hh:mm" time-range syntax, add
  @DATE +&lt;format&gt;@ to faxheader processing
  * faxq: properly display queued jobs with time-range field
  * faxrunqd: correctly handle jobs running out of the end of their
  sent-time window.
  INCOMPATIBLE CHANGE: Changes handling of "-t hh:mm" to
  "from hh:mm to midnight"
  * microcom: improve read-from-device exception handling
  * sendfax: send NSF frame on reception,
  new option reset-after-fail
  * faxrunqd: enhance and clarify per-modem statistics
- New build fixes (mgetty-noroot.patch, mgetty-mkdir-p.patch).
- Update patches
  (mgetty-1.1.36-callback.patch -&gt; mgetty-1.1.37-callback.patch,
  mgetty-1.1.36-makefile.patch -&gt; mgetty-1.1.37-makefile.patch).</changelog>
  <changelog author="mcalabkova@suse.com" date="1537531200">- Added patches:
  * mgetty-fix-buffer-overflow.patch - upstream patch, sets maximum
  length of a string to prevent buffer overflow and thus possible
  command injection
  * mgetty-delete-obsolete.patch - upstream-based patch, deletes
  obsolete file contrib/scrts.c, which could cause buffer overflow
- Fixed bugs:
  * bsc#1108756 (CVE-2018-16745): Stack-based buffer overflow in
    fax_notify_mail() in faxrec.c
  * bsc#1108757 (CVE-2018-16744): Command injection in faxrec.c
  * bsc#1108762 (CVE-2018-16742): Stack-based buffer overflow in
    contrib/scrts.c triggered via command line parameter
  * bsc#1108761 (CVE-2018-16743): Stack-based buffer overflow with
    long username in contrib/next-login/login.c</changelog>
  <changelog author="mcalabkova@suse.com" date="1537531201">- Added patch mgetty-fax-block-code-injection.patch to fix
  bsc#1108752 (CVE-2018-16741): command injection in fax/faxq-helper.c</changelog>
  <changelog author="sbrabec@suse.com" date="1564488000">- Prevent crash on invalid PBM with negative dimensions
  (bsc#1142770, CVE-2019-1010190, mgetty-CVE-2019-1010190.patch).</changelog>
  <changelog author="meissner@suse.com" date="1580126400">- Fixed permission handling of faxq-helper. (bsc#1168170)
  - It is fax:trusted       4750 in "secure" mode.
  - Also is being checked and set correctly now.</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link /usr/bin/newslock as PIE (bsc#1184124).
  - Modified fixpie.patch</changelog>
</package>
<package pkgid="840378a020bd108c73f9f0348a05058120e51d6aafb79e029a54c6d7ba2bd90b" name="g3utils" arch="s390x">
  <version epoch="0" ver="1.1.37" rel="3.11.2"/>
  <changelog author="ledest@gmail.com" date="1417089600">- fix bashisms in faxback.sh script
- add patches:
  * mgetty-1.1.36-fix-bashisms.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1422100800">- Add mgetty@.service and vgetty@.service (boo#914661)</changelog>
  <changelog author="mpluskal@suse.com" date="1422446400">- Require systemd-rpm-macros instead of systemd for building</changelog>
  <changelog author="mpluskal@suse.com" date="1456574400">- Use correct permissions for unit files (boo#968571)</changelog>
  <changelog author="kukuk@suse.de" date="1477483200">- Add PreReq for group uucp to sendfax package</changelog>
  <changelog author="tchvatal@suse.com" date="1496664000">- Cleanup a bit with spec-cleaner
- Remove few rpmlint warnings and reduce the deps to contain only
  what is needed
- Add patch to build with gcc7 0001-Fix-build-failure-with-gcc-7.patch
  bsc#1041290</changelog>
  <changelog author="sbrabec@suse.com" date="1496836800">- Update to version 1.1.37:
  * faxspool: implement "-t hh:mm-hh:mm" time-range syntax, add
  @DATE +&lt;format&gt;@ to faxheader processing
  * faxq: properly display queued jobs with time-range field
  * faxrunqd: correctly handle jobs running out of the end of their
  sent-time window.
  INCOMPATIBLE CHANGE: Changes handling of "-t hh:mm" to
  "from hh:mm to midnight"
  * microcom: improve read-from-device exception handling
  * sendfax: send NSF frame on reception,
  new option reset-after-fail
  * faxrunqd: enhance and clarify per-modem statistics
- New build fixes (mgetty-noroot.patch, mgetty-mkdir-p.patch).
- Update patches
  (mgetty-1.1.36-callback.patch -&gt; mgetty-1.1.37-callback.patch,
  mgetty-1.1.36-makefile.patch -&gt; mgetty-1.1.37-makefile.patch).</changelog>
  <changelog author="mcalabkova@suse.com" date="1537531200">- Added patches:
  * mgetty-fix-buffer-overflow.patch - upstream patch, sets maximum
  length of a string to prevent buffer overflow and thus possible
  command injection
  * mgetty-delete-obsolete.patch - upstream-based patch, deletes
  obsolete file contrib/scrts.c, which could cause buffer overflow
- Fixed bugs:
  * bsc#1108756 (CVE-2018-16745): Stack-based buffer overflow in
    fax_notify_mail() in faxrec.c
  * bsc#1108757 (CVE-2018-16744): Command injection in faxrec.c
  * bsc#1108762 (CVE-2018-16742): Stack-based buffer overflow in
    contrib/scrts.c triggered via command line parameter
  * bsc#1108761 (CVE-2018-16743): Stack-based buffer overflow with
    long username in contrib/next-login/login.c</changelog>
  <changelog author="mcalabkova@suse.com" date="1537531201">- Added patch mgetty-fax-block-code-injection.patch to fix
  bsc#1108752 (CVE-2018-16741): command injection in fax/faxq-helper.c</changelog>
  <changelog author="sbrabec@suse.com" date="1564488000">- Prevent crash on invalid PBM with negative dimensions
  (bsc#1142770, CVE-2019-1010190, mgetty-CVE-2019-1010190.patch).</changelog>
  <changelog author="meissner@suse.com" date="1580126400">- Fixed permission handling of faxq-helper. (bsc#1168170)
  - It is fax:trusted       4750 in "secure" mode.
  - Also is being checked and set correctly now.</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link /usr/bin/newslock as PIE (bsc#1184124).
  - Modified fixpie.patch</changelog>
</package>
<package pkgid="0bb95bf93382296380971f97da59c7b1d31f2047179db0f273175272bab17eff" name="g3utils" arch="x86_64">
  <version epoch="0" ver="1.1.37" rel="3.11.2"/>
  <changelog author="ledest@gmail.com" date="1417089600">- fix bashisms in faxback.sh script
- add patches:
  * mgetty-1.1.36-fix-bashisms.patch</changelog>
  <changelog author="mpluskal@suse.com" date="1422100800">- Add mgetty@.service and vgetty@.service (boo#914661)</changelog>
  <changelog author="mpluskal@suse.com" date="1422446400">- Require systemd-rpm-macros instead of systemd for building</changelog>
  <changelog author="mpluskal@suse.com" date="1456574400">- Use correct permissions for unit files (boo#968571)</changelog>
  <changelog author="kukuk@suse.de" date="1477483200">- Add PreReq for group uucp to sendfax package</changelog>
  <changelog author="tchvatal@suse.com" date="1496664000">- Cleanup a bit with spec-cleaner
- Remove few rpmlint warnings and reduce the deps to contain only
  what is needed
- Add patch to build with gcc7 0001-Fix-build-failure-with-gcc-7.patch
  bsc#1041290</changelog>
  <changelog author="sbrabec@suse.com" date="1496836800">- Update to version 1.1.37:
  * faxspool: implement "-t hh:mm-hh:mm" time-range syntax, add
  @DATE +&lt;format&gt;@ to faxheader processing
  * faxq: properly display queued jobs with time-range field
  * faxrunqd: correctly handle jobs running out of the end of their
  sent-time window.
  INCOMPATIBLE CHANGE: Changes handling of "-t hh:mm" to
  "from hh:mm to midnight"
  * microcom: improve read-from-device exception handling
  * sendfax: send NSF frame on reception,
  new option reset-after-fail
  * faxrunqd: enhance and clarify per-modem statistics
- New build fixes (mgetty-noroot.patch, mgetty-mkdir-p.patch).
- Update patches
  (mgetty-1.1.36-callback.patch -&gt; mgetty-1.1.37-callback.patch,
  mgetty-1.1.36-makefile.patch -&gt; mgetty-1.1.37-makefile.patch).</changelog>
  <changelog author="mcalabkova@suse.com" date="1537531200">- Added patches:
  * mgetty-fix-buffer-overflow.patch - upstream patch, sets maximum
  length of a string to prevent buffer overflow and thus possible
  command injection
  * mgetty-delete-obsolete.patch - upstream-based patch, deletes
  obsolete file contrib/scrts.c, which could cause buffer overflow
- Fixed bugs:
  * bsc#1108756 (CVE-2018-16745): Stack-based buffer overflow in
    fax_notify_mail() in faxrec.c
  * bsc#1108757 (CVE-2018-16744): Command injection in faxrec.c
  * bsc#1108762 (CVE-2018-16742): Stack-based buffer overflow in
    contrib/scrts.c triggered via command line parameter
  * bsc#1108761 (CVE-2018-16743): Stack-based buffer overflow with
    long username in contrib/next-login/login.c</changelog>
  <changelog author="mcalabkova@suse.com" date="1537531201">- Added patch mgetty-fax-block-code-injection.patch to fix
  bsc#1108752 (CVE-2018-16741): command injection in fax/faxq-helper.c</changelog>
  <changelog author="sbrabec@suse.com" date="1564488000">- Prevent crash on invalid PBM with negative dimensions
  (bsc#1142770, CVE-2019-1010190, mgetty-CVE-2019-1010190.patch).</changelog>
  <changelog author="meissner@suse.com" date="1580126400">- Fixed permission handling of faxq-helper. (bsc#1168170)
  - It is fax:trusted       4750 in "secure" mode.
  - Also is being checked and set correctly now.</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1621944000">- Link /usr/bin/newslock as PIE (bsc#1184124).
  - Modified fixpie.patch</changelog>
</package>
<package pkgid="74bf4a13627a30890ba4d6bfa6d9b8a454a9f439ff50ced6139631add8aaa820" name="gcc-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="039e987bf57266af49c881dbbbc51ffa9af688131867b32f5b42dc2a5d539cc4" name="gcc-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="1b627a689803d2178784d2517e5171e5c99de77e4343c604f6b898f80de7e392" name="gcc-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="9d7cce3bdb456838d5c42f99a12c1b577b07ea325c050298f7482eb228ea82e2" name="gcc-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="ab6abf01d5123dc047029b41501e6afea0539ca4f26d12551fcf7198f1885b12" name="gcc" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="3c1a98e87157baa859a598ae91dbae63cef761ab03760c340731faaf5f37e651" name="gcc" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="5b8f0936edf92b82bab04166c9be1f19595ef13398fe92b590e612a790bde30b" name="gcc" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="828abb29865ecf093a874f6133c7a70b3b1e2c1f795ab3252c4d78789b12e9d6" name="gcc" arch="src">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="49297d3f268d10ecd51abb321ac74e26180f086e4984fcaa793acbdcae555634" name="gcc" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="77a0658ecda6793c689b3dac8c48fcb781dcdc21a1684a4eb792ecd552d13072" name="gcc" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="b240381d207609a8a0f448856a537b051c8d536bb1036709c973e67e7c7d3d96" name="gcc" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="d3c7025be1d3cc883df737d439cdfb71572513c42ab3218510bcbd9d6d295d9a" name="gcc" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="3c5e79822344020c7f66894877dfcc6b5e16abc067a62015bdbc27bbdda2e2bd" name="gcc" arch="src">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="88ca3abb80d633f4f4ba2f07b1c112567ddc67ada62a839b787e7682ee40ce57" name="gcc" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="cb1eb9cda7c7b090b4680bf270c6fbd6a2255561c7be7861a1a9f8cd7e0a8ece" name="gcc-PIE" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="47206f1f3579675dfa3ab537256a8381b640c5f049b735c34f3d142788149264" name="gcc-PIE" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="9ddeda5e46d8df79070119b31f19c78de5f46dad69c0e1174dd162c69d540b1d" name="gcc-PIE" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="fd6ae6e4e86bdd58ea9f4fae3065d0a6fb893cc1a2d61f1cc31302984dbbc811" name="gcc-PIE" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="658ac165f8e029d251b2bc1acfe93bcbe2e0bf612ba72f6ef8c43419466b26aa" name="gcc-PIE" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="cb1173faef95cb3aef4ccf290032b5dc17ba69115ae06510cdc7f49c11001838" name="gcc-PIE" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="ee6a08851607512b3f90529e1b6c6ec80b8fa0fa5c0f406b829626d126e452cb" name="gcc-PIE" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="5e17c203e4773780d03224b4770f3cd63dd76c6db14bead404b66b4b5913eb47" name="gcc-PIE" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="a1ae706a50a53c3b43a6e6dc29d10e18e2e819e50d9710af00370b481f13c3bd" name="gcc-ada-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="05160b1b9a616855b9bf5973491333028a7dbb73c5f25b3789da7a6cccf84c8f" name="gcc-ada-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="213eb7ecb89cc53c2617110d28e353dc3289c1e5b9d03b43d5e90c263e76d020" name="gcc-ada-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="f46c9e2cd84ec8abae78073a7d7cb4df0eb6fb0712f56698ac02a92b3d118f90" name="gcc-ada-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="55b4c970cbb9f17e35f0412a8e548c0c6778d4dd8ff3f95b4c2a90a06e748c8a" name="gcc-ada" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="2078aab863a07e69dd1dc99e4a0dba91257619f7c739c19ccfb9a9d72cf13fe5" name="gcc-ada" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="35989bd58c16b140ac425672dc826dd5b82b2b9f23f6717129e0bfd72f02b555" name="gcc-ada" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="366c2d05f43313707d253192bfead2f644a948573e3d77062e521afb752505bc" name="gcc-ada" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="1639bff87bcae918561f25cdf16f841c62c2269afabe3a3ebe865b4624396aa9" name="gcc-ada" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="48b7730c955ed0ffe7439f3db5d0b0aaf36db058465b283f48569016323eb478" name="gcc-ada" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="bdac9e0d3a6e355cd13ab10c3a5d765466d8353fedb483e391f577a4869b3a79" name="gcc-ada" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="6047c68a5038fb0aab4033e8d242595380e16f1bef0d71dff39ae943a68e6c1e" name="gcc-ada" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="7560c99b7c7602c34358615ce1371f79bbe2003a3a318c9221b5fea2f5bb9e54" name="gcc-c++-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="afdabcccd48ea1a80488136166754354df57616710ceb6f61bda5226d06c1382" name="gcc-c++-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="4db92c8035ab6e9116b8a222a1d458c50b87556bbbffd57cf1a9edef53f1cd23" name="gcc-c++-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="3b67f1e2ea89b3eab0b5f28f0f00c6f41dd4c7a8222c27dc56370ccd55495e87" name="gcc-c++-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="227b156bf4df154b1b9bb59c61dca29657cb51d00bbb9b7c901f82470d525c9c" name="gcc-c++" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="323f6c5615bfe73f3a6e44e0b22ff4a86bb11ed415685581c8e119cd96a3fa5c" name="gcc-c++" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="abe2c3b266c62d61b4cf6a79d46c685b90cbe5c5b8ed31995039dda5602ad967" name="gcc-c++" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="388e414fb2c4ae2bd0d1185d6a0de9d4413f9dcf6d0b2728c81812e40acc92d8" name="gcc-c++" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="6151ba1b5dd5b8298b6ff456922afe70acd2a0cd80e632740821366196da6b47" name="gcc-c++" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="d6bb4c88add0cec704607069d38940d6c8b45b8944dbfae6b3682f7f31a5704d" name="gcc-c++" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="6569fdd8025c09de74d42bc323a98ec8513036c14d167666741874ca777f7be8" name="gcc-c++" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="6ccb15946511163645ba59b79c7ae0011507a8b3654843f4d2c25e9bf2099b38" name="gcc-c++" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="7a6e9ace191049ebbcb25fc8c76359389bd7bfa5d1db333a4acb2211d1d9349d" name="gcc-fortran-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="ae2810945e9c5a807a45b1524a25c60300ef7aa2d0834ab9e6c40f5ab7386135" name="gcc-fortran-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="e82882a070f81002f9339f1c5255840ad3403fca42820f7255fe31725d489d33" name="gcc-fortran-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="2776c213f2db803a8cea8195f3f8f064abf42fbffb99cf1bcbceccee5914ff71" name="gcc-fortran-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="2f8106595ce09126fcd716af4b185a73a898650775b55cc0c10e1582973e82c6" name="gcc-fortran" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="0538c95c6470f10a1f1c6e99cd0a4cde3d913595d9eecbd5df247554492477b4" name="gcc-fortran" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="c687723c81a592073688be423b7e48a6272714e5fee71b3b370b86a632a2f1e2" name="gcc-fortran" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="3cee9e0a515b51c0ca3ba46e6e2dc7c74dac572a4bca60dc5e8152376860c835" name="gcc-fortran" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="3e3ae32d776ce6610e1e150430a26ae35a07d123dbb5ccf6b16c8139481df676" name="gcc-fortran" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="07761c77eaaaae608243b7c4b5a10a35296ec144d52505f85420b111c4567b68" name="gcc-fortran" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="cd50f7475273a5d6609e0d0a86d48ef9eddca2b4a4829572d1e86dd629137a2c" name="gcc-fortran" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="ceceb10aa29cd751c81b0141a32a3f3f386ee0c7eee85998c3593c4b72c576de" name="gcc-fortran" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="32a3c422bb881931665622aeb2fa46aea5126d3c1667e31b3fe8f76472aba45f" name="gcc-go-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="53e3049011147eec1f640814d5c8bb6a1a2262b9b13cc0753676fa3fb8bd47fc" name="gcc-go-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="246067bc8e43eb2f18b01b56a074e60366a610cfb1e59d85ccc6feffc307bf85" name="gcc-go-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="5b5f084536beec8088c6d05321cde91f3b5d8f67827cd01dd8f162232ebc6151" name="gcc-go-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="3623c904db7db4964112d4e1e1f92df3bbbcd9e37afe16aa2b583793dd7e309d" name="gcc-go" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="3d56d873bfe595175cbb3b39687258c95239d7265902a5cbf0f792f4a268c51c" name="gcc-go" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="86630829846a7a001bed3e9e6e7eb1ec9319d69e3a8ea4229333374cd6305462" name="gcc-go" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="adb778533881b3fe7da695bf838a378533168e058e338150489e1918f2517468" name="gcc-go" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="8d9724398c1791cac699f878176c767c7d16701aa9d0c12087dc9aa8e53362df" name="gcc-go" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="5dda8fd6f8072f6b35a70dc2291ddc3c9946999c3f78a0be04e03b2932f38332" name="gcc-go" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="b53ac00c5e86b63cbb8c32307ee5f0381d07aaa6df403d4b41ca339caddd2649" name="gcc-go" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="e186dac25c61f9d5ed34f57a24c1582679920c338dec42e9d2f474c7298446c2" name="gcc-go" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="5fb33ec7924593b29059a25010b1f4b66c0cf31ee06bec78c4d5fcbd9f74f46d" name="gcc-info" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="57a3be126122b5c5991320ea00c2e42061062c9715cb41f49f09ef44debeebac" name="gcc-info" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="8ab200842a424737ebdbb3eadbdda2f32ce29b2d46f6788fda27d7bd7b04f7af" name="gcc-info" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="42c44d011f98c0fd6a4958cafed167c1a4580581ca783294b5898b2920047747" name="gcc-info" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="f6280fe07fc861f1530e1cc16ee8b41950938ca76b97579ce0a53f07dac8d5f9" name="gcc-info" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="fd78f83393f1dc624f170579f5e1f006fc58ce24a2bc422a33d5866a90470673" name="gcc-info" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="15fe654052e7778432b12e97e253e7c6c4314b85f381fddd8b4ba2ae5c691561" name="gcc-info" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="9dde66182c85c68ba995b8ca7596404c32cb347acb61f40ad9cc383ed5d6e4f1" name="gcc-info" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="431e307178132da02a5590d7a40226273424eecd766235cdd74269fdea575524" name="gcc-locale" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="0822c0b5a9b8c3e27dc6c4de385bbae60c801e8a88b7a11fd757eeaed6a9be15" name="gcc-locale" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="c05549c0f5d41ece6edd8cb190a2fd4326e6bac43f6bc70ff3c998f0355a79f3" name="gcc-locale" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="e82b324738a255eadd5499e85da3556cf1aaff17cab1a248267a054e51495920" name="gcc-locale" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="84eae733f86c41f492e9231915ce5b373a69ee50b561db97e11fcf5cc53d92ca" name="gcc-locale" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="6388b6527abb422396506c8ac0c373c5f6e3b0692706aa47618a367e23dd3b38" name="gcc-locale" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="6cf0be38e6b2805d8a5205d815bbac5e08e376b18b3855c9daa2b5ed66f4536d" name="gcc-locale" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="5f79ec6ea618844d277d2ec4eda5bf479864e104a70b3fc9a3c75281251a4df9" name="gcc-locale" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="466d467d98ce794efb1a301fed618c848adace77904520aa1ade40e22a792954" name="gcc-obj-c++" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="b3011acaff5189c03a060e4f0906db42816f7429836f37aea07da9f4b495a94f" name="gcc-obj-c++" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="df6690b3d2de88353c7a4f285ed23cda02947b9577327797e7e2de4eb410f02d" name="gcc-obj-c++" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="4f3b192d97f125361f85508b0bb7ea4bcbbe170243c77fad42a97c0abd8159be" name="gcc-obj-c++" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="56b8163e5b583fc4733399274227de76f3dabdfcc25b946ccdad3bc8d093da3b" name="gcc-obj-c++" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="4b8c851afbceadb2776d377430f130179aa1875e4e545911f950a3e5a3167e56" name="gcc-obj-c++" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="6065e869674cffe90d909bfa687ba5aee1bf9c9fda3b58e2d6f9cf1c1a983106" name="gcc-obj-c++" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="27fd15577972e8179cbd6833f21a0a5fcce5b0fce0b8ee5f5de647bfd77f1837" name="gcc-obj-c++" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="141f09f554847ebbc1132096225c1176c7c853c997cc93dbeacb6246e513c781" name="gcc-objc-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="08b5e417d5e5d342f48e9894082f723e2c95055265348e3debbfd065524b4666" name="gcc-objc-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="e8591fe1f9b87479c8996031e5fc40c6a8ce85df987eafd8f09cc1e7ac8c06bb" name="gcc-objc-32bit" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="893c0fdef0019b2f158c67082b593f9c01f35d0793b63dfe3934852f06b308bb" name="gcc-objc-32bit" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="eca4869db447dc9250b08daa87a4591877f4d1a7eea31389115babb21acf5ee8" name="gcc-objc" arch="aarch64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="883f70e20b2674d3e66f8e6beab34dc777dcd44aeaaf6ed5f04773c939de15e9" name="gcc-objc" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="d6784a0e8884721fd3b8d9ebb8a13b1bff51fe0c735fd0813f2edd4c21163be7" name="gcc-objc" arch="s390x">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="88e29b787244ab598f1e076f103b98b4cc04979dd1565316fcba5e5bfdd7cb5a" name="gcc-objc" arch="x86_64">
  <version epoch="0" ver="7" rel="3.6.1"/>
  <changelog author="meissner@suse.com" date="1423051200">- add a gcc-PIE subpackage, which enables building PIE binaries
  by default using the defaults.spec file. bsc#912298</changelog>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
</package>
<package pkgid="66633930b180231a100cabe29b2b343251dd40ccb6ec402e2ba9291e83b3f9c9" name="gcc-objc" arch="aarch64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="7d217bc3310174d0ad9c428c37e3c94b9f19a51e212e3c4f78f2b72c15679e54" name="gcc-objc" arch="ppc64le">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="3602f1d4f94703b21536ae9c7863484c358f26e4125ccbcc4153548ccaf12d5d" name="gcc-objc" arch="s390x">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="0790d79b687199fd180833c607751bc9b7932f88c68ad41c2753fa25425e47f8" name="gcc-objc" arch="x86_64">
  <version epoch="0" ver="7" rel="3.9.1"/>
  <changelog author="rguenther@suse.com" date="1424865600">- Add gcc-ada-32bit and gcc-ada-64bit packages.</changelog>
  <changelog author="schwab@suse.de" date="1425297600">- Add gcc-ada-32bit and gcc-ada-64bit packages only if building Ada</changelog>
  <changelog author="rguenther@suse.com" date="1429531200">- Switch gcc to default 5.
- Add gcc-go{,-32bit,-64bit} packages.</changelog>
  <changelog author="rguenther@suse.com" date="1431086400">- Adjust for GCC 5 package renames.</changelog>
  <changelog author="rguenther@suse.com" date="1432036800">- Fix bogus requires to gcc5-c++-{32,64}bit.</changelog>
  <changelog author="rguenther@suse.com" date="1432209600">- Properly query gcc-%gcc_suffix for paths.</changelog>
  <changelog author="rguenther@suse.com" date="1460635200">- Enable Ada for ppc64le and aarch64.</changelog>
  <changelog author="rguenther@suse.com" date="1461758400">- Switch gcc to default 6.</changelog>
  <changelog author="rguenther@suse.com" date="1471521600">- Add gcc-devel package.</changelog>
  <changelog author="rguenther@suse.com" date="1485172800">- Remove java related packages, those are in a separate gcc-java now.</changelog>
  <changelog author="rguenther@suse.com" date="1486728000">- Enable Ada for s390x.</changelog>
  <changelog author="rguenther@suse.com" date="1490270400">- Switch gcc to default 7.
- Remove unrelated README.packaging.</changelog>
  <changelog author="rguenther@suse.com" date="1491307200">- Fix dependencies of libstdc++-devel-{32,64}-bit.</changelog>
  <changelog author="rguenther@suse.com" date="1492084800">- Remove README in empty packages only required for SLE11 and older.
- Remove now empty %build section.</changelog>
  <changelog author="mliska@suse.cz" date="1496750400">- Include gcov-tool and gcov-dump binaries.</changelog>
  <changelog author="rguenther@suse.com" date="1496836800">- Guard gcc-devel so it is only built on Tumbleweed.
- Remove bogus link to versioned g++.info file which doesn't exist.
  Instead refer to gcc.info from the g++ info directory entry.
  [bnc#922419]</changelog>
  <changelog author="rguenther@suse.com" date="1497009600">- Fix gcc-devel guard to use %sle_version.  [bnc#1043590]</changelog>
  <changelog author="rguenther@suse.com" date="1528200000">- Fix gcc-PIE spec to properly honor -no-pie at link time.
  [bnc#1096008]</changelog>
  <changelog author="rguenther@suse.com" date="1528891200">- Add gccgo symlink, add go and gofmt as alternatives to support
  parallel install of golang.  [bnc#1096677]</changelog>
  <changelog author="rguenther@suse.com" date="1625832000">- With gcc-PIE add -pie even when -fPIC is specified but we are
  not linking a shared library.  [boo#1185348]
- Fix postun of gcc-go alternative.</changelog>
</package>
<package pkgid="486e1301e7bdc13981df2642d6a434efa1a94ea76de2abc4a2e3b23e6749bc5d" name="gcc10" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="c2e4f3f5b1cbd83d0ea174489ec0ec942646bd847531b6f842339182af3f6c38" name="gcc10" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="0f1b766eab27f64c9a4a4f45dca7648997383c5758ffcd6a17571aca986ae908" name="gcc10" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="9c0a365dee771a6304735fe70c859f919fe2eed315b91648aaab626eb190f14d" name="gcc10" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="24e4056c1eaa7077fd6796925b2fbbffa0c68426f7ad114a24db7952b3764fbd" name="gcc10" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="cff99fe15513011ae142cab6fe1799588bd51c9f0851cfe27fbb4686e2a402a4" name="gcc10-32bit" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="4e1d8a70b0405fedf30ae8dcb6fcc45adc02709aeb1925c2d2ada1b19b9452b2" name="gcc10-32bit" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="35ba526d754568f2eb9d3163817a4a1098ea3db2f70c25ed9d5af1f78ca7bc07" name="gcc10-ada" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="3c64ac4d7462ee71ff43082f29936dcec39ab3dc9c683a61669fc8289af7af20" name="gcc10-ada" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="e2c0e86c8439500d64da37a12d572d283f69b5592366a2aad102a9bee1dc284f" name="gcc10-ada" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="be5d332ae025bb1b94a65683b53f10b51951bafb5c17f5e0024d02c0e8d9e39f" name="gcc10-ada" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="9c597f72375652799db418c101abebf35adc808593aa50c9984345de2a9e34e9" name="gcc10-ada-32bit" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="6c04c2dc5508e30df765637de13f3c272a1020c9cb051a921683105d59ef8100" name="gcc10-ada-32bit" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f80326a8e8d42a79ffebd210115d9f98fe0d7187e5ec091115eb64228cdf305c" name="gcc10-c++" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f12f91b2e4754c4a4069638ffe12471f9fb2de1445e8ac591c96384ce3169b11" name="gcc10-c++" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="657283efa4a05e344af9c4036862c9d28dda9f7266190ac6b3e8b77144a87356" name="gcc10-c++" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="c76bdbb1717851f0939cbfa8508e4b2dbf4054646dfcc2e2b27350a8897991ec" name="gcc10-c++" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="c33a594a9a116b0407ad13a7663503f089a85030b29ba2cb05d3643de1f9b9b7" name="gcc10-c++-32bit" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="e42e59f5212c4b9346bb6b79011de0a3f1ee2632772f9e948cb8ec605b6fa290" name="gcc10-c++-32bit" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f9c7617e5753393a415a313db4551fed41316872e727efdc8cef0a14bf214b3f" name="gcc10-d" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="0e7b249e063a0763940fe120fd02e2e1bc9520b9d502522c4ed6b0526174f9c3" name="gcc10-d" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="15901668b5c1b4436f394328b919504c5e17893ab49d9ef48506f0de18b3392f" name="gcc10-d" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="9c8fa94cc9a58d7fb851e977b9386b37374cef3b5988859a076ccfe45c947874" name="gcc10-d-32bit" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="ea3f33e1e0fa1bbace28943b7e25c409cfe649a66e942b987ed785a1fd43c233" name="gcc10-d-32bit" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="1319b8739e41f40d006a6185ffccaaffce75321e45ae8977e6340206925b3b2d" name="gcc10-fortran" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="b6d13327f6d2cabbea1219919c977ee1b21925d913bc5144fb52334daa883643" name="gcc10-fortran" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="15948baac57504ef4ed0b15fe77e9e0b2e938f73ce3228e63e1d235cd20f04a3" name="gcc10-fortran" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="4f32e7cb55406cc91336f697343bae4e593b92bcf03894bcea0086585f993712" name="gcc10-fortran" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="0403d13a1de3858063cb36253378b00bb20b79694dad0c3bfff34bdf1f9aef08" name="gcc10-fortran-32bit" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="a6359da7a009544cb863f51689837f887220a7438d248af1a0e1cb91a13b2cb8" name="gcc10-fortran-32bit" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="9ccc4036a4fdb7b9f7953a11bb957cde51e12888086256b9d90df711dd67f2ed" name="gcc10-go" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="684100c63d6cebfcfb4dff8a5691b890bff5bb631a915a972f8c45118e57c064" name="gcc10-go" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="7fcf4e04f5ec573faaceaf11d17627879a6d3222ba5e8abade29bd486f451a1e" name="gcc10-go" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="6443807d22d8d6fa0ca97b199154c872794a285f30737408be30f89666ff4812" name="gcc10-go" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="58d2013bf5b77ecb1d5d7edb0c56b892a793ee121eabdbfc859c5b2d16d3fbd3" name="gcc10-go-32bit" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="6f9f7e7f6e8fda5e35de60873d6ea9042a49ff8886f5d8614a84991c3bdb343c" name="gcc10-go-32bit" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="8c7e29584d29c4278fdd5d565902e077da12faea028db02fce43e8012af4e5d0" name="gcc10-info" arch="noarch">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="02970939bbfa645d473a80c57c1414bbf43a6d23955a4b3f0d3a82b49c237576" name="gcc10-locale" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="0498e335bcec76a1c89ce6326a91f60ae4c6030ce8db14f7056acbcd67ea437d" name="gcc10-locale" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="90fa54b5896df925ee3a2e5783e3b7735db29e0c1376e163201ff832f5b5da8c" name="gcc10-locale" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="9c2332331344a29060b7bf72ee08c2704704df0648e0516e80a37b2044c82bb5" name="gcc10-locale" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="ca00b07847d044da9c4fe63a3884cfa290f2e26f53482d280f341c0132ef6e46" name="gcc10-obj-c++" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="fa1a72e6650311783a50fcb9e48d99039442649987a5008e47479bf7add7d028" name="gcc10-obj-c++" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="e7429e0f344f1cdcf1f8846a202155880e42d15d04a533df65a905c9276d0fce" name="gcc10-obj-c++" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="883dcffdce8461cfbe471ae96eba43db0ca5e59ebef45e44a38f77d1ee2ff52c" name="gcc10-obj-c++" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="bb14c0943a394cb0f417a31f8e936f15f40954044cddda76b1c0d1c6cf302d40" name="gcc10-obj-c++-32bit" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="38b56755ff1325ad3ea3d47de0586d132215a3d1c92c49ad7a134ae082e16bde" name="gcc10-obj-c++-32bit" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="30ae395b121eba08d59fa948131c80faec88be26567d4c125dfc13867f608fa3" name="gcc10-objc" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="78563ead062133a484798674fd041b0e052001e6e282c9fefdc4650625e6cacc" name="gcc10-objc" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="2e3b83935f9ca9c75f7b4de1897db2d1f0eae867a5c19ce9c546ed704f123f87" name="gcc10-objc" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="45341985fa19a90808a78406d0d93eae2351d37d197188d86587c4d83c977ddb" name="gcc10-objc" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="0a200dd391c47885f6c701b7cabdff709f4424753e1d7570cbd07e7d2eca119e" name="gcc10-objc-32bit" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="88029da9d3d229e3a9de70e017fc2deca4d0715f5fe9294cae44749cb769aa70" name="gcc10-objc-32bit" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.4"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="7d4c56cdf650c2a5d437294014d6119dd320f776996c19960402874cd8a4d7f5" name="gcc10-testresults" arch="aarch64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.7"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="bccb90a53c546e3a037e74ed8baed5953456afe32ffdb46bedf50578f1e0fe56" name="gcc10-testresults" arch="ppc64le">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.7"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="f831467266ff071211f1bb03052487a99cd436194a5454869da627d2074b4037" name="gcc10-testresults" arch="s390x">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.7"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="4573c33b1167502e608d71da941baabf9318d355486068e057b6b7b8d380ef64" name="gcc10-testresults" arch="src">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.7"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="cb5ba9154832310f48f8ec2d5ae4fead6faa8e69f22387ef9854a2fe6a0fcd68" name="gcc10-testresults" arch="x86_64">
  <version epoch="0" ver="10.3.0+git1587" rel="1.6.7"/>
  <changelog author="guillaume.gardet@opensuse.org" date="1593777600">- Enable nvptx support for aarch64</changelog>
  <changelog author="rguenther@suse.com" date="1594123200">- Update to gcc-10 branch head (12e1a54b06777db74ce375496), git355.
  * Includes fix for non-reproducible builds with LTO [bsc#1172846].</changelog>
  <changelog author="rguenther@suse.com" date="1595937600">- Update to gcc-10 branch head (c0438ced53bcf57e4ebb1c38c), git465.
  * Includes GCC 10.2 release.  [bsc#1173972] [jsc#ECO-2373]
  * Picks up fixes for C++20 coroutines support.  [jsc#SLE-12297]
  * Picks up fix for a recent chromium build fail.
- Build x86 CET enabled runtime for Factory.
- Disable GCN offloading for SLE12 and SLE15 GA.</changelog>
  <changelog author="rguenther@suse.com" date="1596628800">- Update to gcc-10 branch head (dda1e9d08434def88ed86557d0), git501.
  * Includes fix for AARCH64 kernel build failure.  [bsc#1174817]
  * Includes aarch64 SLS mitigation changes.  [bsc#1172798, CVE-2020-13844]
- Add gcc10-streamer-backports1.patch and gcc10-streamer-backports2.patch.
- Enable x86 CET runtime for SLES15 and Leap15 also.
- Do not enable the now deprecated HSA offloading capability.</changelog>
  <changelog author="rguenther@suse.com" date="1598270400">- Update to gcc-10 branch head (d523b5201cce1796717a8ca669), git580.
  * Includes gcc10-streamer-backports1.patch and
    gcc10-streamer-backports2.patch.
  * Includes fixes for LTO ICE [bsc#1175168] and aarc64 128bit
    CAS miscompilation [bsc#1174753].</changelog>
  <changelog author="rguenther@suse.com" date="1598356800">- Update to gcc-10 branch head (c0746a1beb1ba073c7981eb09f), git583.
  * Fixes ABI breakage for as-base CDTORs of final classes.  [gcc#95428]</changelog>
  <changelog author="matthewtrescott@gmail.com" date="1603800000">- Build complete set of multilibs for arm-none target [bsc#1106014]
  * Fixes inadvertant mixture of ARM and Thumb instructions in linker output</changelog>
  <changelog author="rguenther@suse.com" date="1603886400">- Update to gcc-10 branch head (a78cd759754c92cecbf235ac9b), git872.</changelog>
  <changelog author="lnussel@suse.de" date="1603972800">- prepare usrmerge: Install libgcc_s into %_libdir. ABI wise it
  stays /%lib. (boo#1029961)</changelog>
  <changelog author="rguenther@suse.com" date="1605096000">- Fix 32bit libgnat.so link.  [bsc#1178675]</changelog>
  <changelog author="rguenther@suse.com" date="1605614400">- Update to gcc-10 branch head (98ba03ffe0b9f37b4916ce6238), git958.
  * Includes fix for memcpy miscompilation on aarch64.
    [bsc#1178624, bsc#1178577]</changelog>
  <changelog author="rguenther@suse.com" date="1605787200">- Add gcc10-amdgcn-llvm-as.patch to fix build of amdgcn offload
  compiler with llvm11.</changelog>
  <changelog author="rguenther@suse.com" date="1606392000">- Enable fortran for offload compilers.</changelog>
  <changelog author="rguenther@suse.com" date="1606478400">- Do not specify alternate offload compiler location at
  configure time.
- Update README.First-for.SuSE.packagers
- Install offload compilers for gcc10-testresults build</changelog>
  <changelog author="rguenther@suse.com" date="1606910400">- Update to gcc-10 branch head (e563687cf9d3d1278f45aaebd), git1030
  * Includes fix for firefox build [gcc#97918]</changelog>
  <changelog author="rguenther@suse.com" date="1612353600">- Remove include-fixed/pthread.h
- Change GCC exception licenses to SPDX format</changelog>
  <changelog author="rguenther@suse.com" date="1614772800">- Update to gcc-10 branch head (85977f624a34eac309f9d77a5), git1331
  * Includes fix for [bsc#1182016]
- The 32bit nvptx libgomp plugin is no longer built, do not attempt
  to package it.</changelog>
  <changelog author="rguenther@suse.com" date="1616587200">- Update to gcc-10 branch head (592388d4f6e8a6adb470428fe), git1450</changelog>
  <changelog author="rguenther@suse.com" date="1617278400">- Update to gcc-10 branch head (892024d4af83b258801ff7484), git1574
  * Includes GCC 10.3 RC1</changelog>
  <changelog author="rguenther@suse.com" date="1618488000">- Update to GCC 10.3.0 release (63fa67847628e5f358e7e2e7e), git1587
- Disable nvptx offloading for aarch64 again since it doesn't work</changelog>
</package>
<package pkgid="b590fe50200623a6a7e33f8befe457489a12b04b76861ebae903194ce2e212ae" name="gd" arch="aarch64">
  <version epoch="0" ver="2.2.5" rel="11.3.1"/>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1431432000">- Added patch gd-libvpx.patch to enable build against libvpx &gt;= 1.4,
  new VPX_ prefixed namespaces are available since libvpx = 0.9.1.</changelog>
  <changelog author="pgajdos@suse.com" date="1456833600">- add missing config/getver.pl [bsc#965190]</changelog>
  <changelog author="pgajdos@suse.com" date="1464609600">- security update:
  * CVE-2016-5116 [bsc#982176]
    + gd-CVE-2016-5116.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1471953600">- security update:
  * CVE-2016-6132 [bsc#987577]
    + gd-CVE-2016-6132.patch
  * CVE-2016-6214 [bsc#991436]
    + gd-CVE-2016-6214.patch
  * CVE-2016-6905 [bsc#995034]
    + gd-CVE-2016-6905.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1475150400">- Add gd-disable-freetype27-failed-tests.patch: Disable for now
  tests failing against freetype &gt;= 2.7 for being too exact
  (gh#libgd/libgd#302). The failures have been understood by
  upstream to be due to minor differences between test images and
  those generated when freeetype &gt;= 2.7 is used to build gd.</changelog>
  <changelog author="badshah400@gmail.com" date="1475236800">- Update to version 2.2.3:
  + Security fixes:
  - Php bug#72339, Integer Overflow in _gd2GetHeader
    (CVE-2016-5766)
  - Issue gh/libgd/libgd#247: A read out-of-bands was found in
    the parsing of TGA files (CVE-2016-6132)
  - Issue gh/libgd/libgd#247: Buffer over-read issue when
    parsing crafted TGA file (CVE-2016-6214)
  - Issue gh/libgd/libgd#248: fix Out-Of-Bounds Read in
    read_image_tga
  - Integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  - Fix php bug#72494, invalid color index not handled, can lead
    to crash (CVE-2016-6128)
  + Improve color check for CropThreshold
  + gdImageCopyResampled has been improved. Better handling of
    images with alpha channel, also brings libgd in sync with
    php's bundled gd.
- Drop patches:
  + gd-CVE-2016-5116.patch: upstreamed
  + gd-CVE-2016-6132.patch: upstreamed
  + gd-CVE-2016-6214.patch: upstreamed
  + gd-CVE-2016-6905.patch: upstreamed
  + gd-libvpx.patch: vpx support dropped.
- Add BuildRequires for automake and autoconf since
  gd-disable-freetype27-failed-tests.patch touches makefiles.
- Drop getver.pl from source: included in upstream tarball.
- Add "-msse -mfpmath=sse" to CFLAGS to fix tests on ix86
  architectures.
- Add "-ffp-contract=off" to CFLAGS for non-ix86 arch (ppc, arm)
  to fix a test: see gh#libgd/libgd#278.
- Add gd-test-unintialized-var.patch to fix an uninitialised
  variable in tests/gd2/gd2_read.c to prevent it from compiling
  with -Werror (only causes problems in no ix86 arch
  surprisingly); patch sent upstream.
- Rebase gd-disable-freetype27-failed-tests.patch for updated
  version.
- Update URL and Source to project's new github URL's.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198400">- Honour %optflags correctly.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198401">- Support webp format, BuildRequires libwebp-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1481284800">- devel package also require libwebp-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Version update to 2.2.4:
  * gdImageCreate() doesn't check for oversized images and as such is prone
    to DoS vulnerabilities. (CVE-2016-9317) bsc#1022283
  * double-free in gdImageWebPtr() (CVE-2016-6912) bsc#1022284
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
    bsc#1022263
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    bsc#1022264
  * Signed Integer Overflow gd_io.c (CVE-2016-10168) bsc#1022265
- Remove patches merged/obsoleted by upstream:
  * gd-config.patch
  * gd-disable-freetype27-failed-tests.patch
  * gd-test-unintialized-var.patch
- Add patch gd-freetype.patch taking patch from upstream for
  freetype 2.7</changelog>
  <changelog author="tchvatal@suse.com" date="1500638400">- Add patch gd-rounding.patch
- Set again the cflags so other archs do not fail testsuite</changelog>
  <changelog author="lnussel@suse.de" date="1502798400">- Don't fail gdimagegrayscale/basic on SLE15 (boo#1053825)</changelog>
  <changelog author="pgajdos@suse.com" date="1504612800">- Version update to 2.2.5:
  [#]## Security
  - Double-free in gdImagePngPtr(). (CVE-2017-6362)
  - Buffer over-read into uninitialized memory. (CVE-2017-7890)
  [#]## Fixed
  - Fix #109: XBM reading fails with printed error
  - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable
  - Fix #357: 2.2.4: Segfault in test suite
  - Fix #386: gdImageGrayScale() may produce colors
  - Fix #406: webpng -i removes the transparent color
  - Fix Coverity #155475: Failure to restore alphaBlendingFlag
  - Fix Coverity #155476: potential resource leak
  - Fix several build issues and test failures
  - Fix and reenable optimized support for reading 1 bps TIFFs
  [#]## Added
  - The native MSVC buildchain now supports libtiff and most executables
- removed patches (upstreamed):
  . gd-freetype.patch
  . gd-rounding.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1516622400">- security update:
  * CVE-2018-5711 [bsc#1076391]
    + gd-CVE-2018-5711.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1535371200">- security update:
  * CVE-2018-1000222 [bsc#1105434]
    + gd-CVE-2018-1000222.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548936000">- security update
  * CVE-2019-6978 [bsc#1123522]
    + gd-CVE-2019-6978.patch
  * CVE-2019-6977 [bsc#1123361]
    + gd-CVE-2019-6977.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- change order while installing splitted library [bsc#1136574]</changelog>
  <changelog author="pgajdos@suse.com" date="1563278400">- security update
- added patches
  CVE-2019-11038 [bsc#1140120]
  + gd-CVE-2019-11038.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1583323200">- security update
- added patches
  fix CVE-2018-14553 [bsc#1165471], null pointer dereference in gdImageClone()
  + gd-CVE-2018-14553.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631620800">- security update
- added patches
  fix CVE-2021-40812 [bsc#1190400], out-of-bounds read in GD library
  + gd-CVE-2021-40812.patch</changelog>
</package>
<package pkgid="74a9a9ff16eab1cfc7e8dcd2bb06fac3f46134cb266fc9eac25c2a186d0229e6" name="gd" arch="ppc64le">
  <version epoch="0" ver="2.2.5" rel="11.3.1"/>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1431432000">- Added patch gd-libvpx.patch to enable build against libvpx &gt;= 1.4,
  new VPX_ prefixed namespaces are available since libvpx = 0.9.1.</changelog>
  <changelog author="pgajdos@suse.com" date="1456833600">- add missing config/getver.pl [bsc#965190]</changelog>
  <changelog author="pgajdos@suse.com" date="1464609600">- security update:
  * CVE-2016-5116 [bsc#982176]
    + gd-CVE-2016-5116.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1471953600">- security update:
  * CVE-2016-6132 [bsc#987577]
    + gd-CVE-2016-6132.patch
  * CVE-2016-6214 [bsc#991436]
    + gd-CVE-2016-6214.patch
  * CVE-2016-6905 [bsc#995034]
    + gd-CVE-2016-6905.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1475150400">- Add gd-disable-freetype27-failed-tests.patch: Disable for now
  tests failing against freetype &gt;= 2.7 for being too exact
  (gh#libgd/libgd#302). The failures have been understood by
  upstream to be due to minor differences between test images and
  those generated when freeetype &gt;= 2.7 is used to build gd.</changelog>
  <changelog author="badshah400@gmail.com" date="1475236800">- Update to version 2.2.3:
  + Security fixes:
  - Php bug#72339, Integer Overflow in _gd2GetHeader
    (CVE-2016-5766)
  - Issue gh/libgd/libgd#247: A read out-of-bands was found in
    the parsing of TGA files (CVE-2016-6132)
  - Issue gh/libgd/libgd#247: Buffer over-read issue when
    parsing crafted TGA file (CVE-2016-6214)
  - Issue gh/libgd/libgd#248: fix Out-Of-Bounds Read in
    read_image_tga
  - Integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  - Fix php bug#72494, invalid color index not handled, can lead
    to crash (CVE-2016-6128)
  + Improve color check for CropThreshold
  + gdImageCopyResampled has been improved. Better handling of
    images with alpha channel, also brings libgd in sync with
    php's bundled gd.
- Drop patches:
  + gd-CVE-2016-5116.patch: upstreamed
  + gd-CVE-2016-6132.patch: upstreamed
  + gd-CVE-2016-6214.patch: upstreamed
  + gd-CVE-2016-6905.patch: upstreamed
  + gd-libvpx.patch: vpx support dropped.
- Add BuildRequires for automake and autoconf since
  gd-disable-freetype27-failed-tests.patch touches makefiles.
- Drop getver.pl from source: included in upstream tarball.
- Add "-msse -mfpmath=sse" to CFLAGS to fix tests on ix86
  architectures.
- Add "-ffp-contract=off" to CFLAGS for non-ix86 arch (ppc, arm)
  to fix a test: see gh#libgd/libgd#278.
- Add gd-test-unintialized-var.patch to fix an uninitialised
  variable in tests/gd2/gd2_read.c to prevent it from compiling
  with -Werror (only causes problems in no ix86 arch
  surprisingly); patch sent upstream.
- Rebase gd-disable-freetype27-failed-tests.patch for updated
  version.
- Update URL and Source to project's new github URL's.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198400">- Honour %optflags correctly.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198401">- Support webp format, BuildRequires libwebp-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1481284800">- devel package also require libwebp-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Version update to 2.2.4:
  * gdImageCreate() doesn't check for oversized images and as such is prone
    to DoS vulnerabilities. (CVE-2016-9317) bsc#1022283
  * double-free in gdImageWebPtr() (CVE-2016-6912) bsc#1022284
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
    bsc#1022263
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    bsc#1022264
  * Signed Integer Overflow gd_io.c (CVE-2016-10168) bsc#1022265
- Remove patches merged/obsoleted by upstream:
  * gd-config.patch
  * gd-disable-freetype27-failed-tests.patch
  * gd-test-unintialized-var.patch
- Add patch gd-freetype.patch taking patch from upstream for
  freetype 2.7</changelog>
  <changelog author="tchvatal@suse.com" date="1500638400">- Add patch gd-rounding.patch
- Set again the cflags so other archs do not fail testsuite</changelog>
  <changelog author="lnussel@suse.de" date="1502798400">- Don't fail gdimagegrayscale/basic on SLE15 (boo#1053825)</changelog>
  <changelog author="pgajdos@suse.com" date="1504612800">- Version update to 2.2.5:
  [#]## Security
  - Double-free in gdImagePngPtr(). (CVE-2017-6362)
  - Buffer over-read into uninitialized memory. (CVE-2017-7890)
  [#]## Fixed
  - Fix #109: XBM reading fails with printed error
  - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable
  - Fix #357: 2.2.4: Segfault in test suite
  - Fix #386: gdImageGrayScale() may produce colors
  - Fix #406: webpng -i removes the transparent color
  - Fix Coverity #155475: Failure to restore alphaBlendingFlag
  - Fix Coverity #155476: potential resource leak
  - Fix several build issues and test failures
  - Fix and reenable optimized support for reading 1 bps TIFFs
  [#]## Added
  - The native MSVC buildchain now supports libtiff and most executables
- removed patches (upstreamed):
  . gd-freetype.patch
  . gd-rounding.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1516622400">- security update:
  * CVE-2018-5711 [bsc#1076391]
    + gd-CVE-2018-5711.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1535371200">- security update:
  * CVE-2018-1000222 [bsc#1105434]
    + gd-CVE-2018-1000222.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548936000">- security update
  * CVE-2019-6978 [bsc#1123522]
    + gd-CVE-2019-6978.patch
  * CVE-2019-6977 [bsc#1123361]
    + gd-CVE-2019-6977.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- change order while installing splitted library [bsc#1136574]</changelog>
  <changelog author="pgajdos@suse.com" date="1563278400">- security update
- added patches
  CVE-2019-11038 [bsc#1140120]
  + gd-CVE-2019-11038.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1583323200">- security update
- added patches
  fix CVE-2018-14553 [bsc#1165471], null pointer dereference in gdImageClone()
  + gd-CVE-2018-14553.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631620800">- security update
- added patches
  fix CVE-2021-40812 [bsc#1190400], out-of-bounds read in GD library
  + gd-CVE-2021-40812.patch</changelog>
</package>
<package pkgid="f66acb5003aff5f07a4a8688789bf86dd031cca44f3396d98833ff8fe8c5062f" name="gd" arch="s390x">
  <version epoch="0" ver="2.2.5" rel="11.3.1"/>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1431432000">- Added patch gd-libvpx.patch to enable build against libvpx &gt;= 1.4,
  new VPX_ prefixed namespaces are available since libvpx = 0.9.1.</changelog>
  <changelog author="pgajdos@suse.com" date="1456833600">- add missing config/getver.pl [bsc#965190]</changelog>
  <changelog author="pgajdos@suse.com" date="1464609600">- security update:
  * CVE-2016-5116 [bsc#982176]
    + gd-CVE-2016-5116.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1471953600">- security update:
  * CVE-2016-6132 [bsc#987577]
    + gd-CVE-2016-6132.patch
  * CVE-2016-6214 [bsc#991436]
    + gd-CVE-2016-6214.patch
  * CVE-2016-6905 [bsc#995034]
    + gd-CVE-2016-6905.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1475150400">- Add gd-disable-freetype27-failed-tests.patch: Disable for now
  tests failing against freetype &gt;= 2.7 for being too exact
  (gh#libgd/libgd#302). The failures have been understood by
  upstream to be due to minor differences between test images and
  those generated when freeetype &gt;= 2.7 is used to build gd.</changelog>
  <changelog author="badshah400@gmail.com" date="1475236800">- Update to version 2.2.3:
  + Security fixes:
  - Php bug#72339, Integer Overflow in _gd2GetHeader
    (CVE-2016-5766)
  - Issue gh/libgd/libgd#247: A read out-of-bands was found in
    the parsing of TGA files (CVE-2016-6132)
  - Issue gh/libgd/libgd#247: Buffer over-read issue when
    parsing crafted TGA file (CVE-2016-6214)
  - Issue gh/libgd/libgd#248: fix Out-Of-Bounds Read in
    read_image_tga
  - Integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  - Fix php bug#72494, invalid color index not handled, can lead
    to crash (CVE-2016-6128)
  + Improve color check for CropThreshold
  + gdImageCopyResampled has been improved. Better handling of
    images with alpha channel, also brings libgd in sync with
    php's bundled gd.
- Drop patches:
  + gd-CVE-2016-5116.patch: upstreamed
  + gd-CVE-2016-6132.patch: upstreamed
  + gd-CVE-2016-6214.patch: upstreamed
  + gd-CVE-2016-6905.patch: upstreamed
  + gd-libvpx.patch: vpx support dropped.
- Add BuildRequires for automake and autoconf since
  gd-disable-freetype27-failed-tests.patch touches makefiles.
- Drop getver.pl from source: included in upstream tarball.
- Add "-msse -mfpmath=sse" to CFLAGS to fix tests on ix86
  architectures.
- Add "-ffp-contract=off" to CFLAGS for non-ix86 arch (ppc, arm)
  to fix a test: see gh#libgd/libgd#278.
- Add gd-test-unintialized-var.patch to fix an uninitialised
  variable in tests/gd2/gd2_read.c to prevent it from compiling
  with -Werror (only causes problems in no ix86 arch
  surprisingly); patch sent upstream.
- Rebase gd-disable-freetype27-failed-tests.patch for updated
  version.
- Update URL and Source to project's new github URL's.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198400">- Honour %optflags correctly.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198401">- Support webp format, BuildRequires libwebp-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1481284800">- devel package also require libwebp-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Version update to 2.2.4:
  * gdImageCreate() doesn't check for oversized images and as such is prone
    to DoS vulnerabilities. (CVE-2016-9317) bsc#1022283
  * double-free in gdImageWebPtr() (CVE-2016-6912) bsc#1022284
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
    bsc#1022263
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    bsc#1022264
  * Signed Integer Overflow gd_io.c (CVE-2016-10168) bsc#1022265
- Remove patches merged/obsoleted by upstream:
  * gd-config.patch
  * gd-disable-freetype27-failed-tests.patch
  * gd-test-unintialized-var.patch
- Add patch gd-freetype.patch taking patch from upstream for
  freetype 2.7</changelog>
  <changelog author="tchvatal@suse.com" date="1500638400">- Add patch gd-rounding.patch
- Set again the cflags so other archs do not fail testsuite</changelog>
  <changelog author="lnussel@suse.de" date="1502798400">- Don't fail gdimagegrayscale/basic on SLE15 (boo#1053825)</changelog>
  <changelog author="pgajdos@suse.com" date="1504612800">- Version update to 2.2.5:
  [#]## Security
  - Double-free in gdImagePngPtr(). (CVE-2017-6362)
  - Buffer over-read into uninitialized memory. (CVE-2017-7890)
  [#]## Fixed
  - Fix #109: XBM reading fails with printed error
  - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable
  - Fix #357: 2.2.4: Segfault in test suite
  - Fix #386: gdImageGrayScale() may produce colors
  - Fix #406: webpng -i removes the transparent color
  - Fix Coverity #155475: Failure to restore alphaBlendingFlag
  - Fix Coverity #155476: potential resource leak
  - Fix several build issues and test failures
  - Fix and reenable optimized support for reading 1 bps TIFFs
  [#]## Added
  - The native MSVC buildchain now supports libtiff and most executables
- removed patches (upstreamed):
  . gd-freetype.patch
  . gd-rounding.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1516622400">- security update:
  * CVE-2018-5711 [bsc#1076391]
    + gd-CVE-2018-5711.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1535371200">- security update:
  * CVE-2018-1000222 [bsc#1105434]
    + gd-CVE-2018-1000222.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548936000">- security update
  * CVE-2019-6978 [bsc#1123522]
    + gd-CVE-2019-6978.patch
  * CVE-2019-6977 [bsc#1123361]
    + gd-CVE-2019-6977.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- change order while installing splitted library [bsc#1136574]</changelog>
  <changelog author="pgajdos@suse.com" date="1563278400">- security update
- added patches
  CVE-2019-11038 [bsc#1140120]
  + gd-CVE-2019-11038.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1583323200">- security update
- added patches
  fix CVE-2018-14553 [bsc#1165471], null pointer dereference in gdImageClone()
  + gd-CVE-2018-14553.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631620800">- security update
- added patches
  fix CVE-2021-40812 [bsc#1190400], out-of-bounds read in GD library
  + gd-CVE-2021-40812.patch</changelog>
</package>
<package pkgid="61712571720e9c70c0c23ea1f4a9b67b15c576061b9481c359ce5729e0f84026" name="gd" arch="src">
  <version epoch="0" ver="2.2.5" rel="11.3.1"/>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1431432000">- Added patch gd-libvpx.patch to enable build against libvpx &gt;= 1.4,
  new VPX_ prefixed namespaces are available since libvpx = 0.9.1.</changelog>
  <changelog author="pgajdos@suse.com" date="1456833600">- add missing config/getver.pl [bsc#965190]</changelog>
  <changelog author="pgajdos@suse.com" date="1464609600">- security update:
  * CVE-2016-5116 [bsc#982176]
    + gd-CVE-2016-5116.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1471953600">- security update:
  * CVE-2016-6132 [bsc#987577]
    + gd-CVE-2016-6132.patch
  * CVE-2016-6214 [bsc#991436]
    + gd-CVE-2016-6214.patch
  * CVE-2016-6905 [bsc#995034]
    + gd-CVE-2016-6905.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1475150400">- Add gd-disable-freetype27-failed-tests.patch: Disable for now
  tests failing against freetype &gt;= 2.7 for being too exact
  (gh#libgd/libgd#302). The failures have been understood by
  upstream to be due to minor differences between test images and
  those generated when freeetype &gt;= 2.7 is used to build gd.</changelog>
  <changelog author="badshah400@gmail.com" date="1475236800">- Update to version 2.2.3:
  + Security fixes:
  - Php bug#72339, Integer Overflow in _gd2GetHeader
    (CVE-2016-5766)
  - Issue gh/libgd/libgd#247: A read out-of-bands was found in
    the parsing of TGA files (CVE-2016-6132)
  - Issue gh/libgd/libgd#247: Buffer over-read issue when
    parsing crafted TGA file (CVE-2016-6214)
  - Issue gh/libgd/libgd#248: fix Out-Of-Bounds Read in
    read_image_tga
  - Integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  - Fix php bug#72494, invalid color index not handled, can lead
    to crash (CVE-2016-6128)
  + Improve color check for CropThreshold
  + gdImageCopyResampled has been improved. Better handling of
    images with alpha channel, also brings libgd in sync with
    php's bundled gd.
- Drop patches:
  + gd-CVE-2016-5116.patch: upstreamed
  + gd-CVE-2016-6132.patch: upstreamed
  + gd-CVE-2016-6214.patch: upstreamed
  + gd-CVE-2016-6905.patch: upstreamed
  + gd-libvpx.patch: vpx support dropped.
- Add BuildRequires for automake and autoconf since
  gd-disable-freetype27-failed-tests.patch touches makefiles.
- Drop getver.pl from source: included in upstream tarball.
- Add "-msse -mfpmath=sse" to CFLAGS to fix tests on ix86
  architectures.
- Add "-ffp-contract=off" to CFLAGS for non-ix86 arch (ppc, arm)
  to fix a test: see gh#libgd/libgd#278.
- Add gd-test-unintialized-var.patch to fix an uninitialised
  variable in tests/gd2/gd2_read.c to prevent it from compiling
  with -Werror (only causes problems in no ix86 arch
  surprisingly); patch sent upstream.
- Rebase gd-disable-freetype27-failed-tests.patch for updated
  version.
- Update URL and Source to project's new github URL's.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198400">- Honour %optflags correctly.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198401">- Support webp format, BuildRequires libwebp-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1481284800">- devel package also require libwebp-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Version update to 2.2.4:
  * gdImageCreate() doesn't check for oversized images and as such is prone
    to DoS vulnerabilities. (CVE-2016-9317) bsc#1022283
  * double-free in gdImageWebPtr() (CVE-2016-6912) bsc#1022284
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
    bsc#1022263
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    bsc#1022264
  * Signed Integer Overflow gd_io.c (CVE-2016-10168) bsc#1022265
- Remove patches merged/obsoleted by upstream:
  * gd-config.patch
  * gd-disable-freetype27-failed-tests.patch
  * gd-test-unintialized-var.patch
- Add patch gd-freetype.patch taking patch from upstream for
  freetype 2.7</changelog>
  <changelog author="tchvatal@suse.com" date="1500638400">- Add patch gd-rounding.patch
- Set again the cflags so other archs do not fail testsuite</changelog>
  <changelog author="lnussel@suse.de" date="1502798400">- Don't fail gdimagegrayscale/basic on SLE15 (boo#1053825)</changelog>
  <changelog author="pgajdos@suse.com" date="1504612800">- Version update to 2.2.5:
  [#]## Security
  - Double-free in gdImagePngPtr(). (CVE-2017-6362)
  - Buffer over-read into uninitialized memory. (CVE-2017-7890)
  [#]## Fixed
  - Fix #109: XBM reading fails with printed error
  - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable
  - Fix #357: 2.2.4: Segfault in test suite
  - Fix #386: gdImageGrayScale() may produce colors
  - Fix #406: webpng -i removes the transparent color
  - Fix Coverity #155475: Failure to restore alphaBlendingFlag
  - Fix Coverity #155476: potential resource leak
  - Fix several build issues and test failures
  - Fix and reenable optimized support for reading 1 bps TIFFs
  [#]## Added
  - The native MSVC buildchain now supports libtiff and most executables
- removed patches (upstreamed):
  . gd-freetype.patch
  . gd-rounding.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1516622400">- security update:
  * CVE-2018-5711 [bsc#1076391]
    + gd-CVE-2018-5711.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1535371200">- security update:
  * CVE-2018-1000222 [bsc#1105434]
    + gd-CVE-2018-1000222.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548936000">- security update
  * CVE-2019-6978 [bsc#1123522]
    + gd-CVE-2019-6978.patch
  * CVE-2019-6977 [bsc#1123361]
    + gd-CVE-2019-6977.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- change order while installing splitted library [bsc#1136574]</changelog>
  <changelog author="pgajdos@suse.com" date="1563278400">- security update
- added patches
  CVE-2019-11038 [bsc#1140120]
  + gd-CVE-2019-11038.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1583323200">- security update
- added patches
  fix CVE-2018-14553 [bsc#1165471], null pointer dereference in gdImageClone()
  + gd-CVE-2018-14553.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631620800">- security update
- added patches
  fix CVE-2021-40812 [bsc#1190400], out-of-bounds read in GD library
  + gd-CVE-2021-40812.patch</changelog>
</package>
<package pkgid="94f5199ffe42129ee5424c26740f6a1f6f41036ee983b23e225ebe8e32522b28" name="gd" arch="x86_64">
  <version epoch="0" ver="2.2.5" rel="11.3.1"/>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1431432000">- Added patch gd-libvpx.patch to enable build against libvpx &gt;= 1.4,
  new VPX_ prefixed namespaces are available since libvpx = 0.9.1.</changelog>
  <changelog author="pgajdos@suse.com" date="1456833600">- add missing config/getver.pl [bsc#965190]</changelog>
  <changelog author="pgajdos@suse.com" date="1464609600">- security update:
  * CVE-2016-5116 [bsc#982176]
    + gd-CVE-2016-5116.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1471953600">- security update:
  * CVE-2016-6132 [bsc#987577]
    + gd-CVE-2016-6132.patch
  * CVE-2016-6214 [bsc#991436]
    + gd-CVE-2016-6214.patch
  * CVE-2016-6905 [bsc#995034]
    + gd-CVE-2016-6905.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1475150400">- Add gd-disable-freetype27-failed-tests.patch: Disable for now
  tests failing against freetype &gt;= 2.7 for being too exact
  (gh#libgd/libgd#302). The failures have been understood by
  upstream to be due to minor differences between test images and
  those generated when freeetype &gt;= 2.7 is used to build gd.</changelog>
  <changelog author="badshah400@gmail.com" date="1475236800">- Update to version 2.2.3:
  + Security fixes:
  - Php bug#72339, Integer Overflow in _gd2GetHeader
    (CVE-2016-5766)
  - Issue gh/libgd/libgd#247: A read out-of-bands was found in
    the parsing of TGA files (CVE-2016-6132)
  - Issue gh/libgd/libgd#247: Buffer over-read issue when
    parsing crafted TGA file (CVE-2016-6214)
  - Issue gh/libgd/libgd#248: fix Out-Of-Bounds Read in
    read_image_tga
  - Integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  - Fix php bug#72494, invalid color index not handled, can lead
    to crash (CVE-2016-6128)
  + Improve color check for CropThreshold
  + gdImageCopyResampled has been improved. Better handling of
    images with alpha channel, also brings libgd in sync with
    php's bundled gd.
- Drop patches:
  + gd-CVE-2016-5116.patch: upstreamed
  + gd-CVE-2016-6132.patch: upstreamed
  + gd-CVE-2016-6214.patch: upstreamed
  + gd-CVE-2016-6905.patch: upstreamed
  + gd-libvpx.patch: vpx support dropped.
- Add BuildRequires for automake and autoconf since
  gd-disable-freetype27-failed-tests.patch touches makefiles.
- Drop getver.pl from source: included in upstream tarball.
- Add "-msse -mfpmath=sse" to CFLAGS to fix tests on ix86
  architectures.
- Add "-ffp-contract=off" to CFLAGS for non-ix86 arch (ppc, arm)
  to fix a test: see gh#libgd/libgd#278.
- Add gd-test-unintialized-var.patch to fix an uninitialised
  variable in tests/gd2/gd2_read.c to prevent it from compiling
  with -Werror (only causes problems in no ix86 arch
  surprisingly); patch sent upstream.
- Rebase gd-disable-freetype27-failed-tests.patch for updated
  version.
- Update URL and Source to project's new github URL's.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198400">- Honour %optflags correctly.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198401">- Support webp format, BuildRequires libwebp-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1481284800">- devel package also require libwebp-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Version update to 2.2.4:
  * gdImageCreate() doesn't check for oversized images and as such is prone
    to DoS vulnerabilities. (CVE-2016-9317) bsc#1022283
  * double-free in gdImageWebPtr() (CVE-2016-6912) bsc#1022284
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
    bsc#1022263
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    bsc#1022264
  * Signed Integer Overflow gd_io.c (CVE-2016-10168) bsc#1022265
- Remove patches merged/obsoleted by upstream:
  * gd-config.patch
  * gd-disable-freetype27-failed-tests.patch
  * gd-test-unintialized-var.patch
- Add patch gd-freetype.patch taking patch from upstream for
  freetype 2.7</changelog>
  <changelog author="tchvatal@suse.com" date="1500638400">- Add patch gd-rounding.patch
- Set again the cflags so other archs do not fail testsuite</changelog>
  <changelog author="lnussel@suse.de" date="1502798400">- Don't fail gdimagegrayscale/basic on SLE15 (boo#1053825)</changelog>
  <changelog author="pgajdos@suse.com" date="1504612800">- Version update to 2.2.5:
  [#]## Security
  - Double-free in gdImagePngPtr(). (CVE-2017-6362)
  - Buffer over-read into uninitialized memory. (CVE-2017-7890)
  [#]## Fixed
  - Fix #109: XBM reading fails with printed error
  - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable
  - Fix #357: 2.2.4: Segfault in test suite
  - Fix #386: gdImageGrayScale() may produce colors
  - Fix #406: webpng -i removes the transparent color
  - Fix Coverity #155475: Failure to restore alphaBlendingFlag
  - Fix Coverity #155476: potential resource leak
  - Fix several build issues and test failures
  - Fix and reenable optimized support for reading 1 bps TIFFs
  [#]## Added
  - The native MSVC buildchain now supports libtiff and most executables
- removed patches (upstreamed):
  . gd-freetype.patch
  . gd-rounding.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1516622400">- security update:
  * CVE-2018-5711 [bsc#1076391]
    + gd-CVE-2018-5711.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1535371200">- security update:
  * CVE-2018-1000222 [bsc#1105434]
    + gd-CVE-2018-1000222.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548936000">- security update
  * CVE-2019-6978 [bsc#1123522]
    + gd-CVE-2019-6978.patch
  * CVE-2019-6977 [bsc#1123361]
    + gd-CVE-2019-6977.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- change order while installing splitted library [bsc#1136574]</changelog>
  <changelog author="pgajdos@suse.com" date="1563278400">- security update
- added patches
  CVE-2019-11038 [bsc#1140120]
  + gd-CVE-2019-11038.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1583323200">- security update
- added patches
  fix CVE-2018-14553 [bsc#1165471], null pointer dereference in gdImageClone()
  + gd-CVE-2018-14553.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631620800">- security update
- added patches
  fix CVE-2021-40812 [bsc#1190400], out-of-bounds read in GD library
  + gd-CVE-2021-40812.patch</changelog>
</package>
<package pkgid="4b5644a7d2bebf3256ad06ba984dcfb83dca82768d59899b3b782503de6f7481" name="gd-devel" arch="aarch64">
  <version epoch="0" ver="2.2.5" rel="11.3.1"/>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1431432000">- Added patch gd-libvpx.patch to enable build against libvpx &gt;= 1.4,
  new VPX_ prefixed namespaces are available since libvpx = 0.9.1.</changelog>
  <changelog author="pgajdos@suse.com" date="1456833600">- add missing config/getver.pl [bsc#965190]</changelog>
  <changelog author="pgajdos@suse.com" date="1464609600">- security update:
  * CVE-2016-5116 [bsc#982176]
    + gd-CVE-2016-5116.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1471953600">- security update:
  * CVE-2016-6132 [bsc#987577]
    + gd-CVE-2016-6132.patch
  * CVE-2016-6214 [bsc#991436]
    + gd-CVE-2016-6214.patch
  * CVE-2016-6905 [bsc#995034]
    + gd-CVE-2016-6905.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1475150400">- Add gd-disable-freetype27-failed-tests.patch: Disable for now
  tests failing against freetype &gt;= 2.7 for being too exact
  (gh#libgd/libgd#302). The failures have been understood by
  upstream to be due to minor differences between test images and
  those generated when freeetype &gt;= 2.7 is used to build gd.</changelog>
  <changelog author="badshah400@gmail.com" date="1475236800">- Update to version 2.2.3:
  + Security fixes:
  - Php bug#72339, Integer Overflow in _gd2GetHeader
    (CVE-2016-5766)
  - Issue gh/libgd/libgd#247: A read out-of-bands was found in
    the parsing of TGA files (CVE-2016-6132)
  - Issue gh/libgd/libgd#247: Buffer over-read issue when
    parsing crafted TGA file (CVE-2016-6214)
  - Issue gh/libgd/libgd#248: fix Out-Of-Bounds Read in
    read_image_tga
  - Integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  - Fix php bug#72494, invalid color index not handled, can lead
    to crash (CVE-2016-6128)
  + Improve color check for CropThreshold
  + gdImageCopyResampled has been improved. Better handling of
    images with alpha channel, also brings libgd in sync with
    php's bundled gd.
- Drop patches:
  + gd-CVE-2016-5116.patch: upstreamed
  + gd-CVE-2016-6132.patch: upstreamed
  + gd-CVE-2016-6214.patch: upstreamed
  + gd-CVE-2016-6905.patch: upstreamed
  + gd-libvpx.patch: vpx support dropped.
- Add BuildRequires for automake and autoconf since
  gd-disable-freetype27-failed-tests.patch touches makefiles.
- Drop getver.pl from source: included in upstream tarball.
- Add "-msse -mfpmath=sse" to CFLAGS to fix tests on ix86
  architectures.
- Add "-ffp-contract=off" to CFLAGS for non-ix86 arch (ppc, arm)
  to fix a test: see gh#libgd/libgd#278.
- Add gd-test-unintialized-var.patch to fix an uninitialised
  variable in tests/gd2/gd2_read.c to prevent it from compiling
  with -Werror (only causes problems in no ix86 arch
  surprisingly); patch sent upstream.
- Rebase gd-disable-freetype27-failed-tests.patch for updated
  version.
- Update URL and Source to project's new github URL's.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198400">- Honour %optflags correctly.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198401">- Support webp format, BuildRequires libwebp-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1481284800">- devel package also require libwebp-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Version update to 2.2.4:
  * gdImageCreate() doesn't check for oversized images and as such is prone
    to DoS vulnerabilities. (CVE-2016-9317) bsc#1022283
  * double-free in gdImageWebPtr() (CVE-2016-6912) bsc#1022284
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
    bsc#1022263
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    bsc#1022264
  * Signed Integer Overflow gd_io.c (CVE-2016-10168) bsc#1022265
- Remove patches merged/obsoleted by upstream:
  * gd-config.patch
  * gd-disable-freetype27-failed-tests.patch
  * gd-test-unintialized-var.patch
- Add patch gd-freetype.patch taking patch from upstream for
  freetype 2.7</changelog>
  <changelog author="tchvatal@suse.com" date="1500638400">- Add patch gd-rounding.patch
- Set again the cflags so other archs do not fail testsuite</changelog>
  <changelog author="lnussel@suse.de" date="1502798400">- Don't fail gdimagegrayscale/basic on SLE15 (boo#1053825)</changelog>
  <changelog author="pgajdos@suse.com" date="1504612800">- Version update to 2.2.5:
  [#]## Security
  - Double-free in gdImagePngPtr(). (CVE-2017-6362)
  - Buffer over-read into uninitialized memory. (CVE-2017-7890)
  [#]## Fixed
  - Fix #109: XBM reading fails with printed error
  - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable
  - Fix #357: 2.2.4: Segfault in test suite
  - Fix #386: gdImageGrayScale() may produce colors
  - Fix #406: webpng -i removes the transparent color
  - Fix Coverity #155475: Failure to restore alphaBlendingFlag
  - Fix Coverity #155476: potential resource leak
  - Fix several build issues and test failures
  - Fix and reenable optimized support for reading 1 bps TIFFs
  [#]## Added
  - The native MSVC buildchain now supports libtiff and most executables
- removed patches (upstreamed):
  . gd-freetype.patch
  . gd-rounding.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1516622400">- security update:
  * CVE-2018-5711 [bsc#1076391]
    + gd-CVE-2018-5711.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1535371200">- security update:
  * CVE-2018-1000222 [bsc#1105434]
    + gd-CVE-2018-1000222.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548936000">- security update
  * CVE-2019-6978 [bsc#1123522]
    + gd-CVE-2019-6978.patch
  * CVE-2019-6977 [bsc#1123361]
    + gd-CVE-2019-6977.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- change order while installing splitted library [bsc#1136574]</changelog>
  <changelog author="pgajdos@suse.com" date="1563278400">- security update
- added patches
  CVE-2019-11038 [bsc#1140120]
  + gd-CVE-2019-11038.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1583323200">- security update
- added patches
  fix CVE-2018-14553 [bsc#1165471], null pointer dereference in gdImageClone()
  + gd-CVE-2018-14553.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631620800">- security update
- added patches
  fix CVE-2021-40812 [bsc#1190400], out-of-bounds read in GD library
  + gd-CVE-2021-40812.patch</changelog>
</package>
<package pkgid="20b1b449f209ed99685f4e5a3aab4928d7732d59468377c4da281f7b10f90e94" name="gd-devel" arch="ppc64le">
  <version epoch="0" ver="2.2.5" rel="11.3.1"/>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1431432000">- Added patch gd-libvpx.patch to enable build against libvpx &gt;= 1.4,
  new VPX_ prefixed namespaces are available since libvpx = 0.9.1.</changelog>
  <changelog author="pgajdos@suse.com" date="1456833600">- add missing config/getver.pl [bsc#965190]</changelog>
  <changelog author="pgajdos@suse.com" date="1464609600">- security update:
  * CVE-2016-5116 [bsc#982176]
    + gd-CVE-2016-5116.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1471953600">- security update:
  * CVE-2016-6132 [bsc#987577]
    + gd-CVE-2016-6132.patch
  * CVE-2016-6214 [bsc#991436]
    + gd-CVE-2016-6214.patch
  * CVE-2016-6905 [bsc#995034]
    + gd-CVE-2016-6905.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1475150400">- Add gd-disable-freetype27-failed-tests.patch: Disable for now
  tests failing against freetype &gt;= 2.7 for being too exact
  (gh#libgd/libgd#302). The failures have been understood by
  upstream to be due to minor differences between test images and
  those generated when freeetype &gt;= 2.7 is used to build gd.</changelog>
  <changelog author="badshah400@gmail.com" date="1475236800">- Update to version 2.2.3:
  + Security fixes:
  - Php bug#72339, Integer Overflow in _gd2GetHeader
    (CVE-2016-5766)
  - Issue gh/libgd/libgd#247: A read out-of-bands was found in
    the parsing of TGA files (CVE-2016-6132)
  - Issue gh/libgd/libgd#247: Buffer over-read issue when
    parsing crafted TGA file (CVE-2016-6214)
  - Issue gh/libgd/libgd#248: fix Out-Of-Bounds Read in
    read_image_tga
  - Integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  - Fix php bug#72494, invalid color index not handled, can lead
    to crash (CVE-2016-6128)
  + Improve color check for CropThreshold
  + gdImageCopyResampled has been improved. Better handling of
    images with alpha channel, also brings libgd in sync with
    php's bundled gd.
- Drop patches:
  + gd-CVE-2016-5116.patch: upstreamed
  + gd-CVE-2016-6132.patch: upstreamed
  + gd-CVE-2016-6214.patch: upstreamed
  + gd-CVE-2016-6905.patch: upstreamed
  + gd-libvpx.patch: vpx support dropped.
- Add BuildRequires for automake and autoconf since
  gd-disable-freetype27-failed-tests.patch touches makefiles.
- Drop getver.pl from source: included in upstream tarball.
- Add "-msse -mfpmath=sse" to CFLAGS to fix tests on ix86
  architectures.
- Add "-ffp-contract=off" to CFLAGS for non-ix86 arch (ppc, arm)
  to fix a test: see gh#libgd/libgd#278.
- Add gd-test-unintialized-var.patch to fix an uninitialised
  variable in tests/gd2/gd2_read.c to prevent it from compiling
  with -Werror (only causes problems in no ix86 arch
  surprisingly); patch sent upstream.
- Rebase gd-disable-freetype27-failed-tests.patch for updated
  version.
- Update URL and Source to project's new github URL's.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198400">- Honour %optflags correctly.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198401">- Support webp format, BuildRequires libwebp-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1481284800">- devel package also require libwebp-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Version update to 2.2.4:
  * gdImageCreate() doesn't check for oversized images and as such is prone
    to DoS vulnerabilities. (CVE-2016-9317) bsc#1022283
  * double-free in gdImageWebPtr() (CVE-2016-6912) bsc#1022284
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
    bsc#1022263
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    bsc#1022264
  * Signed Integer Overflow gd_io.c (CVE-2016-10168) bsc#1022265
- Remove patches merged/obsoleted by upstream:
  * gd-config.patch
  * gd-disable-freetype27-failed-tests.patch
  * gd-test-unintialized-var.patch
- Add patch gd-freetype.patch taking patch from upstream for
  freetype 2.7</changelog>
  <changelog author="tchvatal@suse.com" date="1500638400">- Add patch gd-rounding.patch
- Set again the cflags so other archs do not fail testsuite</changelog>
  <changelog author="lnussel@suse.de" date="1502798400">- Don't fail gdimagegrayscale/basic on SLE15 (boo#1053825)</changelog>
  <changelog author="pgajdos@suse.com" date="1504612800">- Version update to 2.2.5:
  [#]## Security
  - Double-free in gdImagePngPtr(). (CVE-2017-6362)
  - Buffer over-read into uninitialized memory. (CVE-2017-7890)
  [#]## Fixed
  - Fix #109: XBM reading fails with printed error
  - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable
  - Fix #357: 2.2.4: Segfault in test suite
  - Fix #386: gdImageGrayScale() may produce colors
  - Fix #406: webpng -i removes the transparent color
  - Fix Coverity #155475: Failure to restore alphaBlendingFlag
  - Fix Coverity #155476: potential resource leak
  - Fix several build issues and test failures
  - Fix and reenable optimized support for reading 1 bps TIFFs
  [#]## Added
  - The native MSVC buildchain now supports libtiff and most executables
- removed patches (upstreamed):
  . gd-freetype.patch
  . gd-rounding.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1516622400">- security update:
  * CVE-2018-5711 [bsc#1076391]
    + gd-CVE-2018-5711.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1535371200">- security update:
  * CVE-2018-1000222 [bsc#1105434]
    + gd-CVE-2018-1000222.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548936000">- security update
  * CVE-2019-6978 [bsc#1123522]
    + gd-CVE-2019-6978.patch
  * CVE-2019-6977 [bsc#1123361]
    + gd-CVE-2019-6977.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- change order while installing splitted library [bsc#1136574]</changelog>
  <changelog author="pgajdos@suse.com" date="1563278400">- security update
- added patches
  CVE-2019-11038 [bsc#1140120]
  + gd-CVE-2019-11038.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1583323200">- security update
- added patches
  fix CVE-2018-14553 [bsc#1165471], null pointer dereference in gdImageClone()
  + gd-CVE-2018-14553.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631620800">- security update
- added patches
  fix CVE-2021-40812 [bsc#1190400], out-of-bounds read in GD library
  + gd-CVE-2021-40812.patch</changelog>
</package>
<package pkgid="7a221c2dbba243df6c52116d366eed6db7c60fe99643b76d6da87fc0ce738fd1" name="gd-devel" arch="s390x">
  <version epoch="0" ver="2.2.5" rel="11.3.1"/>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1431432000">- Added patch gd-libvpx.patch to enable build against libvpx &gt;= 1.4,
  new VPX_ prefixed namespaces are available since libvpx = 0.9.1.</changelog>
  <changelog author="pgajdos@suse.com" date="1456833600">- add missing config/getver.pl [bsc#965190]</changelog>
  <changelog author="pgajdos@suse.com" date="1464609600">- security update:
  * CVE-2016-5116 [bsc#982176]
    + gd-CVE-2016-5116.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1471953600">- security update:
  * CVE-2016-6132 [bsc#987577]
    + gd-CVE-2016-6132.patch
  * CVE-2016-6214 [bsc#991436]
    + gd-CVE-2016-6214.patch
  * CVE-2016-6905 [bsc#995034]
    + gd-CVE-2016-6905.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1475150400">- Add gd-disable-freetype27-failed-tests.patch: Disable for now
  tests failing against freetype &gt;= 2.7 for being too exact
  (gh#libgd/libgd#302). The failures have been understood by
  upstream to be due to minor differences between test images and
  those generated when freeetype &gt;= 2.7 is used to build gd.</changelog>
  <changelog author="badshah400@gmail.com" date="1475236800">- Update to version 2.2.3:
  + Security fixes:
  - Php bug#72339, Integer Overflow in _gd2GetHeader
    (CVE-2016-5766)
  - Issue gh/libgd/libgd#247: A read out-of-bands was found in
    the parsing of TGA files (CVE-2016-6132)
  - Issue gh/libgd/libgd#247: Buffer over-read issue when
    parsing crafted TGA file (CVE-2016-6214)
  - Issue gh/libgd/libgd#248: fix Out-Of-Bounds Read in
    read_image_tga
  - Integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  - Fix php bug#72494, invalid color index not handled, can lead
    to crash (CVE-2016-6128)
  + Improve color check for CropThreshold
  + gdImageCopyResampled has been improved. Better handling of
    images with alpha channel, also brings libgd in sync with
    php's bundled gd.
- Drop patches:
  + gd-CVE-2016-5116.patch: upstreamed
  + gd-CVE-2016-6132.patch: upstreamed
  + gd-CVE-2016-6214.patch: upstreamed
  + gd-CVE-2016-6905.patch: upstreamed
  + gd-libvpx.patch: vpx support dropped.
- Add BuildRequires for automake and autoconf since
  gd-disable-freetype27-failed-tests.patch touches makefiles.
- Drop getver.pl from source: included in upstream tarball.
- Add "-msse -mfpmath=sse" to CFLAGS to fix tests on ix86
  architectures.
- Add "-ffp-contract=off" to CFLAGS for non-ix86 arch (ppc, arm)
  to fix a test: see gh#libgd/libgd#278.
- Add gd-test-unintialized-var.patch to fix an uninitialised
  variable in tests/gd2/gd2_read.c to prevent it from compiling
  with -Werror (only causes problems in no ix86 arch
  surprisingly); patch sent upstream.
- Rebase gd-disable-freetype27-failed-tests.patch for updated
  version.
- Update URL and Source to project's new github URL's.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198400">- Honour %optflags correctly.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198401">- Support webp format, BuildRequires libwebp-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1481284800">- devel package also require libwebp-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Version update to 2.2.4:
  * gdImageCreate() doesn't check for oversized images and as such is prone
    to DoS vulnerabilities. (CVE-2016-9317) bsc#1022283
  * double-free in gdImageWebPtr() (CVE-2016-6912) bsc#1022284
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
    bsc#1022263
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    bsc#1022264
  * Signed Integer Overflow gd_io.c (CVE-2016-10168) bsc#1022265
- Remove patches merged/obsoleted by upstream:
  * gd-config.patch
  * gd-disable-freetype27-failed-tests.patch
  * gd-test-unintialized-var.patch
- Add patch gd-freetype.patch taking patch from upstream for
  freetype 2.7</changelog>
  <changelog author="tchvatal@suse.com" date="1500638400">- Add patch gd-rounding.patch
- Set again the cflags so other archs do not fail testsuite</changelog>
  <changelog author="lnussel@suse.de" date="1502798400">- Don't fail gdimagegrayscale/basic on SLE15 (boo#1053825)</changelog>
  <changelog author="pgajdos@suse.com" date="1504612800">- Version update to 2.2.5:
  [#]## Security
  - Double-free in gdImagePngPtr(). (CVE-2017-6362)
  - Buffer over-read into uninitialized memory. (CVE-2017-7890)
  [#]## Fixed
  - Fix #109: XBM reading fails with printed error
  - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable
  - Fix #357: 2.2.4: Segfault in test suite
  - Fix #386: gdImageGrayScale() may produce colors
  - Fix #406: webpng -i removes the transparent color
  - Fix Coverity #155475: Failure to restore alphaBlendingFlag
  - Fix Coverity #155476: potential resource leak
  - Fix several build issues and test failures
  - Fix and reenable optimized support for reading 1 bps TIFFs
  [#]## Added
  - The native MSVC buildchain now supports libtiff and most executables
- removed patches (upstreamed):
  . gd-freetype.patch
  . gd-rounding.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1516622400">- security update:
  * CVE-2018-5711 [bsc#1076391]
    + gd-CVE-2018-5711.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1535371200">- security update:
  * CVE-2018-1000222 [bsc#1105434]
    + gd-CVE-2018-1000222.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548936000">- security update
  * CVE-2019-6978 [bsc#1123522]
    + gd-CVE-2019-6978.patch
  * CVE-2019-6977 [bsc#1123361]
    + gd-CVE-2019-6977.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- change order while installing splitted library [bsc#1136574]</changelog>
  <changelog author="pgajdos@suse.com" date="1563278400">- security update
- added patches
  CVE-2019-11038 [bsc#1140120]
  + gd-CVE-2019-11038.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1583323200">- security update
- added patches
  fix CVE-2018-14553 [bsc#1165471], null pointer dereference in gdImageClone()
  + gd-CVE-2018-14553.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631620800">- security update
- added patches
  fix CVE-2021-40812 [bsc#1190400], out-of-bounds read in GD library
  + gd-CVE-2021-40812.patch</changelog>
</package>
<package pkgid="eb9154e00a7fe9143cda45fafb9855181f3640a9f732784c7e3b262bad51764a" name="gd-devel" arch="x86_64">
  <version epoch="0" ver="2.2.5" rel="11.3.1"/>
  <changelog author="joerg.lorenzen@ki.tng.de" date="1431432000">- Added patch gd-libvpx.patch to enable build against libvpx &gt;= 1.4,
  new VPX_ prefixed namespaces are available since libvpx = 0.9.1.</changelog>
  <changelog author="pgajdos@suse.com" date="1456833600">- add missing config/getver.pl [bsc#965190]</changelog>
  <changelog author="pgajdos@suse.com" date="1464609600">- security update:
  * CVE-2016-5116 [bsc#982176]
    + gd-CVE-2016-5116.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1471953600">- security update:
  * CVE-2016-6132 [bsc#987577]
    + gd-CVE-2016-6132.patch
  * CVE-2016-6214 [bsc#991436]
    + gd-CVE-2016-6214.patch
  * CVE-2016-6905 [bsc#995034]
    + gd-CVE-2016-6905.patch</changelog>
  <changelog author="badshah400@gmail.com" date="1475150400">- Add gd-disable-freetype27-failed-tests.patch: Disable for now
  tests failing against freetype &gt;= 2.7 for being too exact
  (gh#libgd/libgd#302). The failures have been understood by
  upstream to be due to minor differences between test images and
  those generated when freeetype &gt;= 2.7 is used to build gd.</changelog>
  <changelog author="badshah400@gmail.com" date="1475236800">- Update to version 2.2.3:
  + Security fixes:
  - Php bug#72339, Integer Overflow in _gd2GetHeader
    (CVE-2016-5766)
  - Issue gh/libgd/libgd#247: A read out-of-bands was found in
    the parsing of TGA files (CVE-2016-6132)
  - Issue gh/libgd/libgd#247: Buffer over-read issue when
    parsing crafted TGA file (CVE-2016-6214)
  - Issue gh/libgd/libgd#248: fix Out-Of-Bounds Read in
    read_image_tga
  - Integer overflow error within _gdContributionsAlloc()
    (CVE-2016-6207)
  - Fix php bug#72494, invalid color index not handled, can lead
    to crash (CVE-2016-6128)
  + Improve color check for CropThreshold
  + gdImageCopyResampled has been improved. Better handling of
    images with alpha channel, also brings libgd in sync with
    php's bundled gd.
- Drop patches:
  + gd-CVE-2016-5116.patch: upstreamed
  + gd-CVE-2016-6132.patch: upstreamed
  + gd-CVE-2016-6214.patch: upstreamed
  + gd-CVE-2016-6905.patch: upstreamed
  + gd-libvpx.patch: vpx support dropped.
- Add BuildRequires for automake and autoconf since
  gd-disable-freetype27-failed-tests.patch touches makefiles.
- Drop getver.pl from source: included in upstream tarball.
- Add "-msse -mfpmath=sse" to CFLAGS to fix tests on ix86
  architectures.
- Add "-ffp-contract=off" to CFLAGS for non-ix86 arch (ppc, arm)
  to fix a test: see gh#libgd/libgd#278.
- Add gd-test-unintialized-var.patch to fix an uninitialised
  variable in tests/gd2/gd2_read.c to prevent it from compiling
  with -Werror (only causes problems in no ix86 arch
  surprisingly); patch sent upstream.
- Rebase gd-disable-freetype27-failed-tests.patch for updated
  version.
- Update URL and Source to project's new github URL's.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198400">- Honour %optflags correctly.</changelog>
  <changelog author="crrodriguez@opensuse.org" date="1481198401">- Support webp format, BuildRequires libwebp-devel</changelog>
  <changelog author="pgajdos@suse.com" date="1481284800">- devel package also require libwebp-devel</changelog>
  <changelog author="tchvatal@suse.com" date="1499428800">- Version update to 2.2.4:
  * gdImageCreate() doesn't check for oversized images and as such is prone
    to DoS vulnerabilities. (CVE-2016-9317) bsc#1022283
  * double-free in gdImageWebPtr() (CVE-2016-6912) bsc#1022284
  * potential unsigned underflow in gd_interpolation.c (CVE-2016-10166)
    bsc#1022263
  * DOS vulnerability in gdImageCreateFromGd2Ctx() (CVE-2016-10167)
    bsc#1022264
  * Signed Integer Overflow gd_io.c (CVE-2016-10168) bsc#1022265
- Remove patches merged/obsoleted by upstream:
  * gd-config.patch
  * gd-disable-freetype27-failed-tests.patch
  * gd-test-unintialized-var.patch
- Add patch gd-freetype.patch taking patch from upstream for
  freetype 2.7</changelog>
  <changelog author="tchvatal@suse.com" date="1500638400">- Add patch gd-rounding.patch
- Set again the cflags so other archs do not fail testsuite</changelog>
  <changelog author="lnussel@suse.de" date="1502798400">- Don't fail gdimagegrayscale/basic on SLE15 (boo#1053825)</changelog>
  <changelog author="pgajdos@suse.com" date="1504612800">- Version update to 2.2.5:
  [#]## Security
  - Double-free in gdImagePngPtr(). (CVE-2017-6362)
  - Buffer over-read into uninitialized memory. (CVE-2017-7890)
  [#]## Fixed
  - Fix #109: XBM reading fails with printed error
  - Fix #338: Fatal and normal libjpeg/ibpng errors not distinguishable
  - Fix #357: 2.2.4: Segfault in test suite
  - Fix #386: gdImageGrayScale() may produce colors
  - Fix #406: webpng -i removes the transparent color
  - Fix Coverity #155475: Failure to restore alphaBlendingFlag
  - Fix Coverity #155476: potential resource leak
  - Fix several build issues and test failures
  - Fix and reenable optimized support for reading 1 bps TIFFs
  [#]## Added
  - The native MSVC buildchain now supports libtiff and most executables
- removed patches (upstreamed):
  . gd-freetype.patch
  . gd-rounding.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1516622400">- security update:
  * CVE-2018-5711 [bsc#1076391]
    + gd-CVE-2018-5711.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1535371200">- security update:
  * CVE-2018-1000222 [bsc#1105434]
    + gd-CVE-2018-1000222.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1548936000">- security update
  * CVE-2019-6978 [bsc#1123522]
    + gd-CVE-2019-6978.patch
  * CVE-2019-6977 [bsc#1123361]
    + gd-CVE-2019-6977.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1559217600">- change order while installing splitted library [bsc#1136574]</changelog>
  <changelog author="pgajdos@suse.com" date="1563278400">- security update
- added patches
  CVE-2019-11038 [bsc#1140120]
  + gd-CVE-2019-11038.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1583323200">- security update
- added patches
  fix CVE-2018-14553 [bsc#1165471], null pointer dereference in gdImageClone()
  + gd-CVE-2018-14553.patch</changelog>
  <changelog author="pgajdos@suse.com" date="1631620800">- security update
- added patches
  fix CVE-2021-40812 [bsc#1190400], out-of-bounds read in GD library
  + gd-CVE-2021-40812.patch</changelog>
</package>
<package pkgid="5e51801bf9518a7052c9d671bcc96e81512dbe5d437d03cff68b290ce42a7a2f" name="gettext-its-gtk3" arch="aarch64">
  <version epoch="0" ver="3.24.20" rel="3.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1554984000">- Update to version 3.24.8:
  + Color editor: don't warn if editing is cancelled.
  + Always redraw on allocate - not doing so is not safe when any
    widget can have a background.
  + Use GLSL 3.30 for shaders.
  + Quartz: add a preliminary GdkGLContext implementation.
  + Win32: Fix a bug that prevented storing printer driver prefs.
  + Wayland: properly place window menus.
  + GtkApplication: support session state changes in sandboxes,
    using the inhibit portal.
  + Fix a problem with autostart notification.
  + Places: Show loop devices as reported by gvfs.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1556107200">- Disable LTO (boo#1133119).</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560859200">- Update to version 3.24.9:
  + GTK can now be built with the meson build system.
  + Wayland:
  - Support the xdg-output protocol for correct monitor sizes
    with scaled displays.
  - Fix handling of cursor hotspots that was reading
    uninitialized memory.
  - Update tablet cursors when scale changes.
  + CSS: Use multiple font-family values (bsc#1134059,
    glgo#GNOME/gtk#1854).
  + Emoji: Populate the Emoji chooser incrementally.
  + Printing: Require CUPS 1.7.
  + Scrolling: Add a gtk-overlay-scrolling setting that can be used
    to force traditional (non-overlay) scrollbars.
  + GtkTreeView:
  - Update rubberband rectangles more often.
  - Remove the pixel cache, to avoid the redraw issues that it
    causes.
  + Tooling: Support sysprof profiling.
  + Themes:
  - Adwaita: Small tweaks to the theme refresh.
  - Adwaita: Update treeview progress bars.
  - HighContrast: Improve notebook tabs.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562241600">- Update to version 3.24.10:
  + Make gtk_widget_get_action_group behave as documented.
  + Make gdk_screen_get_monitor_plug_name works as before.
  + Adwaita:
  - Update infobar look.
  - Fix some issues with submenus and popovers.
  + Wayland: Use the xdg-output protocol.
  + Fix build issues around cups.
  + Quartz: Build fixes.
  + treeview: Bring the pixel cache back, since its removal was
    causing problems in some applications.
  + Various documentation improvements.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567598400">- Update to version 3.24.11:
  + Adwaita:
  - Add drop shadow to icons.
  - Small color fixes.
  - Make title buttons round.
  + Wayland:
  - Support xdg-output v3.
  - Fix clipboard ownership handling.
  + X11: Improve monitor metadata.
  + Build: Require GLib 2.57.2.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 3.24.12:
  + file chooser: allow sorting by file type.
  + dnd: fix pointer offsets under X11 and Wayland.
  + broadway: Fix a font problem.
  + mir Drop this backend.
  + printing: Get PPD from original host if needed.
  + a11y: Fix interference with clutter a11y impl.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 3.24.12+32:
  + gdk: Do not change the windowing selection when cancelling
    source
  + Revert "gdk: Do not call gdk_selection_owner_set() internally
    to the backend"
  + gtkwidget: Ensure to run key controllers in the bubble phase
  + keycontroller: Fix ::key-released signal argument
  + key controller: Don't eat modifier events
  + gdk: Do not call gdk_selection_owner_set() internally to the
    backend
  + gdk: Shuffle the situations where a selection is unset
  + gtkwidget: Forward unhandled scroll events through controllers
- Switch to gitcheckout of stable branch, needed to get fixes for
  copy/paste between Xwayland and wayland programs.
- Following the above, add gtk-doc and libtool BuildRequires and
  pass autogen.sh to bootstrap and --enable-gtk-doc to configure.
- No longer disable LTO, current versions of gtk3 builds fine with
  it enabled.</changelog>
  <changelog author="idonmez@suse.com" date="1572609600">- Don't recommend -lang subpackage</changelog>
  <changelog author="fcrozat@suse.com" date="1574164800">- Add Obsoletes/Provides to baselibs.conf to ensure
  gtk3-immodules-tigrigna-32bit can be upgraded from old version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574856000">- Update to version 3.24.13+0:
  + Fix a11y test output
  + HighContrast: Add missing color to entry
  + themes: remove various @extend with compound selectors
  + Avoid Broadwayd - GtkEntry popup takes 35s after application
    startup.
  + Hide Objective-C from outside GdkQuartz.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1576065600">- Split API doc generation from main package using _multibuild,
  libgtk3 itself only takes a fraction of the time to build.</changelog>
  <changelog author="dimstar@opensuse.org" date="1578657600">- Move /usr/share/locale/en from the -lang package to the -data
  package: English is installed on all systems. This avoids
  gtk3-lang being triggered for installation on english-only
  systems.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581940800">- Update to version 3.24.14:
  + Fix the opaque region for windows on X11.
  + Theme:
  - Fix flat buttons in backdrop.
  - Make popovers look more similar to menus.
  - Tweak checkbox &amp; radiobutton appearance.
  - Add general typography classes (heading, title-1, etc).
  + Language bindings: Fix annotations for
    gtk_tree_model_sort_new_with_model.
  + Switch: Fix touch support.
  + Infobar: Make clickable for default action.
  + Emojichooser: Respect a no-emoji input hint.
  + Fontchooser: Fix an oversight with hiding the size label.
  + Filechooser: Disable recursive search without a system indexer.
  + Modelbutton: Fix a11y support to reflect button state.
  + Input: Fix touchpad gesture center calculation.
  + X11:
  - Fix root window scaling.
  - Support _GTK_WORKAREAS_Dn property.
  + Wayland:
  - Support a terminal purpose in input methods.
  - Fix preedit cursor positioning.
  - Fix enabling/disabling of text inputs.
  - Support simultaneous selection requests.
  - Require Wayland 1.14.91.
  + Printing: Fix a crash with Avahi.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585396800">- Update to version 3.24.16:
  + Fix the build.
- Changes from version 3.24.15:
  + filechooser:
  - Fix a crash.
  - Support selecting directories with a new enough file chooser
    portal.
  + textview: Speed up tag handling.
  + wayland:
  - Fix problems with clipboard handling.
  - Fix a crash in the Wayland input method.
  - Support cursor scale of 400%.
  - Fix a crash in glade.
  + css: Support font-feature-settings
  + Adwaita:
  - Use tabular figures where appropriate.
  - Color tweaks for dark mode.
  - Improve rendering of rounded corners.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1586001600">- Update to version 3.24.17:
  + GtkFileChooser: Fix some keynav issues.
  + GtkMenuButton: disable focus-on-click.
  + Derive the HighContrast and HighContrastInverse themes from
    Adwaita.
  + Wayland:
  - Fix firefox sizing problems.
  - Prevent Alt lingering after Alt-Tab.
  - Load compose sequences from ~/.Compose.
  - Fix a crash in the Wayland input method.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1586520000">- Update to version 3.24.18:
  + Wayland: Fix more sizing regressions in Epiphany and
    LibreOffice menus, and popups in general.
  + Build: Make resource build reproducible.
  + Updated translations.
- Disable autogeneration of .changes in service, we are currently
  using released tags so it is not needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1587988800">- Update to version 3.24.20:
  + GtkFileChooser:
  - Prevent selection changes after overwrite confirmation
  - Don't grab focus to the sidebar on click
  - Avoid a use-after-free in GtkFileSystemModel
  + GtkEmojiChooser: Remove blacklist
  + GtkAboutDialog: Add more licenses
  + Adwaita: Lower the contrast of checkboxes
  + HighContrast: Export the same public colors as Adwaita
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1591272000">- Add gtk3-x11-fix-menu-touch-by-pointer-emulation.patch: GtkMenu
  under X11 cannot work with touchscreen because it cannot handle
  touch events properly, this patch disable touch grabbing for it,
  so it will fallback to pointer emulation while touching
  (bsc#1167951, glgo#GNOME/gtk!1794).</changelog>
  <changelog author="fcrozat@suse.com" date="1623931200">- Add gtk3-fix-avahi-printers.patch: Ensure printers entries from
  Avahi are usable (bsc#1094486, bsc#1189238).</changelog>
</package>
<package pkgid="a45c0c239ea4daf387df8cb503993120c03203073e4534d72f386f525d9ddf1e" name="gettext-its-gtk3" arch="ppc64le">
  <version epoch="0" ver="3.24.20" rel="3.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1554984000">- Update to version 3.24.8:
  + Color editor: don't warn if editing is cancelled.
  + Always redraw on allocate - not doing so is not safe when any
    widget can have a background.
  + Use GLSL 3.30 for shaders.
  + Quartz: add a preliminary GdkGLContext implementation.
  + Win32: Fix a bug that prevented storing printer driver prefs.
  + Wayland: properly place window menus.
  + GtkApplication: support session state changes in sandboxes,
    using the inhibit portal.
  + Fix a problem with autostart notification.
  + Places: Show loop devices as reported by gvfs.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1556107200">- Disable LTO (boo#1133119).</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560859200">- Update to version 3.24.9:
  + GTK can now be built with the meson build system.
  + Wayland:
  - Support the xdg-output protocol for correct monitor sizes
    with scaled displays.
  - Fix handling of cursor hotspots that was reading
    uninitialized memory.
  - Update tablet cursors when scale changes.
  + CSS: Use multiple font-family values (bsc#1134059,
    glgo#GNOME/gtk#1854).
  + Emoji: Populate the Emoji chooser incrementally.
  + Printing: Require CUPS 1.7.
  + Scrolling: Add a gtk-overlay-scrolling setting that can be used
    to force traditional (non-overlay) scrollbars.
  + GtkTreeView:
  - Update rubberband rectangles more often.
  - Remove the pixel cache, to avoid the redraw issues that it
    causes.
  + Tooling: Support sysprof profiling.
  + Themes:
  - Adwaita: Small tweaks to the theme refresh.
  - Adwaita: Update treeview progress bars.
  - HighContrast: Improve notebook tabs.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562241600">- Update to version 3.24.10:
  + Make gtk_widget_get_action_group behave as documented.
  + Make gdk_screen_get_monitor_plug_name works as before.
  + Adwaita:
  - Update infobar look.
  - Fix some issues with submenus and popovers.
  + Wayland: Use the xdg-output protocol.
  + Fix build issues around cups.
  + Quartz: Build fixes.
  + treeview: Bring the pixel cache back, since its removal was
    causing problems in some applications.
  + Various documentation improvements.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567598400">- Update to version 3.24.11:
  + Adwaita:
  - Add drop shadow to icons.
  - Small color fixes.
  - Make title buttons round.
  + Wayland:
  - Support xdg-output v3.
  - Fix clipboard ownership handling.
  + X11: Improve monitor metadata.
  + Build: Require GLib 2.57.2.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 3.24.12:
  + file chooser: allow sorting by file type.
  + dnd: fix pointer offsets under X11 and Wayland.
  + broadway: Fix a font problem.
  + mir Drop this backend.
  + printing: Get PPD from original host if needed.
  + a11y: Fix interference with clutter a11y impl.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 3.24.12+32:
  + gdk: Do not change the windowing selection when cancelling
    source
  + Revert "gdk: Do not call gdk_selection_owner_set() internally
    to the backend"
  + gtkwidget: Ensure to run key controllers in the bubble phase
  + keycontroller: Fix ::key-released signal argument
  + key controller: Don't eat modifier events
  + gdk: Do not call gdk_selection_owner_set() internally to the
    backend
  + gdk: Shuffle the situations where a selection is unset
  + gtkwidget: Forward unhandled scroll events through controllers
- Switch to gitcheckout of stable branch, needed to get fixes for
  copy/paste between Xwayland and wayland programs.
- Following the above, add gtk-doc and libtool BuildRequires and
  pass autogen.sh to bootstrap and --enable-gtk-doc to configure.
- No longer disable LTO, current versions of gtk3 builds fine with
  it enabled.</changelog>
  <changelog author="idonmez@suse.com" date="1572609600">- Don't recommend -lang subpackage</changelog>
  <changelog author="fcrozat@suse.com" date="1574164800">- Add Obsoletes/Provides to baselibs.conf to ensure
  gtk3-immodules-tigrigna-32bit can be upgraded from old version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574856000">- Update to version 3.24.13+0:
  + Fix a11y test output
  + HighContrast: Add missing color to entry
  + themes: remove various @extend with compound selectors
  + Avoid Broadwayd - GtkEntry popup takes 35s after application
    startup.
  + Hide Objective-C from outside GdkQuartz.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1576065600">- Split API doc generation from main package using _multibuild,
  libgtk3 itself only takes a fraction of the time to build.</changelog>
  <changelog author="dimstar@opensuse.org" date="1578657600">- Move /usr/share/locale/en from the -lang package to the -data
  package: English is installed on all systems. This avoids
  gtk3-lang being triggered for installation on english-only
  systems.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581940800">- Update to version 3.24.14:
  + Fix the opaque region for windows on X11.
  + Theme:
  - Fix flat buttons in backdrop.
  - Make popovers look more similar to menus.
  - Tweak checkbox &amp; radiobutton appearance.
  - Add general typography classes (heading, title-1, etc).
  + Language bindings: Fix annotations for
    gtk_tree_model_sort_new_with_model.
  + Switch: Fix touch support.
  + Infobar: Make clickable for default action.
  + Emojichooser: Respect a no-emoji input hint.
  + Fontchooser: Fix an oversight with hiding the size label.
  + Filechooser: Disable recursive search without a system indexer.
  + Modelbutton: Fix a11y support to reflect button state.
  + Input: Fix touchpad gesture center calculation.
  + X11:
  - Fix root window scaling.
  - Support _GTK_WORKAREAS_Dn property.
  + Wayland:
  - Support a terminal purpose in input methods.
  - Fix preedit cursor positioning.
  - Fix enabling/disabling of text inputs.
  - Support simultaneous selection requests.
  - Require Wayland 1.14.91.
  + Printing: Fix a crash with Avahi.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585396800">- Update to version 3.24.16:
  + Fix the build.
- Changes from version 3.24.15:
  + filechooser:
  - Fix a crash.
  - Support selecting directories with a new enough file chooser
    portal.
  + textview: Speed up tag handling.
  + wayland:
  - Fix problems with clipboard handling.
  - Fix a crash in the Wayland input method.
  - Support cursor scale of 400%.
  - Fix a crash in glade.
  + css: Support font-feature-settings
  + Adwaita:
  - Use tabular figures where appropriate.
  - Color tweaks for dark mode.
  - Improve rendering of rounded corners.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1586001600">- Update to version 3.24.17:
  + GtkFileChooser: Fix some keynav issues.
  + GtkMenuButton: disable focus-on-click.
  + Derive the HighContrast and HighContrastInverse themes from
    Adwaita.
  + Wayland:
  - Fix firefox sizing problems.
  - Prevent Alt lingering after Alt-Tab.
  - Load compose sequences from ~/.Compose.
  - Fix a crash in the Wayland input method.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1586520000">- Update to version 3.24.18:
  + Wayland: Fix more sizing regressions in Epiphany and
    LibreOffice menus, and popups in general.
  + Build: Make resource build reproducible.
  + Updated translations.
- Disable autogeneration of .changes in service, we are currently
  using released tags so it is not needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1587988800">- Update to version 3.24.20:
  + GtkFileChooser:
  - Prevent selection changes after overwrite confirmation
  - Don't grab focus to the sidebar on click
  - Avoid a use-after-free in GtkFileSystemModel
  + GtkEmojiChooser: Remove blacklist
  + GtkAboutDialog: Add more licenses
  + Adwaita: Lower the contrast of checkboxes
  + HighContrast: Export the same public colors as Adwaita
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1591272000">- Add gtk3-x11-fix-menu-touch-by-pointer-emulation.patch: GtkMenu
  under X11 cannot work with touchscreen because it cannot handle
  touch events properly, this patch disable touch grabbing for it,
  so it will fallback to pointer emulation while touching
  (bsc#1167951, glgo#GNOME/gtk!1794).</changelog>
  <changelog author="fcrozat@suse.com" date="1623931200">- Add gtk3-fix-avahi-printers.patch: Ensure printers entries from
  Avahi are usable (bsc#1094486, bsc#1189238).</changelog>
</package>
<package pkgid="28182d97b8089ee27a2a1c1ba651717c63b22bff45071579eeefce8be48821d9" name="gettext-its-gtk3" arch="s390x">
  <version epoch="0" ver="3.24.20" rel="3.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1554984000">- Update to version 3.24.8:
  + Color editor: don't warn if editing is cancelled.
  + Always redraw on allocate - not doing so is not safe when any
    widget can have a background.
  + Use GLSL 3.30 for shaders.
  + Quartz: add a preliminary GdkGLContext implementation.
  + Win32: Fix a bug that prevented storing printer driver prefs.
  + Wayland: properly place window menus.
  + GtkApplication: support session state changes in sandboxes,
    using the inhibit portal.
  + Fix a problem with autostart notification.
  + Places: Show loop devices as reported by gvfs.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1556107200">- Disable LTO (boo#1133119).</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560859200">- Update to version 3.24.9:
  + GTK can now be built with the meson build system.
  + Wayland:
  - Support the xdg-output protocol for correct monitor sizes
    with scaled displays.
  - Fix handling of cursor hotspots that was reading
    uninitialized memory.
  - Update tablet cursors when scale changes.
  + CSS: Use multiple font-family values (bsc#1134059,
    glgo#GNOME/gtk#1854).
  + Emoji: Populate the Emoji chooser incrementally.
  + Printing: Require CUPS 1.7.
  + Scrolling: Add a gtk-overlay-scrolling setting that can be used
    to force traditional (non-overlay) scrollbars.
  + GtkTreeView:
  - Update rubberband rectangles more often.
  - Remove the pixel cache, to avoid the redraw issues that it
    causes.
  + Tooling: Support sysprof profiling.
  + Themes:
  - Adwaita: Small tweaks to the theme refresh.
  - Adwaita: Update treeview progress bars.
  - HighContrast: Improve notebook tabs.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562241600">- Update to version 3.24.10:
  + Make gtk_widget_get_action_group behave as documented.
  + Make gdk_screen_get_monitor_plug_name works as before.
  + Adwaita:
  - Update infobar look.
  - Fix some issues with submenus and popovers.
  + Wayland: Use the xdg-output protocol.
  + Fix build issues around cups.
  + Quartz: Build fixes.
  + treeview: Bring the pixel cache back, since its removal was
    causing problems in some applications.
  + Various documentation improvements.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567598400">- Update to version 3.24.11:
  + Adwaita:
  - Add drop shadow to icons.
  - Small color fixes.
  - Make title buttons round.
  + Wayland:
  - Support xdg-output v3.
  - Fix clipboard ownership handling.
  + X11: Improve monitor metadata.
  + Build: Require GLib 2.57.2.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 3.24.12:
  + file chooser: allow sorting by file type.
  + dnd: fix pointer offsets under X11 and Wayland.
  + broadway: Fix a font problem.
  + mir Drop this backend.
  + printing: Get PPD from original host if needed.
  + a11y: Fix interference with clutter a11y impl.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 3.24.12+32:
  + gdk: Do not change the windowing selection when cancelling
    source
  + Revert "gdk: Do not call gdk_selection_owner_set() internally
    to the backend"
  + gtkwidget: Ensure to run key controllers in the bubble phase
  + keycontroller: Fix ::key-released signal argument
  + key controller: Don't eat modifier events
  + gdk: Do not call gdk_selection_owner_set() internally to the
    backend
  + gdk: Shuffle the situations where a selection is unset
  + gtkwidget: Forward unhandled scroll events through controllers
- Switch to gitcheckout of stable branch, needed to get fixes for
  copy/paste between Xwayland and wayland programs.
- Following the above, add gtk-doc and libtool BuildRequires and
  pass autogen.sh to bootstrap and --enable-gtk-doc to configure.
- No longer disable LTO, current versions of gtk3 builds fine with
  it enabled.</changelog>
  <changelog author="idonmez@suse.com" date="1572609600">- Don't recommend -lang subpackage</changelog>
  <changelog author="fcrozat@suse.com" date="1574164800">- Add Obsoletes/Provides to baselibs.conf to ensure
  gtk3-immodules-tigrigna-32bit can be upgraded from old version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574856000">- Update to version 3.24.13+0:
  + Fix a11y test output
  + HighContrast: Add missing color to entry
  + themes: remove various @extend with compound selectors
  + Avoid Broadwayd - GtkEntry popup takes 35s after application
    startup.
  + Hide Objective-C from outside GdkQuartz.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1576065600">- Split API doc generation from main package using _multibuild,
  libgtk3 itself only takes a fraction of the time to build.</changelog>
  <changelog author="dimstar@opensuse.org" date="1578657600">- Move /usr/share/locale/en from the -lang package to the -data
  package: English is installed on all systems. This avoids
  gtk3-lang being triggered for installation on english-only
  systems.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581940800">- Update to version 3.24.14:
  + Fix the opaque region for windows on X11.
  + Theme:
  - Fix flat buttons in backdrop.
  - Make popovers look more similar to menus.
  - Tweak checkbox &amp; radiobutton appearance.
  - Add general typography classes (heading, title-1, etc).
  + Language bindings: Fix annotations for
    gtk_tree_model_sort_new_with_model.
  + Switch: Fix touch support.
  + Infobar: Make clickable for default action.
  + Emojichooser: Respect a no-emoji input hint.
  + Fontchooser: Fix an oversight with hiding the size label.
  + Filechooser: Disable recursive search without a system indexer.
  + Modelbutton: Fix a11y support to reflect button state.
  + Input: Fix touchpad gesture center calculation.
  + X11:
  - Fix root window scaling.
  - Support _GTK_WORKAREAS_Dn property.
  + Wayland:
  - Support a terminal purpose in input methods.
  - Fix preedit cursor positioning.
  - Fix enabling/disabling of text inputs.
  - Support simultaneous selection requests.
  - Require Wayland 1.14.91.
  + Printing: Fix a crash with Avahi.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585396800">- Update to version 3.24.16:
  + Fix the build.
- Changes from version 3.24.15:
  + filechooser:
  - Fix a crash.
  - Support selecting directories with a new enough file chooser
    portal.
  + textview: Speed up tag handling.
  + wayland:
  - Fix problems with clipboard handling.
  - Fix a crash in the Wayland input method.
  - Support cursor scale of 400%.
  - Fix a crash in glade.
  + css: Support font-feature-settings
  + Adwaita:
  - Use tabular figures where appropriate.
  - Color tweaks for dark mode.
  - Improve rendering of rounded corners.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1586001600">- Update to version 3.24.17:
  + GtkFileChooser: Fix some keynav issues.
  + GtkMenuButton: disable focus-on-click.
  + Derive the HighContrast and HighContrastInverse themes from
    Adwaita.
  + Wayland:
  - Fix firefox sizing problems.
  - Prevent Alt lingering after Alt-Tab.
  - Load compose sequences from ~/.Compose.
  - Fix a crash in the Wayland input method.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1586520000">- Update to version 3.24.18:
  + Wayland: Fix more sizing regressions in Epiphany and
    LibreOffice menus, and popups in general.
  + Build: Make resource build reproducible.
  + Updated translations.
- Disable autogeneration of .changes in service, we are currently
  using released tags so it is not needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1587988800">- Update to version 3.24.20:
  + GtkFileChooser:
  - Prevent selection changes after overwrite confirmation
  - Don't grab focus to the sidebar on click
  - Avoid a use-after-free in GtkFileSystemModel
  + GtkEmojiChooser: Remove blacklist
  + GtkAboutDialog: Add more licenses
  + Adwaita: Lower the contrast of checkboxes
  + HighContrast: Export the same public colors as Adwaita
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1591272000">- Add gtk3-x11-fix-menu-touch-by-pointer-emulation.patch: GtkMenu
  under X11 cannot work with touchscreen because it cannot handle
  touch events properly, this patch disable touch grabbing for it,
  so it will fallback to pointer emulation while touching
  (bsc#1167951, glgo#GNOME/gtk!1794).</changelog>
  <changelog author="fcrozat@suse.com" date="1623931200">- Add gtk3-fix-avahi-printers.patch: Ensure printers entries from
  Avahi are usable (bsc#1094486, bsc#1189238).</changelog>
</package>
<package pkgid="026f73f26b97b935090e5af9c41925f6b5dca1934214381b92c8ffa947c6490c" name="gettext-its-gtk3" arch="x86_64">
  <version epoch="0" ver="3.24.20" rel="3.6.1"/>
  <changelog author="bjorn.lie@gmail.com" date="1554984000">- Update to version 3.24.8:
  + Color editor: don't warn if editing is cancelled.
  + Always redraw on allocate - not doing so is not safe when any
    widget can have a background.
  + Use GLSL 3.30 for shaders.
  + Quartz: add a preliminary GdkGLContext implementation.
  + Win32: Fix a bug that prevented storing printer driver prefs.
  + Wayland: properly place window menus.
  + GtkApplication: support session state changes in sandboxes,
    using the inhibit portal.
  + Fix a problem with autostart notification.
  + Places: Show loop devices as reported by gvfs.
  + Updated translations.</changelog>
  <changelog author="mliska@suse.cz" date="1556107200">- Disable LTO (boo#1133119).</changelog>
  <changelog author="dimstar@opensuse.org" date="1557316800">- Move RPM macros to %_rpmmacrodir.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1560859200">- Update to version 3.24.9:
  + GTK can now be built with the meson build system.
  + Wayland:
  - Support the xdg-output protocol for correct monitor sizes
    with scaled displays.
  - Fix handling of cursor hotspots that was reading
    uninitialized memory.
  - Update tablet cursors when scale changes.
  + CSS: Use multiple font-family values (bsc#1134059,
    glgo#GNOME/gtk#1854).
  + Emoji: Populate the Emoji chooser incrementally.
  + Printing: Require CUPS 1.7.
  + Scrolling: Add a gtk-overlay-scrolling setting that can be used
    to force traditional (non-overlay) scrollbars.
  + GtkTreeView:
  - Update rubberband rectangles more often.
  - Remove the pixel cache, to avoid the redraw issues that it
    causes.
  + Tooling: Support sysprof profiling.
  + Themes:
  - Adwaita: Small tweaks to the theme refresh.
  - Adwaita: Update treeview progress bars.
  - HighContrast: Improve notebook tabs.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1562241600">- Update to version 3.24.10:
  + Make gtk_widget_get_action_group behave as documented.
  + Make gdk_screen_get_monitor_plug_name works as before.
  + Adwaita:
  - Update infobar look.
  - Fix some issues with submenus and popovers.
  + Wayland: Use the xdg-output protocol.
  + Fix build issues around cups.
  + Quartz: Build fixes.
  + treeview: Bring the pixel cache back, since its removal was
    causing problems in some applications.
  + Various documentation improvements.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1567598400">- Update to version 3.24.11:
  + Adwaita:
  - Add drop shadow to icons.
  - Small color fixes.
  - Make title buttons round.
  + Wayland:
  - Support xdg-output v3.
  - Fix clipboard ownership handling.
  + X11: Improve monitor metadata.
  + Build: Require GLib 2.57.2.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1570190400">- Update to version 3.24.12:
  + file chooser: allow sorting by file type.
  + dnd: fix pointer offsets under X11 and Wayland.
  + broadway: Fix a font problem.
  + mir Drop this backend.
  + printing: Get PPD from original host if needed.
  + a11y: Fix interference with clutter a11y impl.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1571832000">- Update to version 3.24.12+32:
  + gdk: Do not change the windowing selection when cancelling
    source
  + Revert "gdk: Do not call gdk_selection_owner_set() internally
    to the backend"
  + gtkwidget: Ensure to run key controllers in the bubble phase
  + keycontroller: Fix ::key-released signal argument
  + key controller: Don't eat modifier events
  + gdk: Do not call gdk_selection_owner_set() internally to the
    backend
  + gdk: Shuffle the situations where a selection is unset
  + gtkwidget: Forward unhandled scroll events through controllers
- Switch to gitcheckout of stable branch, needed to get fixes for
  copy/paste between Xwayland and wayland programs.
- Following the above, add gtk-doc and libtool BuildRequires and
  pass autogen.sh to bootstrap and --enable-gtk-doc to configure.
- No longer disable LTO, current versions of gtk3 builds fine with
  it enabled.</changelog>
  <changelog author="idonmez@suse.com" date="1572609600">- Don't recommend -lang subpackage</changelog>
  <changelog author="fcrozat@suse.com" date="1574164800">- Add Obsoletes/Provides to baselibs.conf to ensure
  gtk3-immodules-tigrigna-32bit can be upgraded from old version.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1574856000">- Update to version 3.24.13+0:
  + Fix a11y test output
  + HighContrast: Add missing color to entry
  + themes: remove various @extend with compound selectors
  + Avoid Broadwayd - GtkEntry popup takes 35s after application
    startup.
  + Hide Objective-C from outside GdkQuartz.</changelog>
  <changelog author="stefan.bruens@rwth-aachen.de" date="1576065600">- Split API doc generation from main package using _multibuild,
  libgtk3 itself only takes a fraction of the time to build.</changelog>
  <changelog author="dimstar@opensuse.org" date="1578657600">- Move /usr/share/locale/en from the -lang package to the -data
  package: English is installed on all systems. This avoids
  gtk3-lang being triggered for installation on english-only
  systems.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1581940800">- Update to version 3.24.14:
  + Fix the opaque region for windows on X11.
  + Theme:
  - Fix flat buttons in backdrop.
  - Make popovers look more similar to menus.
  - Tweak checkbox &amp; radiobutton appearance.
  - Add general typography classes (heading, title-1, etc).
  + Language bindings: Fix annotations for
    gtk_tree_model_sort_new_with_model.
  + Switch: Fix touch support.
  + Infobar: Make clickable for default action.
  + Emojichooser: Respect a no-emoji input hint.
  + Fontchooser: Fix an oversight with hiding the size label.
  + Filechooser: Disable recursive search without a system indexer.
  + Modelbutton: Fix a11y support to reflect button state.
  + Input: Fix touchpad gesture center calculation.
  + X11:
  - Fix root window scaling.
  - Support _GTK_WORKAREAS_Dn property.
  + Wayland:
  - Support a terminal purpose in input methods.
  - Fix preedit cursor positioning.
  - Fix enabling/disabling of text inputs.
  - Support simultaneous selection requests.
  - Require Wayland 1.14.91.
  + Printing: Fix a crash with Avahi.
  + Updated translations.</changelog>
  <changelog author="dimstar@opensuse.org" date="1585396800">- Update to version 3.24.16:
  + Fix the build.
- Changes from version 3.24.15:
  + filechooser:
  - Fix a crash.
  - Support selecting directories with a new enough file chooser
    portal.
  + textview: Speed up tag handling.
  + wayland:
  - Fix problems with clipboard handling.
  - Fix a crash in the Wayland input method.
  - Support cursor scale of 400%.
  - Fix a crash in glade.
  + css: Support font-feature-settings
  + Adwaita:
  - Use tabular figures where appropriate.
  - Color tweaks for dark mode.
  - Improve rendering of rounded corners.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1586001600">- Update to version 3.24.17:
  + GtkFileChooser: Fix some keynav issues.
  + GtkMenuButton: disable focus-on-click.
  + Derive the HighContrast and HighContrastInverse themes from
    Adwaita.
  + Wayland:
  - Fix firefox sizing problems.
  - Prevent Alt lingering after Alt-Tab.
  - Load compose sequences from ~/.Compose.
  - Fix a crash in the Wayland input method.
  + Updated translations.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1586520000">- Update to version 3.24.18:
  + Wayland: Fix more sizing regressions in Epiphany and
    LibreOffice menus, and popups in general.
  + Build: Make resource build reproducible.
  + Updated translations.
- Disable autogeneration of .changes in service, we are currently
  using released tags so it is not needed.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1587988800">- Update to version 3.24.20:
  + GtkFileChooser:
  - Prevent selection changes after overwrite confirmation
  - Don't grab focus to the sidebar on click
  - Avoid a use-after-free in GtkFileSystemModel
  + GtkEmojiChooser: Remove blacklist
  + GtkAboutDialog: Add more licenses
  + Adwaita: Lower the contrast of checkboxes
  + HighContrast: Export the same public colors as Adwaita
  + Updated translations.</changelog>
  <changelog author="alynx.zhou@suse.com" date="1591272000">- Add gtk3-x11-fix-menu-touch-by-pointer-emulation.patch: GtkMenu
  under X11 cannot work with touchscreen because it cannot handle
  touch events properly, this patch disable touch grabbing for it,
  so it will fallback to pointer emulation while touching
  (bsc#1167951, glgo#GNOME/gtk!1794).</changelog>
  <changelog author="fcrozat@suse.com" date="1623931200">- Add gtk3-fix-avahi-printers.patch: Ensure printers entries from
  Avahi are usable (bsc#1094486, bsc#1189238).</changelog>
</package>
<package pkgid="92132b83b46cf1d4a289604da701bc1c48b9b75ce42d4c26f11db1e8d3a65a40" name="gfs2-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="15c811a2bd7ec9609810d79015b4d7c125a865727a9badf39eccb3dc0e6110fd" name="gfs2-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="9d7343ee55fa45d0ecd515100422bed26d444e9bba62c27e06a956e9652d898e" name="gfs2-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="fbb76301f0e6d9344d2ef183bfc21206381b3b3517854f6fbc486fbe0d536fcc" name="gfs2-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="539210b2747b09aff3b6788b9e34a5a1a323ed05709f243b9b3173547f510cde" name="gfs2-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="de948629712b2876087e86cd5c9939d2489245d71c5351acfa2380f8a8dc462a" name="gfs2-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="ff0c8d9d3c3ec649a12d7f84fb1834c9065cedd8cd33de2bc80db495f89b0db7" name="gfs2-kmp-64kb" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="90c569fc708083d7960684b16e30215000aa2dea0b2a9a6f1fa07db1b19cba4c" name="gfs2-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.11.1"/>
  <changelog author="lduncan@suse.com" date="1625140800">- Blacklisted SCSI ufs core patch: way out of context.
- commit 33b89f4</changelog>
  <changelog author="glin@suse.com" date="1625140801">- bpfilter: Specify the log level for the kmsg message
  (bsc#1155518).
- commit a6b5aff</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140802">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch
  patches.suse/xfrm-policy-Read-seqcount-outside-of-rcu-read-side-i.patch
- commit fc2830a</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140803">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140804">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140805">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140806">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140807">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140808">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="bp@suse.de" date="1625140809">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="ohering@suse.de" date="1625227201">- x86/vdso: Mark the TSC clocksource path likely (bsc#1186071).
- hv_sock: Add the support of hibernation (bsc#1186071).
- hv_sock: set VMADDR_CID_HOST in the hvs_remote_addr_init()
  (bsc#1186071).
- hv_sock: use HV_HYP_PAGE_SIZE for Hyper-V communication
  (bsc#1186071).
- hv_sock: Use consistent types for UUIDs (bsc#1186071).
- commit e34e685</changelog>
  <changelog author="ohering@suse.de" date="1625227202">- x86/vdso: Move VDSO clocksource state tracking to callback (bsc#1186071).
- commit fc5b544</changelog>
  <changelog author="ohering@suse.de" date="1625227203">- hv_netvsc: Validate number of allocated sub-channels
  (bsc#1183682).
- drivers: hv: vmbus: Fix call msleep using &lt; 20ms (bsc#1186071).
- drivers: hv: vmbus: Fix checkpatch LINE_SPACING (bsc#1186071).
- drivers: hv: vmbus: Replace symbolic permissions by octal
  permissions (bsc#1186071).
- drivers: hv: Fix hyperv_record_panic_msg path on comment
  (bsc#1183682).
- hv_netvsc: Use vmbus_requestor to generate transaction IDs
  for VMBus hardening (bsc#1183682).
- scsi: storvsc: Use vmbus_requestor to generate transaction
  IDs for VMBus hardening (bsc#1183682).
- Drivers: hv: vmbus: Add vmbus_requestor data structure for
  VMBus hardening (bsc#1183682).
- x86/hyper-v: Add synthetic debugger definitions (bsc#1186071).
- asm-generic/hyperv: Add definitions for Get/SetVpRegister
  hypercalls (bsc#1186071).
- commit f79519d</changelog>
  <changelog author="ohering@suse.de" date="1625227204">- scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback() (bsc#1183682).
- commit e599609</changelog>
  <changelog author="ohering@suse.de" date="1625227205">- drivers/hv: remove obsolete TODO and fix misleading typo in
  comment (bsc#1186071).
- drivers: hv: vmbus: Fix checkpatch SPLIT_STRING (bsc#1186071).
- commit 9cc5e50</changelog>
  <changelog author="ohering@suse.de" date="1625227206">- Revert "scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback()" (bsc#1183682).
- commit fa61bc6</changelog>
  <changelog author="ohering@suse.de" date="1625227207">- PCI: hv: Drop msi_controller structure (bsc#1186071).
- hv_netvsc: Make netvsc/VF binding check both MAC and serial
  number (bsc#1186071).
- hv_netvsc: Add error handling while switching data path
  (bsc#1186071).
- hv_netvsc: Add a comment clarifying batching logic
  (bsc#1186071).
- scsi: storvsc: Enable scatterlist entry lengths &gt; 4Kbytes
  (bsc#1186071).
- scsi: storvsc: Parameterize number hardware queues
  (bsc#1186071).
- drivers: hv: Create a consistent pattern for checking Hyper-V
  hypercall status (bsc#1186071).
- x86/hyperv: Move hv_do_rep_hypercall to asm-generic
  (bsc#1186071).
- Drivers: hv: vmbus: Check for pending channel interrupts before
  taking a CPU offline (bsc#1186071).
- Drivers: hv: vmbus: Drivers: hv: vmbus: Introduce
  CHANNELMSG_MODIFYCHANNEL_RESPONSE (bsc#1186071).
- Drivers: hv: vmbus: Introduce and negotiate VMBus protocol
  version 5.3 (bsc#1186071).
- Drivers: hv: vmbus: remove unused function (bsc#1186071).
- Drivers: hv: vmbus: Remove unused linux/version.h header
  (bsc#1186071).
- x86/hyperv: remove unused linux/version.h header (bsc#1186071).
- x86/hyperv: Fix unused variable 'hi' warning in hv_apic_read
  (bsc#1186071).
- x86/hyperv: Fix unused variable 'msr_val' warning in
  hv_qlock_wait (bsc#1186071).
- hv: hyperv.h: a few mundane typo fixes (bsc#1186071).
- drivers: hv: Fix EXPORT_SYMBOL and tab spaces issue
  (bsc#1186071).
- Drivers: hv: vmbus: Drop error message when 'No request id
  available' (bsc#1183682).
- asm-generic/hyperv: Add missing function prototypes per -W1
  warnings (bsc#1186071).
- clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts
  (bsc#1186071).
- clocksource/drivers/hyper-v: Set clocksource rating based on
  Hyper-V feature (bsc#1186071).
- clocksource/drivers/hyper-v: Handle sched_clock differences
  inline (bsc#1186071).
- Drivers: hv: vmbus: Move handling of VMbus interrupts
  (bsc#1186071).
- Drivers: hv: vmbus: Handle auto EOI quirk inline (bsc#1186071).
- Drivers: hv: vmbus: Move hyperv_report_panic_msg to arch
  neutral code (bsc#1186071).
- Drivers: hv: Redo Hyper-V synthetic MSR get/set functions
  (bsc#1186071).
- x86/hyper-v: Move hv_message_type to architecture neutral module
  (bsc#1186071).
- Drivers: hv: vmbus: Move Hyper-V page allocator to arch neutral
  code (bsc#1186071).
- hv_netvsc: Fix validation in netvsc_linkstatus_callback()
  (bsc#1183682).
- PCI: hv: Fix typo (bsc#1186071).
- scsi: storvsc: Return DID_ERROR for invalid commands
  (bsc#1186071).
- scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback() (bsc#1183682).
- scsi: storvsc: Resolve data race in storvsc_probe()
  (bsc#1183682).
- scsi: storvsc: Fix max_outstanding_req_per_channel for Win8
  and newer (bsc#1186071).
- Revert "Drivers: hv: vmbus: Copy packets sent by Hyper-V out
  of the ring buffer" (bsc#1186071).
- iommu/hyperv: setup an IO-APIC IRQ remapping domain for root
  partition (bsc#1186071).
- x86/hyperv: implement an MSI domain for root partition
  (bsc#1186071).
- asm-generic/hyperv: import data structures for mapping device
  interrupts (bsc#1186071).
- asm-generic/hyperv: introduce hv_device_id and auxiliary
  structures (bsc#1186071).
- asm-generic/hyperv: update hv_interrupt_entry (bsc#1186071).
- asm-generic/hyperv: update hv_msi_entry (bsc#1186071).
- x86/hyperv: implement and use hv_smp_prepare_cpus (bsc#1186071).
- x86/hyperv: provide a bunch of helper functions (bsc#1186071).
- x86/hyperv: handling hypercall page setup for root
  (bsc#1186071).
- x86/hyperv: extract partition ID from Microsoft Hypervisor if
  necessary (bsc#1186071).
- x86/hyperv: allocate output arg pages if required (bsc#1186071).
- clocksource/hyperv: use MSR-based access if running as root
  (bsc#1186071).
- Drivers: hv: vmbus: skip VMBus initialization if Linux is root
  (bsc#1186071).
- x86/hyperv: detect if Linux is the root partition (bsc#1186071).
- asm-generic/hyperv: change HV_CPU_POWER_MANAGEMENT to
  HV_CPU_MANAGEMENT (bsc#1186071).
- hv: hyperv.h: Replace one-element array with flexible-array
  in struct icmsg_negotiate (bsc#1186071).
- hv_netvsc: Restrict configurations on isolated guests
  (bsc#1183682).
- Drivers: hv: vmbus: Enforce 'VMBus version &gt;= 5.2' on isolated
  guests (bsc#1183682).
- Drivers: hv: vmbus: Restrict vmbus_devices on isolated guests
  (bsc#1183682).
- x86/hyperv: Load/save the Isolation Configuration leaf
  (bsc#1183682).
- hv_utils: Fix spelling mistake "Hearbeat" -&gt; "Heartbeat"
  (bsc#1186071).
- Drivers: hv: vmbus: Add /sys/bus/vmbus/hibernation
  (bsc#1186071).
- Drivers: hv: vmbus: Resolve race condition in
  vmbus_onoffer_rescind() (bsc#1183682).
- Drivers: hv: vmbus: Copy the hv_message in vmbus_on_msg_dpc()
  (bsc#1183682).
- Drivers: hv: vmbus: Reduce number of references to message in
  vmbus_on_msg_dpc() (bsc#1183682).
- Drivers: hv: vmbus: Initialize memory to be sent to the host
  (bsc#1183682).
- hv_utils: Add validation for untrusted Hyper-V values
  (bsc#1183682).
- Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the
  ring buffer (bsc#1183682).
- hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet
  info (bsc#1183682).
- hv_netvsc: Allocate the recv_buf buffers after
  NVSP_MSG1_TYPE_SEND_RECV_BUF (bsc#1183682).
- hv_netvsc: Copy packets sent by Hyper-V out of the receive
  buffer (bsc#1183682).
- hv_netvsc: Add (more) validation for untrusted Hyper-V values
  (bsc#1183682).
- hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
  (bsc#1186071).
- hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
  (bsc#1186071).
- hv_netvsc: Check VF datapath when sending traffic to VF
  (bsc#1183682).
- vsock: fix locking in vsock_shutdown() (bsc#1186071).
- x86/hyperv: check cpu mask after interrupt has been disabled
  (bsc#1186071).
- use __netdev_notify_peers in hyperv (bsc#1186071).
- hv_balloon: do adjust_managed_page_count() when
  ballooning/un-ballooning (bsc#1186071).
- hv_balloon: simplify math in alloc_balloon_pages()
  (bsc#1186071).
- commit 8aa7b0a</changelog>
  <changelog author="ohering@suse.de" date="1625227208">- x86/hyperv: fix logical processor creation (bsc#1186071).
- commit 3182d1d</changelog>
  <changelog author="bp@suse.de" date="1625486400">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
</package>
<package pkgid="7658137c2d7c297f66ff302ce97c1be172e7fb1dc64d9f1b3a58b0eba0c6a305" name="gfs2-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.14.1"/>
  <changelog author="ohering@suse.de" date="1625227200">- scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback() (bsc#1183682).
- commit e599609</changelog>
  <changelog author="ohering@suse.de" date="1625227201">- drivers/hv: remove obsolete TODO and fix misleading typo in
  comment (bsc#1186071).
- drivers: hv: vmbus: Fix checkpatch SPLIT_STRING (bsc#1186071).
- commit 9cc5e50</changelog>
  <changelog author="ohering@suse.de" date="1625227202">- Revert "scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback()" (bsc#1183682).
- commit fa61bc6</changelog>
  <changelog author="ohering@suse.de" date="1625227203">- PCI: hv: Drop msi_controller structure (bsc#1186071).
- hv_netvsc: Make netvsc/VF binding check both MAC and serial
  number (bsc#1186071).
- hv_netvsc: Add error handling while switching data path
  (bsc#1186071).
- hv_netvsc: Add a comment clarifying batching logic
  (bsc#1186071).
- scsi: storvsc: Enable scatterlist entry lengths &gt; 4Kbytes
  (bsc#1186071).
- scsi: storvsc: Parameterize number hardware queues
  (bsc#1186071).
- drivers: hv: Create a consistent pattern for checking Hyper-V
  hypercall status (bsc#1186071).
- x86/hyperv: Move hv_do_rep_hypercall to asm-generic
  (bsc#1186071).
- Drivers: hv: vmbus: Check for pending channel interrupts before
  taking a CPU offline (bsc#1186071).
- Drivers: hv: vmbus: Drivers: hv: vmbus: Introduce
  CHANNELMSG_MODIFYCHANNEL_RESPONSE (bsc#1186071).
- Drivers: hv: vmbus: Introduce and negotiate VMBus protocol
  version 5.3 (bsc#1186071).
- Drivers: hv: vmbus: remove unused function (bsc#1186071).
- Drivers: hv: vmbus: Remove unused linux/version.h header
  (bsc#1186071).
- x86/hyperv: remove unused linux/version.h header (bsc#1186071).
- x86/hyperv: Fix unused variable 'hi' warning in hv_apic_read
  (bsc#1186071).
- x86/hyperv: Fix unused variable 'msr_val' warning in
  hv_qlock_wait (bsc#1186071).
- hv: hyperv.h: a few mundane typo fixes (bsc#1186071).
- drivers: hv: Fix EXPORT_SYMBOL and tab spaces issue
  (bsc#1186071).
- Drivers: hv: vmbus: Drop error message when 'No request id
  available' (bsc#1183682).
- asm-generic/hyperv: Add missing function prototypes per -W1
  warnings (bsc#1186071).
- clocksource/drivers/hyper-v: Move handling of STIMER0 interrupts
  (bsc#1186071).
- clocksource/drivers/hyper-v: Set clocksource rating based on
  Hyper-V feature (bsc#1186071).
- clocksource/drivers/hyper-v: Handle sched_clock differences
  inline (bsc#1186071).
- Drivers: hv: vmbus: Move handling of VMbus interrupts
  (bsc#1186071).
- Drivers: hv: vmbus: Handle auto EOI quirk inline (bsc#1186071).
- Drivers: hv: vmbus: Move hyperv_report_panic_msg to arch
  neutral code (bsc#1186071).
- Drivers: hv: Redo Hyper-V synthetic MSR get/set functions
  (bsc#1186071).
- x86/hyper-v: Move hv_message_type to architecture neutral module
  (bsc#1186071).
- Drivers: hv: vmbus: Move Hyper-V page allocator to arch neutral
  code (bsc#1186071).
- hv_netvsc: Fix validation in netvsc_linkstatus_callback()
  (bsc#1183682).
- PCI: hv: Fix typo (bsc#1186071).
- scsi: storvsc: Return DID_ERROR for invalid commands
  (bsc#1186071).
- scsi: storvsc: Validate length of incoming packet in
  storvsc_on_channel_callback() (bsc#1183682).
- scsi: storvsc: Resolve data race in storvsc_probe()
  (bsc#1183682).
- scsi: storvsc: Fix max_outstanding_req_per_channel for Win8
  and newer (bsc#1186071).
- Revert "Drivers: hv: vmbus: Copy packets sent by Hyper-V out
  of the ring buffer" (bsc#1186071).
- iommu/hyperv: setup an IO-APIC IRQ remapping domain for root
  partition (bsc#1186071).
- x86/hyperv: implement an MSI domain for root partition
  (bsc#1186071).
- asm-generic/hyperv: import data structures for mapping device
  interrupts (bsc#1186071).
- asm-generic/hyperv: introduce hv_device_id and auxiliary
  structures (bsc#1186071).
- asm-generic/hyperv: update hv_interrupt_entry (bsc#1186071).
- asm-generic/hyperv: update hv_msi_entry (bsc#1186071).
- x86/hyperv: implement and use hv_smp_prepare_cpus (bsc#1186071).
- x86/hyperv: provide a bunch of helper functions (bsc#1186071).
- x86/hyperv: handling hypercall page setup for root
  (bsc#1186071).
- x86/hyperv: extract partition ID from Microsoft Hypervisor if
  necessary (bsc#1186071).
- x86/hyperv: allocate output arg pages if required (bsc#1186071).
- clocksource/hyperv: use MSR-based access if running as root
  (bsc#1186071).
- Drivers: hv: vmbus: skip VMBus initialization if Linux is root
  (bsc#1186071).
- x86/hyperv: detect if Linux is the root partition (bsc#1186071).
- asm-generic/hyperv: change HV_CPU_POWER_MANAGEMENT to
  HV_CPU_MANAGEMENT (bsc#1186071).
- hv: hyperv.h: Replace one-element array with flexible-array
  in struct icmsg_negotiate (bsc#1186071).
- hv_netvsc: Restrict configurations on isolated guests
  (bsc#1183682).
- Drivers: hv: vmbus: Enforce 'VMBus version &gt;= 5.2' on isolated
  guests (bsc#1183682).
- Drivers: hv: vmbus: Restrict vmbus_devices on isolated guests
  (bsc#1183682).
- x86/hyperv: Load/save the Isolation Configuration leaf
  (bsc#1183682).
- hv_utils: Fix spelling mistake "Hearbeat" -&gt; "Heartbeat"
  (bsc#1186071).
- Drivers: hv: vmbus: Add /sys/bus/vmbus/hibernation
  (bsc#1186071).
- Drivers: hv: vmbus: Resolve race condition in
  vmbus_onoffer_rescind() (bsc#1183682).
- Drivers: hv: vmbus: Copy the hv_message in vmbus_on_msg_dpc()
  (bsc#1183682).
- Drivers: hv: vmbus: Reduce number of references to message in
  vmbus_on_msg_dpc() (bsc#1183682).
- Drivers: hv: vmbus: Initialize memory to be sent to the host
  (bsc#1183682).
- hv_utils: Add validation for untrusted Hyper-V values
  (bsc#1183682).
- Drivers: hv: vmbus: Copy packets sent by Hyper-V out of the
  ring buffer (bsc#1183682).
- hv_netvsc: Load and store the proper (NBL_HASH_INFO) per-packet
  info (bsc#1183682).
- hv_netvsc: Allocate the recv_buf buffers after
  NVSP_MSG1_TYPE_SEND_RECV_BUF (bsc#1183682).
- hv_netvsc: Copy packets sent by Hyper-V out of the receive
  buffer (bsc#1183682).
- hv_netvsc: Add (more) validation for untrusted Hyper-V values
  (bsc#1183682).
- hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove
  (bsc#1186071).
- hv_netvsc: Wait for completion on request SWITCH_DATA_PATH
  (bsc#1186071).
- hv_netvsc: Check VF datapath when sending traffic to VF
  (bsc#1183682).
- vsock: fix locking in vsock_shutdown() (bsc#1186071).
- x86/hyperv: check cpu mask after interrupt has been disabled
  (bsc#1186071).
- use __netdev_notify_peers in hyperv (bsc#1186071).
- hv_balloon: do adjust_managed_page_count() when
  ballooning/un-ballooning (bsc#1186071).
- hv_balloon: simplify math in alloc_balloon_pages()
  (bsc#1186071).
- commit 8aa7b0a</changelog>
  <changelog author="ohering@suse.de" date="1625227204">- x86/hyperv: fix logical processor creation (bsc#1186071).
- commit 3182d1d</changelog>
  <changelog author="dwagner@suse.de" date="1625227205">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227206">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227207">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227208">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227209">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="24fd562619a34458077e5ed989b35e47927f4162dc2686c18bce4d7f5d7f8bdc" name="gfs2-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.17.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="099802e3e414a1301958398d624cc4463e07cee01fca5885c217073e167525d8" name="gfs2-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.22.2"/>
  <changelog author="msuchanek@suse.de" date="1631188800">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188802">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- commit 561fbd8</changelog>
  <changelog author="mkoutny@suse.com" date="1631534407">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="f382186591ae429135450d383e716bd9bc0bf8d07be4b15b69f2c15b40cc52d8" name="gfs2-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.25.2"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="f2788c3dbabdbb29f54a12f2aa69a15a2bb20c238b502a026885f8209a49b4e8" name="gfs2-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.28.2"/>
  <changelog author="dwagner@suse.de" date="1635422400">- nvme-pci: fix error unwind in nvme_map_data (bsc#1191934).
- nvme-pci: refactor nvme_unmap_data (bsc#1191934).
- commit 3a9d8cd</changelog>
  <changelog author="dwagner@suse.de" date="1635422401">- nvme-pci: fix error unwind in nvme_map_data (bsc#1191934).
- nvme-pci: refactor nvme_unmap_data (bsc#1191934).
- commit fc21d20</changelog>
  <changelog author="tiwai@suse.de" date="1635422402">- Update patch reference for ISDN fix (CVE-2021-3896 bsc#1191958)
- commit b1524c3</changelog>
  <changelog author="msuchanek@suse.de" date="1635422403">- powerpc/idle: Don't corrupt back chain when going idle
  (bko#206669 bsc#1174585 bsc#1192107 CVE-2021-43056).
- KVM: PPC: Book3S HV: Make idle_kvm_start_guest() return
  0 if it went to guest (bko#206669 bsc#1174585 bsc#1192107
  CVE-2021-43056).
- KVM: PPC: Book3S HV: Fix stack handling in
  idle_kvm_start_guest() (bko#206669 bsc#1174585 bsc#1192107
  CVE-2021-43056).
- powerpc64/idle: Fix SP offsets when saving GPRs (bko#206669
  bsc#1174585 bsc#1192107 CVE-2021-43056).
- commit 90745c9</changelog>
  <changelog author="mkubecek@suse.cz" date="1635508800">- sctp: add param size validation for SCTP_PARAM_SET_PRIMARY
  (CVE-2021-3655 bsc#1188563).
- sctp: validate chunk size in __rcv_asconf_lookup (CVE-2021-3655
  bsc#1188563).
- sctp: add size validation when walking chunks (CVE-2021-3655
  bsc#1188563).
- commit e419503</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1635508801">- netfilter: xt_IDLETIMER: fix panic that occurs when timer_type
  has garbage value (bsc#1176447).
- ice: fix getting UDP tunnel entry (jsc#SLE-12878).
- net/mlx5: E-Switch, Fix double allocation of acl flow counter
  (jsc#SLE-15172).
- net/mlx5e: IPSEC RX, enable checksum complete (jsc#SLE-15172).
- RDMA/cma: Do not change route.addr.src_addr.ss_family
  (bsc#1181147).
- RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
  (bsc#1181147).
- net: hns3: check queue id range before using (jsc#SLE-14777).
- bnxt_en: make bnxt_free_skbs() safe to call after
  bnxt_free_mem() (jsc#SLE-16649).
- ice: Only lock to update netdev dev_addr (git-fixes).
- net/sched: ets: fix crash when flipping from 'strict' to
  'quantum' (bsc#1176774).
- net/mlx5e: RX, Avoid possible data corruption when relaxed
  ordering and LRO combined (jsc#SLE-15172).
- commit 016bdb7</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1635508802">- ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
  (git-fixes).
- commit c406ead</changelog>
  <changelog author="tiwai@suse.de" date="1635508803">- net: lan78xx: fix division by zero in send path (git-fixes).
- net: batman-adv: fix error handling (git-fixes).
- nfc: port100: fix using -ERRNO as command type mask (git-fixes).
- cfg80211: scan: fix RCU in cfg80211_add_nontrans_list()
  (git-fixes).
- regmap: Fix possible double-free in regcache_rbtree_exit()
  (git-fixes).
- commit 1fb45c2</changelog>
  <changelog author="tiwai@suse.de" date="1635508804">- cfg80211: correct bridge/4addr mode check (git-fixes).
- cfg80211: fix management registrations locking (git-fixes).
- commit 38a77a6</changelog>
  <changelog author="tiwai@suse.de" date="1635508805">- kABI workaround for cfg80211 mgmt_registration_lock changes
  (git-fixes).
- commit 85ca292</changelog>
  <changelog author="dwagner@suse.de" date="1635508806">- scsi: lpfc: Update lpfc version to 14.0.0.3 (bsc#1192145).
- scsi: lpfc: Allow fabric node recovery if recovery is in
  progress before devloss (bsc#1192145).
- scsi: lpfc: Fix link down processing to address NULL pointer
  dereference (bsc#1192145).
- scsi: lpfc: Allow PLOGI retry if previous PLOGI was aborted
  (bsc#1192145).
- scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine
  (bsc#1192145).
- scsi: lpfc: Correct sysfs reporting of loop support after SFP
  status change (bsc#1192145).
- scsi: lpfc: Wait for successful restart of SLI3 adapter during
  host sg_reset (bsc#1192145).
- scsi: lpfc: Revert LOG_TRACE_EVENT back to LOG_INIT prior to
  driver_resource_setup() (bsc#1192145).
- commit ea0ad63</changelog>
  <changelog author="tiwai@suse.de" date="1635595200">- mmc: vub300: fix control-message timeouts (git-fixes).
- mmc: dw_mmc: exynos: fix the finding clock sample value
  (git-fixes).
- commit 15296ab</changelog>
  <changelog author="mkubecek@suse.cz" date="1635768000">- sctp: add vtag check in sctp_sf_ootb (CVE-2021-3772
  bsc#1190351).
- sctp: add vtag check in sctp_sf_do_8_5_1_E_sa (CVE-2021-3772
  bsc#1190351).
- sctp: add vtag check in sctp_sf_violation (CVE-2021-3772
  bsc#1190351).
- sctp: fix the processing for COOKIE_ECHO chunk (CVE-2021-3772
  bsc#1190351).
- sctp: fix the processing for INIT_ACK chunk (CVE-2021-3772
  bsc#1190351).
- sctp: fix the processing for INIT chunk (CVE-2021-3772
  bsc#1190351).
- sctp: use init_tag from inithdr for ABORT chunk (CVE-2021-3772
  bsc#1190351).
- sctp: check asoc peer.asconf_capable before processing asconf
  (bsc#1190351).
- commit c4ecd47</changelog>
  <changelog author="msuchanek@suse.de" date="1635768001">- KVM: PPC: Book3S HV: Save host FSCR in the P7/8 path
  (bsc#1065729).
- commit 4a60f84</changelog>
  <changelog author="bp@suse.de" date="1635768002">- x86/pat: Pass valid address to sanitize_phys() (bsc#1152489).
- commit 1702f6b</changelog>
  <changelog author="msuchanek@suse.de" date="1635768003">- powerpc/64s: Remove irq mask workaround in
  accumulate_stolen_time() (jsc#SLE-9246 git-fixes).
- commit 5f2cf7e</changelog>
  <changelog author="msuchanek@suse.de" date="1635768004">- powerpc/xive: Discard disabled interrupts in get_irqchip_state()
  (fate#322438 bsc#1085030 git-fixes).
- commit 3106974</changelog>
  <changelog author="msuchanek@suse.de" date="1635768005">- KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode
  changing registers (bsc#1156395).
- KVM: PPC: Fix clearing never mapped TCEs in realmode
  (bsc#1156395).
- KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0
  when guest SPRs are live (bsc#1156395).
- KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state
  (bsc#1156395).
- KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak (bsc#1156395).
- commit 2ce76cc</changelog>
  <changelog author="mkubecek@suse.cz" date="1635768006">- ipv6/netfilter: Discard first fragment not including all headers
  (bsc#1191241).
- IPv6: reply ICMP error if the first fragment don't include
  all headers (bsc#1191241).
- ICMPv6: Add ICMPv6 Parameter Problem, code 3 definition
  (bsc#1191241).
- net: ipv6: Discard next-hop MTU less than minimum link MTU
  (bsc#1191241).
- commit c74316d</changelog>
  <changelog author="mkubecek@suse.cz" date="1635768007">- netfilter: conntrack: collect all entries in one cycle
  (bsc#1173604).
- commit c4117de</changelog>
</package>
<package pkgid="a938fc7157f124ccc19b5051a1a298aa648d11a70c999adaa5da13b693a50302" name="gfs2-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.3.1"/>
  <changelog author="hare@suse.de" date="1622462400">- nvme-pci: use simple suspend when a HMB is enabled (git-fixes).
- nvme-pci: make sure write/poll_queues less or equal then cpu
  (git-fixes).
- nvme-pci: align io queue count with allocted nvme_queue in
  (git-fixes).
- nvme-pci: remove last_sq_tail (git-fixes).
- nvme-pci: remove volatile cqes (git-fixes).
- nvme-pci: avoid race between nvme_reap_pending_cqes() and
  nvme_poll() (git-fixes).
- nvme-pci: dma read memory barrier for completions (git-fixes).
- nvme-pci: fix "slimmer CQ head update" (git-fixes).
- nvme-pci: Simplify nvme_poll_irqdisable (git-fixes).
- nvme-pci: Remove two-pass completions (git-fixes).
- nvme-pci: Remove tag from process cq (git-fixes).
- nvme-pci: slimmer CQ head update (git-fixes).
- commit dd74a78</changelog>
  <changelog author="hare@suse.de" date="1622462401">- nvme: document nvme controller states (git-fixes).
- commit 495f482</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- blacklist.conf: arm64: add fix for unsupported SOC
- commit 7c4e5f6</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- arm64: vdso32: make vdso32 install conditional (git-fixes).
- commit de92552</changelog>
  <changelog author="hare@suse.de" date="1622462405">- nvme: fix deadlock in disconnect during scan_work and/or
  ana_work (git-fixes).
- Refresh
  patches.suse/nvme-fabrics-reject-I-O-to-offline-device.patch.
- commit 4805fdc</changelog>
  <changelog author="varad.gautam@suse.com" date="1622462406">- series.conf: cleanup
  update upstream references and resort:
  patches.suse/ipc-mqueue-msg-sem-Avoid-relying-on-a-stack-reference.patch
- commit a8331c9</changelog>
  <changelog author="ykaukab@suse.de" date="1622462407">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462408">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462409">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="bp@suse.de" date="1622462410">- x86/cpu: Initialize MSR_TSC_AUX if RDTSCP *or* RDPID is
  supported (bsc#1152489).
- commit 1931741</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="hare@suse.de" date="1622548801">- block/genhd: use atomic_t for disk_event-&gt;block (bsc#1185497).
- commit 57427b3</changelog>
  <changelog author="oneukum@suse.com" date="1622548802">- nxp-nci: add NXP1002 id (bsc#1185589).
- commit 9d43526</changelog>
  <changelog author="oneukum@suse.com" date="1622548803">- nxp-i2c: restore includes for kABI (bsc#1185589).
- commit 1786af1</changelog>
  <changelog author="msuchanek@suse.de" date="1622548804">- Refresh patches.suse/scsi-ibmvfc-Reinit-target-retries.patch.
  Update patch metadata.
- commit e269098</changelog>
  <changelog author="mkubecek@suse.cz" date="1622548805">- series.conf: cleanup
- move unsortable patch out of sorted section
  patches.suse/nxp-nci-add-NXP1002-id.patch
- commit d0ca1ba</changelog>
  <changelog author="dwagner@suse.de" date="1622548806">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
  Refresh:
  - patches.suse/nvme-multipath-retry-commands-for-dying-queues.patch
- commit f0fe006</changelog>
  <changelog author="dwagner@suse.de" date="1622548807">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="c37f2b7c536d852baf7098799169a400f4831db7e49a278738bfbcca92582b96" name="gfs2-kmp-azure" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="38.8.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="8bfdef33886e9b3cf6f509c40cf9846e70365bd2daddde14c56d62154316d8b8" name="gfs2-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="d08a0fe3d4cdb5c888dfe94618fd6849452cb372e43337ca2f7abbfc919ccce0" name="gfs2-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="690246c0142f904f345b5402f061489deec6cc0797127fe541b9e77684333d17" name="gfs2-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="615252e15a0c1a4fc769a06b5a4b86e5b4a534a34a81ccdd0910308cf3805ed1" name="gfs2-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="383777fb02f1f93f8a117edc85410f24ce2d8115d18a0244ecfab9b7e6d765a8" name="gfs2-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="ba6d04c54c1df8904987d6cb51f56b1f1796704b9b491ea732ddf421b0d695aa" name="gfs2-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="627ed4e8a34d857bcc0500356483267daf33341121cc172fc6a832e518df3d77" name="gfs2-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="310b9de840006f83d230be338d01f54e7b6d0d6c30fc466e75718b6fa2e1f832" name="gfs2-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="7222d48964038e47dba950129e53abb1bf67fc3c5e1d26945bb597d33ed57af3" name="gfs2-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="2fe632ee76cab2e65901ebc4165c24f54ab7b120d5a93c0f9b79a11646723f82" name="gfs2-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="b81c4e6561a4eb5c8a6cff347cf5f4057bda39b992f9a90d49a504e7dbf84905" name="gfs2-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="5e59c05260aef2c4eec7174bd3033da7c4ea49f045a666ba05e5e0510b0ef7e2" name="gfs2-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="7d50932cc9b58477f0833341d09a99ea87a936fc766582135f5fdf8de46899df" name="gfs2-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="15b5a068191a0edfd16f96b4db6e507ecfe77f9b8ee83e91ef3c501fbba27121" name="gfs2-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="208a61b89a0b393de4bc7d1ec6ad7b35ea91978ddf148acc394d086189eebbe6" name="gfs2-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="a82f9e15401b8e2292e84426784851f8ea1f2205d2040b6d63c7d0e52545646f" name="gfs2-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="920cc564810f5acf33b2f03db99c67f220ac18d05d7341c45179887652373b86" name="gfs2-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="fe197a1bd979f8d3eb5d24e3789c855f9cee92a4754bfd5175410aaf4978b415" name="gfs2-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="94f80cc6b2e8dfc881c3dde327c26a44b3ec1b633daa021972c44b5b26ee27a3" name="gfs2-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="7121aaaee833da26fefbe9e3d5e22a338382f7829da849daed733b56f394617f" name="gfs2-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="c72303e782262c35f718693ec9c348664b8dd30ef37094923566ae3119c4eeca" name="gfs2-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="2dc12cd8c8437a1674ec86850d8f0a69887305f44f4727cff9386b5153a6927a" name="gfs2-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="414bb81aab4ca147a4b4b45e24be1e6e01b91e53184ad2619b35aa6e42ac54c7" name="gfs2-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="893e51c576e997e153fca3f88399e29b01f11abb1db86d6999421a312795dc90" name="gfs2-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="885dcbfb82ea72cac5a52ee380c0bae606da59c028b9d067b8f38786ad367d13" name="gfs2-kmp-default" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="470530f5e572c01b3d5626cd0bdb10e60bcba918f8e0022359c7e862d28a446a" name="gfs2-kmp-default" arch="ppc64le">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="06aeb60c6f566d49e73e17f5e95eb663a07ee12eafde5635551440748f8c0597" name="gfs2-kmp-default" arch="s390x">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="7f79db1ba2f68fe2d4efdeb61f228bc2f4effc565ae1f1172dcb8e33a88f3fbd" name="gfs2-kmp-default" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="b5d573d01e8f5cd649d003079c2deccff7fbf966679d658657619770cf179bc4" name="gfs2-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="a465a3f20d1662368e5453ea566fb33d1f29a1110b5724ab8350e5a17dd42d98" name="gfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.10.1"/>
  <changelog author="tiwai@suse.de" date="1623672000">- kABI workaround for rtw88 (git-fixes).
- commit 8a7edfc</changelog>
  <changelog author="tiwai@suse.de" date="1623672001">- efi/libstub: prevent read overflow in find_file_option()
  (git-fixes).
- commit 9d1183c</changelog>
  <changelog author="lhenriques@suse.de" date="1623672002">- blacklist: add commit 4f06dd92b5d0 ("fuse: fix write deadlock")
  This is an ancient bug (from v2.6.26) which require extra backports.  Not
  worth the risk introducing new regressions.
- commit f0ede60</changelog>
  <changelog author="bp@suse.de" date="1623672003">- x86/cpufeatures: Force disable X86_FEATURE_ENQCMD and remove
  update_pasid() (bsc#1178134).
- commit 08621e3</changelog>
  <changelog author="mkubecek@suse.cz" date="1623672004">- series.conf: cleanup
  Move a queued patch to "almost mainline" section.
- commit a847492</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758400">- fix patch metadata
- fix Patch-mainline:
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
- commit c80eef0</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758401">- series.conf: cleanup
  Move a SUSE specific patch ("Patch-mainline: Never...") to corresponding
  per-subsystem section.
- commit 811dc9a</changelog>
  <changelog author="mkubecek@suse.cz" date="1623758402">- series.conf: cleanup
- update upstream references and move into sorted section:
  patches.suse/mac80211-add-fragment-cache-to-sta_info.patch
  patches.suse/mac80211-assure-all-fragments-are-encrypted.patch
  patches.suse/mac80211-check-defrag-PN-against-current-frame.patch
  patches.suse/mac80211-do-not-accept-forward-invalid-EAPOL-frames.patch
  patches.suse/mac80211-drop-A-MSDUs-on-old-ciphers.patch
  patches.suse/mac80211-extend-protection-against-mixed-key-and-fra.patch
  patches.suse/mac80211-prevent-attacks-on-TKIP-WEP-as-well.patch
  patches.suse/mac80211-prevent-mixed-key-and-fragment-cache-attack.patch
  patches.suse/mac80211-properly-handle-A-MSDUs-that-start-with-an-.patch
  No effect on expanded tree.
- commit 9fdca2b</changelog>
  <changelog author="varad.gautam@suse.com" date="1623844800">- xfrm: policy: Read seqcount outside of rcu-read side in
  xfrm_policy_lookup_bytype (bsc#1185675).
- commit 372fbf0</changelog>
  <changelog author="tiwai@suse.de" date="1623844801">- Update config files: CONFIG_SND_HDA_INTEL=m for armv7hl, too (bsc#1187334)
  It's used by openQA.
- commit c363e06</changelog>
  <changelog author="mbrugger@suse.com" date="1623844802">- Refresh
  patches.suse/brcmfmac-Add-clm_blob-firmware-files-to-modinfo.patch.
- commit f631d93</changelog>
  <changelog author="colyli@suse.de" date="1623844803">- bcache: avoid oversized read request in cache missing code path
  (bsc#1187357, bsc#1185570, bsc#1184631).
- bcache: remove bcache device self-defined readahead
  (bsc#1187357, bsc#1185570, bsc#1184631).
- lib: crc64: fix kernel-doc warning (bsc#1187357).
- bcache: fix a regression of code compiling failure in debug.c
  (bsc#1187357).
- bcache: Use 64-bit arithmetic instead of 32-bit (bsc#1187357).
- md: bcache: Trivial typo fixes in the file journal.c
  (bsc#1187357).
- md: bcache: avoid -Wempty-body warnings (bsc#1187357).
- bcache: use NULL instead of using plain integer as pointer
  (bsc#1187357).
- bcache: remove PTR_CACHE (bsc#1187357).
- bcache: reduce redundant code in bch_cached_dev_run()
  (bsc#1187357).
- bcache: don't pass BIOSET_NEED_BVECS for the 'bio_set' embedded
  in 'cache_set' (bsc#1187357).
- bcache: Convert to DEFINE_SHOW_ATTRIBUTE (bsc#1187357).
- bcache: inherit the optimal I/O size (bsc#1187357).
- commit ce1a322</changelog>
  <changelog author="tiwai@suse.de" date="1623931200">- dmaengine: idxd: add missing dsa driver unregister (git-fixes).
- ALSA: seq: Fix race of snd_seq_timer_open() (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP ZBook Power G8
  (git-fixes).
- ALSA: hda/realtek: headphone and mic don't work on an Acer
  laptop (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP EliteBook 840
  Aero G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  EliteBook x360 1040 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Elite Dragonfly G2 (git-fixes).
- ASoC: amd: fix for pcm_read() error (git-fixes).
- ASoC: max98088: fix ni clock divider calculation (git-fixes).
- commit 4d314e7</changelog>
  <changelog author="jroedel@suse.de" date="1623931201">- x86/sev: Check SME/SEV support in CPUID first (jsc#SLE-14337).
- iommu/vt-d: Use user privilege for RID2PASID translation
  (bsc#1187348).
- iommu/virtio: Add missing MODULE_DEVICE_TABLE (bsc#1187345).
- x86/sev-es: Use __put_user()/__get_user() for data accesses
  (bsc#1187351).
- x86/sev-es: Forward page-faults which happen during emulation
  (bsc#1187350).
- x86/sev-es: Don't return NULL from sev_es_get_ghcb()
  (bsc#1187349).
- iommu/vt-d: Remove WO permissions on second-level paging entries
  (bsc#1187346).
- iommu/vt-d: Report right snoop capability when using FL for IOVA
  (bsc#1187347).
- iommu: Fix a boundary issue to avoid performance drop
  (bsc#1187344).
- x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate()
  (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in the 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add CPUID sanity check to 32-bit
  boot-path (jsc#SLE-14337).
- x86/boot/compressed/64: Add 32-bit boot #VC handler
  (jsc#SLE-14337).
- x86/boot/compressed/64: Setup IDT in startup_32 boot path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Reload CS in startup_32 (jsc#SLE-14337).
- x86/sev: Do not require Hypervisor CPUID bit for SEV guests
  (jsc#SLE-14337).
- x86/boot/compressed/64: Cleanup exception handling before
  booting kernel (jsc#SLE-14337).
- iommu/amd: Keep track of amd_iommu_irq_remap state
  (https://bugzilla.kernel.org/show_bug.cgi?id=212133).
- x86/sev-es: Do not support MMIO to/from encrypted memory
  (jsc#SLE-14337).
- x86/head/64: Check SEV encryption before switching to kernel
  page-table (jsc#SLE-14337).
- x86/boot/compressed/64: Check SEV encryption in 64-bit boot-path
  (jsc#SLE-14337).
- x86/boot/compressed/64: Sanity-check CPUID results in the
  early #VC handler (jsc#SLE-14337).
- x86/boot/compressed/64: Introduce sev_status (jsc#SLE-14337).
- x86/boot/64: Explicitly map boot_params and command line
  (jsc#SLE-14337).
- x86/head/64: Disable stack protection for head$(BITS).o
  (jsc#SLE-14337).
- commit 9810251</changelog>
  <changelog author="tiwai@suse.de" date="1623931202">- ASoC: Intel: soc-acpi: remove TGL RVP mixed SoundWire/TDM config
  (git-fixes).
- commit 85be7e7</changelog>
  <changelog author="oneukum@suse.com" date="1624276800">- usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection
  (git-fixes).
- commit 9d5feb1</changelog>
  <changelog author="bp@suse.de" date="1624276801">- x86/fpu: Prevent state corruption in __fpu__restore_sig()
  (bsc#1178134).
- commit e509690</changelog>
  <changelog author="bp@suse.de" date="1624276802">- blacklist.conf: 28e5e44aa3f4 x86/mm: Avoid truncating memblocks for SGX memory
- commit ea06fd1</changelog>
  <changelog author="mgorman@suse.de" date="1624276803">- Refresh
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch.
  Add Signed-off-by tag for author of the patch in the SLE branch to suppress
  error during branch merges. Example error is
  patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch An email
  address with @suse.de, @suse.com, @suse.cz, or @novell.com in the From,
  Signed-off-by, or Acked-by headers is required
- commit acfd671</changelog>
  <changelog author="msuchanek@suse.de" date="1624622400">- Revert "Update config files (bsc#1187167)" (bsc#1187711).
  The key is needed. When a random key is generaeted it is a problem with
  OBS repository setup. OBS should provide a signing key.
- commit b53af95</changelog>
</package>
<package pkgid="c693f8fa8ed3f7e8ab0b913976f07322bd6be384a222f87c3c11ff13926e7d38" name="gfs2-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="af083855c047918ddf0f9e97cd1d6fbb5633f7a8eb15431dc5564f62aab8da19" name="gfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.13.1"/>
  <changelog author="denis.kirjanov@suse.com" date="1625140800">- nvmem: rmem: fix undefined reference to memremap (git-fixes).
- commit 420be35</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140801">- SUNRPC: Handle major timeout in xprt_adjust_timeout()
  (git-fixes).
- Refresh
  patches.suse/0001-ipmi-watchdog-Stop-watchdog-timer-when-the-current-a.patch.
- Refresh
  patches.suse/block-return-the-correct-bvec-when-checking-for-gaps.patch.
- Refresh
  patches.suse/ibmvnic-remove-default-label-from-to_string-switch.patch.
- commit bff6126</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1625140802">- perf/x86/intel/uncore: Fix a kernel WARNING triggered by
  maxcpus=1 (git-fixes).
- commit 9602802</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140803">- fix patch metadata
- fix upstream reference:
  patches.suse/bpfilter-Specify-the-log-level-for-the-kmsg-message.patch
- commit 4e6fe72</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1625140804">- Update
  patches.suse/RDMA-ucma-Rework-ucma_migrate_id-to-avoid-races-with.patch
  (bsc#1181147 bsc#1187050 CVE-2020-36385).
  Added CVE reference.
- commit f7b3ebb</changelog>
  <changelog author="mkubecek@suse.cz" date="1625140805">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140806">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140807">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140808">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
</package>
<package pkgid="84696a3f96b6614c14d57ee664cf9598507f81bdc6a4cb44e43b369010514b85" name="gfs2-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="47e07e4019182608fdd5b15d3180000411d93f8ad899f94650711d07c1580507" name="gfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.16.1"/>
  <changelog author="mkubecek@suse.cz" date="1625140800">- series.conf: cleanup
- update upstream reference and resort:
  patches.suse/Revert-ibmvnic-simplify-reset_long_term_buff-functio.patch
- commit dc51831</changelog>
  <changelog author="lhenriques@suse.de" date="1625140801">- ceph: must hold snap_rwsem when filling inode for async create
  (bsc#1187927).
- commit 288e232</changelog>
  <changelog author="bp@suse.de" date="1625140802">- x86/fpu: Preserve supervisor states in
  sanitize_restored_user_xstate() (bsc#1178134).
- commit 8de1b90</changelog>
  <changelog author="bp@suse.de" date="1625140803">- x86/process: Check PF_KTHREAD and not current-&gt;mm for kernel
  threads (bsc#1152489).
- commit f14058e</changelog>
  <changelog author="glin@suse.com" date="1625227200">- bpf: Fix integer overflow in argument calculation for
  bpf_map_area_alloc (bsc#1177028).
- bpf: Fix libelf endian handling in resolv_btfids (bsc#1177028).
- commit f52fc7f</changelog>
  <changelog author="dwagner@suse.de" date="1625227201">- qla2xxx: synchronize rport dev_loss_tmo setting (bsc#1182470
  bsc#1185486).
- commit 8249f86</changelog>
  <changelog author="mkoutny@suse.com" date="1625227202">- cgroup1: don't allow '\n' in renaming (bsc#1187972).
- commit 31d330a</changelog>
  <changelog author="lduncan@suse.com" date="1625227203">- scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM (bsc#1187980).
- commit bc82289</changelog>
  <changelog author="bp@suse.de" date="1625227204">- x86/pkru: Write hardware init value to PKRU when xstate is init
  (bsc#1152489).
- commit 05b202a</changelog>
  <changelog author="bp@suse.de" date="1625227205">- blacklist.conf: d8778e393afa x86/fpu: Invalidate FPU state after a failed XRSTOR from a user buffer
- commit 07e7bbd</changelog>
  <changelog author="bp@suse.de" date="1625486400">- blacklist.conf: 89f5f8fb5bf4 EDAC/thunderx: Remove irrelevant variable from error messages
- commit 7c3f543</changelog>
  <changelog author="bp@suse.de" date="1625486401">- x86/elf: Use _BITUL() macro in UAPI headers (bsc#1178134).
- commit 5b8c19e</changelog>
  <changelog author="bp@suse.de" date="1625486402">- blacklist.conf: 1e886090cefe docs: admin-guide: update description for kernel.hotplug sysctl
- commit 1332420</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572800">- fix patch metadata
- fix Patch-mainline and move to "almost mainline" section:
  patches.suse/qla2xxx-synchronize-rport-dev_loss_tmo-setting.patch
- commit 81935f9</changelog>
  <changelog author="mkubecek@suse.cz" date="1625572801">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/scsi-ibmvfc-Avoid-move-login-if-fast-fail-is-enabled.patch
  patches.suse/scsi-ibmvfc-Handle-move-login-failure.patch
  patches.suse/scsi-ibmvfc-Reinit-target-retries.patch
  patches.suse/scsi-lpfc-Add-a-option-to-enable-interlocked-ABTS-be.patch
  patches.suse/scsi-lpfc-Add-ndlp-kref-accounting-for-resume-RPI-pa.patch
  patches.suse/scsi-lpfc-Fix-Node-recovery-when-driver-is-handling-.patch
  patches.suse/scsi-lpfc-Fix-Unexpected-timeout-error-in-direct-att.patch
  patches.suse/scsi-lpfc-Fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch
  patches.suse/scsi-lpfc-Fix-node-handling-for-Fabric-Controller-an.patch
  patches.suse/scsi-lpfc-Fix-non-optimized-ERSP-handling.patch
  patches.suse/scsi-lpfc-Fix-unreleased-RPIs-when-NPIV-ports-are-cr.patch
  patches.suse/scsi-lpfc-Ignore-GID-FT-response-that-may-be-receive.patch
  patches.suse/scsi-lpfc-Reregister-FPIN-types-if-ELS_RDF-is-receiv.patch
  patches.suse/scsi-lpfc-Update-lpfc-version-to-12.8.0.10.patch
  patches.suse/scsi-scsi_dh_alua-Retry-RTPG-on-a-different-path-aft.patch
- commit 9a3a833</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264000">- blacklist.conf: update blacklist
- commit 6b0f6b8</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264001">- usb: dwc3: Fix debugfs creation flow (git-fixes).
- commit dc4de14</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264002">- blacklist.conf: update blacklist
- commit 36a2250</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626264003">- seq_file: Disallow extremely large seq buffer allocations
  (bsc#1188062, CVE-2021-33909).
- commit fe01024</changelog>
  <changelog author="denis.kirjanov@suse.com" date="1626350400">- netfilter: x_tables: fix compat match/target pad out-of-bound
  write (CVE-2021-22555 bsc#1188116).
- commit 0b62bdb</changelog>
</package>
<package pkgid="8476d92518e28c34b879aac0f11da938ad4fc8b3c7d3691e3a3dc76e593bbfb7" name="gfs2-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="bb9277025c0be40364678c231b97d6da74626b550b28fba3ad8145703f0bd09d" name="gfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.19.1"/>
  <changelog author="msuchanek@suse.de" date="1627560000">- Refresh patches.suse/efi-tpm-Differentiate-missing-and-invalid-final-even.patch.
  Update upstream status.
- commit 871e8d7</changelog>
  <changelog author="tiwai@suse.de" date="1627560001">- Move upstreamed patches to sorted section
- commit e174d5e</changelog>
  <changelog author="aabdallah@suse.de" date="1627560002">- Update patch-mainline and git-commit tags
  Refresh:
  - patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
  - patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
- commit 758ec5c</changelog>
  <changelog author="tiwai@suse.de" date="1627560003">- Bluetooth: btintel: Replace zero-length array with
  flexible-array member (bsc#1188893).
- Bluetooth: btintel: Functions to send firmware header / payload
  (bsc#1188893).
- Bluetooth: btintel: Add infrastructure to read controller
  information (bsc#1188893).
- Bluetooth: btintel: Refactor firmware download function
  (bsc#1188893).
- Bluetooth: hci_intel: enable on new platform (bsc#1188893).
- Bluetooth: hci_intel: switch to list_for_each_entry()
  (bsc#1188893).
- Bluetooth: hci_intel: drop strange le16_to_cpu() against u8
  values (bsc#1188893).
- Bluetooth: btusb: Update boot parameter specific to SKU
  (bsc#1188893).
- commit 29e3766</changelog>
  <changelog author="tiwai@suse.de" date="1627560004">- Bluetooth: btusb: Helper function to download firmware to
  Intel adapters (bsc#1188893).
- Bluetooth: btusb: Define a function to construct firmware
  filename (bsc#1188893).
- Bluetooth: btusb: Add *setup* function for new generation
  Intel controllers (bsc#1188893).
- Bluetooth: btintel: Fix endianness issue for TLV version
  information (bsc#1188893).
- commit 051ab9c</changelog>
  <changelog author="tiwai@suse.de" date="1627560005">- Bluetooth: btusb: Add support for GarfieldPeak controller
  (bsc#1188893).
- Revert "Bluetooth: btintel: Fix endianness issue for TLV
  version information" (bsc#1188893).
- Bluetooth: btusb: Enable MSFT extension for Intel controllers
  (bsc#1188893).
- Bluetooth: btusb: Map Typhoon peak controller to
  BTUSB_INTEL_NEWGEN (bsc#1188893).
- commit 8c5bc15</changelog>
  <changelog author="tiwai@suse.de" date="1627560006">- Bluetooth: btintel: Move operational checks after version check
  (bsc#1188893).
- Bluetooth: btintel: Check firmware version before download
  (bsc#1188893).
- Bluetooth: btintel: Fix offset calculation boot address
  parameter (bsc#1188893).
- Bluetooth: btusb: print firmware file name on error loading
  firmware (bsc#1188893).
- commit 02eefaa</changelog>
  <changelog author="tiwai@suse.de" date="1627560007">- Bluetooth: btusb: Fix failing to init controllers with operation
  firmware (bsc#1188893).
- Bluetooth: btintel: Skip reading firmware file version while
  in bootloader mode (bsc#1188893).
- Bluetooth: btintel: Collect tlv based active firmware build
  info in FW mode (bsc#1188893).
- Bluetooth: btintel: Reorganized bootloader mode tlv checks in
  intel_version_tlv parsing (bsc#1188893).
- Bluetooth: btusb: Consolidate code for waiting firmware download
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version parsing
  (bsc#1188893).
- Bluetooth: btintel: Consolidate intel_version_tlv parsing
  (bsc#1188893).
- commit 5d9b049</changelog>
  <changelog author="tiwai@suse.de" date="1627560008">- kABI workaround for btintel symbol changes (bsc#1188893).
- commit a0378fb</changelog>
  <changelog author="msuchanek@suse.de" date="1627560009">- powerpc/pesries: Get STF barrier requirement from
  H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/security: Add a security feature for STF barrier
  (bsc#1188885 ltc#193722).
- powerpc/pseries: Get entry and uaccess flush required bits
  from H_GET_CPU_CHARACTERISTICS (bsc#1188885 ltc#193722).
- powerpc/pseries: export LPAR security flavor in lparcfg
  (bsc#1188885 ltc#193722).
- powerpc/64s: rename pnv|pseries_setup_rfi_flush to
  _setup_security_mitigations (bsc#1188885 ltc#193722).
- Refresh patches.suse/powerpc-pseries-mobility-notify-network-peers-after-.patch.
- powerpc/pseries: add new branch prediction security bits for
  link stack (bsc#1188885 ltc#193722).
- commit 3f019e2</changelog>
  <changelog author="msuchanek@suse.de" date="1627560010">- powerpc/security: Allow for processors that flush the link
  stack using the special bcctr (bsc#1188885 ltc#193722).
- powerpc/security: split branch cache flush toggle from code
  patching (bsc#1188885 ltc#193722).
- powerpc/security: make display of branch cache flush more
  consistent (bsc#1188885 ltc#193722).
- powerpc/security: change link stack flush state to the flush
  type enum (bsc#1188885 ltc#193722).
- Delete patches.suse/powerpc-add-link-stack-flush-mitigation-in-debugfs.patch
- replaced with upstream security mitigation cleanup
- powerpc/security: re-name count cache flush to branch cache
  flush (bsc#1188885 ltc#193722).
- commit e35bcce</changelog>
  <changelog author="msuchanek@suse.de" date="1627560011">- powerpc/64s: Move branch cache flushing bcctr variant to
  ppc-ops.h (bsc#1188885 ltc#193722).
- commit 837e7fa</changelog>
  <changelog author="jeffm@suse.com" date="1627560012">- Update Patch-mainline tags for patches that landed in 5.14-rc3.
- commit 48a135a</changelog>
  <changelog author="msuchanek@suse.de" date="1627560013">- powerpc/security: Fix link stack flush instruction (bsc#1188885
  ltc#193722).
- commit 6d617e8</changelog>
  <changelog author="tbogendoerfer@suse.de" date="1627646400">- ixgbe: Fix packet corruption due to missing DMA sync
  (git-fixes).
- bnxt_en: Check abort error state in bnxt_half_open_nic()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Add missing check for BNXT_STATE_ABORT_ERR in
  bnxt_fw_rset_task() (jsc#SLE-8371 bsc#1153274).
- bnxt_en: Refresh RoCE capabilities in bnxt_ulp_probe()
  (jsc#SLE-8371 bsc#1153274).
- bnxt_en: don't disable an already disabled PCI device
  (git-fixes).
- cxgb4: fix IRQ free race during driver unload (git-fixes).
- igb: Fix position of assignment to *ring (git-fixes).
- igb: Check if num of q_vectors is smaller than max before
  array access (git-fixes).
- iavf: Fix an error handling path in 'iavf_probe()' (git-fixes).
- e1000e: Fix an error handling path in 'e1000_probe()'
  (git-fixes).
- igb: Fix an error handling path in 'igb_probe()' (git-fixes).
- igc: Fix an error handling path in 'igc_probe()' (git-fixes).
- ixgbe: Fix an error handling path in 'ixgbe_probe()'
  (git-fixes).
- igc: change default return of igc_read_phy_reg() (git-fixes).
- igb: Fix use-after-free error during reset (git-fixes).
- igc: Fix use-after-free error during reset (git-fixes).
- virtio_net: move tx vq operation under tx queue lock
  (git-fixes).
- Revert "be2net: disable bh with spin_lock in be_process_mcc"
  (git-fixes).
- e1000e: Check the PCIm state (git-fixes).
- i40e: Fix autoneg disabling for non-10GBaseT links (git-fixes).
- i40e: Fix error handling in i40e_vsi_open (git-fixes).
- vxlan: add missing rcu_read_lock() in neigh_reduce()
  (git-fixes).
- mvpp2: suppress warning (git-fixes).
- net: mvpp2: Put fwnode in error case during -&gt;probe()
  (git-fixes).
- net/mlx5e: Block offload of outer header csum for GRE tunnel
  (git-fixes).
- commit 3de5d62</changelog>
  <changelog author="mkubecek@suse.cz" date="1627819200">- fix patch metadata
- fix Patch-mainline:
  patches.suse/xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch
- commit e52bdda</changelog>
  <changelog author="tiwai@suse.de" date="1627905600">- can: esd_usb2: fix memory leak (git-fixes).
- can: ems_usb: fix memory leak (git-fixes).
- can: usb_8dev: fix memory leak (git-fixes).
- can: mcba_usb_start(): add missing urb-&gt;transfer_dma
  initialization (git-fixes).
- can: hi311x: fix a signedness bug in hi3110_cmd() (git-fixes).
- nfc: nfcsim: fix use after free during module unload
  (git-fixes).
- can: raw: raw_setsockopt(): fix raw_rcv panic for sock UAF
  (git-fixes).
- Revert "ACPI: resources: Add checks for ACPI IRQ override"
  (git-fixes).
- firmware: arm_scmi: Fix range check for the maximum number of
  pending messages (git-fixes).
- firmware: arm_scmi: Fix possible scmi_linux_errmap buffer
  overflow (git-fixes).
- commit 7ff2c84</changelog>
  <changelog author="tiwai@suse.de" date="1627905601">- ACPI: DPTF: Fix reading of attributes (git-fixes).
- drm/msm/dpu: Fix sm8250_mdp register length (git-fixes).
- commit da4d5f8</changelog>
  <changelog author="tiwai@suse.de" date="1627905602">- ALSA: pcm - fix mmap capability check for the snd-dummy driver
  (git-fixes).
- commit b68f7e6</changelog>
  <changelog author="pmladek@suse.com" date="1627905603">- workqueue: fix UAF in pwq_unbound_release_workfn()
  (bsc#1188973).
- commit b02980f</changelog>
</package>
<package pkgid="7c2062210861178b3a88fed553950c4e3a0153a7c177d5b9381f42cc5cde1e67" name="gfs2-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="c800081686a0c2939e761dce5113415c4d95957cca2606337459abaa8902bec8" name="gfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.24.1"/>
  <changelog author="nborisov@suse.com" date="1631188800">- btrfs: rip out btrfs_space_info::total_bytes_pinned (bsc#1135481).
- Delete
  patches.suse/btrfs-dump_space_info-when-encountering-total_bytes_pinned-0-at-umount.patch.
- commit bfb1107</changelog>
  <changelog author="msuchanek@suse.de" date="1631188801">- Refresh patches.suse/cpuidle-pseries-Fixup-CEDE0-latency-only-for-POWER10.patch
  Update patch metadata.
- commit cbfec2a</changelog>
  <changelog author="msuchanek@suse.de" date="1631188802">- Sort nvme patches into linux-block.
- commit 090f7ef</changelog>
  <changelog author="lduncan@suse.com" date="1631188803">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit a70a19d</changelog>
  <changelog author="lduncan@suse.com" date="1631188804">- scsi: mpt3sas: Fix ReplyPostFree pool allocation (bsc#1181006).
- commit 8c2fa8c</changelog>
  <changelog author="neilb@suse.de" date="1631275200">- SUNRPC: Simplify socket shutdown when not reusing TCP ports
  (git-fixes).
- SUNRPC: Fix potential memory corruption (git-fixes).
- NFSv4/pNFS: Fix a layoutget livelock loop (git-fixes).
- nfsd4: Fix forced-expiry locking (git-fixes).
- lockd: Fix invalid lockowner cast after vfs_test_lock
  (git-fixes).
- commit 59642ba</changelog>
  <changelog author="neilb@suse.de" date="1631275201">- blacklist.conf: blacklist an unwanted commit
- commit 910824e</changelog>
  <changelog author="vbabka@suse.cz" date="1631275202">- mm/vmscan: fix infinite loop in drop_slab_node (VM
  Functionality, bsc#1189301).
- commit 016e8e0</changelog>
  <changelog author="msuchanek@suse.de" date="1631275203">- kernel-cert-subpackage: Fix certificate location in scriptlets
  (bsc#1189841).
  Fixes: d9a1357edd73 ("rpm: Define $certs as rpm macro (bsc#1189841).")
- commit 8684de8</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448000">- fixup "rpm: support gz and zst compression methods" (bsc#1190358, bsc#1190428).
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- fixup "rpm: support gz and zst compression methods"
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
- commit 6c262f9</changelog>
  <changelog author="jeffm@suse.com" date="1631448001">- Avoid double printing SUSE specific flags in mod-&gt;taint (bsc#1190413).
- commit 297a1a6</changelog>
  <changelog author="martin.wilck@suse.com" date="1631448002">- fixup "rpm: support gz and zst compression methods" once more
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 34e68f4</changelog>
  <changelog author="tiwai@suse.de" date="1631448003">- Drop two intel_int0002_vgpio patches that cause Oops (bsc#1190412)
  Deleted and blacklisted:
  patches.suse/platform-x86-intel_int0002_vgpio-Only-call-enable_ir.patch
  patches.suse/platform-x86-intel_int0002_vgpio-Pass-irqchip-when-a.patch
- commit bebba41</changelog>
  <changelog author="tiwai@suse.de" date="1631534400">- pwm: lpc32xx: Don't modify HW state in .probe() after the PWM
  chip was registered (git-fixes).
- ALSA: usb-audio: Add registration quirk for JBL Quantum 800
  (git-fixes).
- PCI: Fix pci_dev_str_match_path() alloc while atomic bug
  (git-fixes).
- PCI/portdrv: Enable Bandwidth Notification only if port supports
  it (git-fixes).
- PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
  (git-fixes).
- PCI: Call Max Payload Size-related fixup quirks early
  (git-fixes).
- ALSA: hda/realtek: Workaround for conflicting SSID on ASUS
  ROG Strix G17 (git-fixes).
- reset: reset-zynqmp: Fixed the argument data type (git-fixes).
- gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for
  (semi)planar U/V formats (git-fixes).
- commit f395ad9</changelog>
  <changelog author="tiwai@suse.de" date="1631534401">- thermal/drivers/exynos: Fix an error code in exynos_tmu_probe()
  (git-fixes).
- drm/panfrost: Simplify lock_region calculation (git-fixes).
- dmaengine: acpi: Avoid comparison GSI with Linux vIRQ
  (git-fixes).
- mfd: lpc_sch: Rename GPIOBASE to prevent build error
  (git-fixes).
- mfd: tqmx86: Clear GPIO IRQ resource when no IRQ is set
  (git-fixes).
- mfd: axp20x: Update AXP288 volatile ranges (git-fixes).
- gpio: mpc8xxx: Fix a resources leak in the error handling path
  of 'mpc8xxx_probe()' (git-fixes).
- commit 75d69a6</changelog>
  <changelog author="tiwai@suse.de" date="1631534402">- PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
- PCI: iproc: Fix BCMA probe resource handling (git-fixes).
- usb: dwc2: Fix error path in gadget registration (git-fixes).
- commit 59e7328</changelog>
  <changelog author="tiwai@suse.de" date="1631534403">- PM: sleep: core: Avoid setting power.must_resume to false
  (git-fixes).
- drm/panfrost: Use u64 for size in lock_region (git-fixes).
- dmaengine: idxd: clear block on fault flag when clear wq
  (git-fixes).
- dmaengine: idxd: fix wq slot allocation index check (git-fixes).
- commit b255b0e</changelog>
  <changelog author="martin.wilck@suse.com" date="1631534404">- fixup "rpm: support gz and zst compression methods" once more
  (bsc#1190428, bsc#1190358)
  Fixes: 3b8c4d9bcc24 ("rpm: support gz and zst compression methods")
  Fixes: 23510fce36ec ("fixup "rpm: support gz and zst compression methods"")
- commit 165378a</changelog>
  <changelog author="mkubecek@suse.cz" date="1631534405">- series.conf: refresh
- update upstream references and resort:
  - patches.suse/nvme-multipath-revalidate-paths-during-rescan.patch
  - patches.suse/nvme-only-call-synchronize_srcu-when-clearing-curren.patch
  - patches.suse/nvme-tcp-Do-not-reset-transport-on-data-digest-error.patch
- commit ebb6bcb</changelog>
  <changelog author="mkoutny@suse.com" date="1631534406">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- memcg: enable accounting of ipc resources (bsc#1190115
  CVE-2021-3759).
- commit 84a3538</changelog>
</package>
<package pkgid="608725841a1516c157657d194156db4e896718b8f7e978938f594bf0ba10b5cb" name="gfs2-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="73bb484b6ef5e48625b30953c1f64d38c215bf3e84c14750febe343bb56a913c" name="gfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.27.1"/>
  <changelog author="tiwai@suse.de" date="1633089600">- mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
  (git-fixes).
- ALSA: firewire-motu: fix truncated bytes in message tracepoints
  (git-fixes).
- ASoC: SOF: Fix DSP oops stack dump output contents (git-fixes).
- ASoC: fsl_micfil: register platform component before registering
  cpu dai (git-fixes).
- ASoC: mediatek: common: handle NULL case in suspend/resume
  function (git-fixes).
- media: cedrus: Fix SUNXI tile size calculation (git-fixes).
- watchdog/sb_watchdog: fix compilation problem due to
  COMPILE_TEST (git-fixes).
- dmaengine: xilinx_dma: Set DMA mask for coherent APIs
  (git-fixes).
- dmaengine: ioat: depends on !UML (git-fixes).
- console: consume APC, DM, DCS (git-fixes).
- commit 71b860e</changelog>
  <changelog author="tiwai@suse.de" date="1633089601">- mac80211: fix use-after-free in CCMP/GCMP RX (git-fixes).
- mac80211-hwsim: fix late beacon hrtimer handling (git-fixes).
- mac80211: mesh: fix potentially unaligned access (git-fixes).
- mac80211: limit injected vht mcs/nss in
  ieee80211_parse_tx_radiotap (git-fixes).
- Re-enable UAS for LaCie Rugged USB3-FW with fk quirk
  (git-fixes).
- usb: dwc2: gadget: Fix ISOC flow for BDMA and Slave (git-fixes).
- spi: Fix tegra20 build with CONFIG_PM=n (git-fixes).
- tty: synclink_gt, drop unneeded forward declarations
  (git-fixes).
- commit dbd9f90</changelog>
  <changelog author="tiwai@suse.de" date="1633089602">- USB: serial: option: add device id for Foxconn T99W265
  (git-fixes).
- USB: serial: cp210x: add ID for GW Instek GDM-834x Digital
  Multimeter (git-fixes).
- USB: serial: option: add Telit LN920 compositions (git-fixes).
- usb-storage: Add quirk for ScanLogic SL11R-IDE older than 2.6c
  (git-fixes).
- usb: core: hcd: Add support for deferring roothub registration
  (git-fixes).
- commit 0a6378c</changelog>
  <changelog author="tiwai@suse.de" date="1633089603">- xhci: Set HCD flag to defer primary roothub registration
  (git-fixes).
- commit 8f4e75e</changelog>
  <changelog author="tiwai@suse.de" date="1633089604">- apparmor: remove duplicate macro list_entry_is_head()
  (git-fixes).
- commit 514b75b</changelog>
  <changelog author="tiwai@suse.de" date="1633348800">- drm/i915/rkl: Remove require_force_probe protection
  (bsc#1189257).
- commit 94530db</changelog>
  <changelog author="msuchanek@suse.de" date="1633348801">- powerpc/perf: Fix the check for SIAR value (bsc#1065729).
- powerpc/perf: Drop the case of returning 0 as instruction
  pointer (bsc#1065729).
- powerpc/perf: Use stack siar instead of mfspr (bsc#1065729).
- powerpc/perf: Fix crash in perf_instruction_pointer() when
  ppmu is not set (bsc#1065729).
- powerpc/perf: Use regs-&gt;nip when SIAR is zero (bsc#1065729).
- powerpc/perf: Use the address from SIAR register to set cpumode
  flags (bsc#1065729).
- commit f3110f1</changelog>
  <changelog author="msuchanek@suse.de" date="1633348802">- powerpc/powernv: Fix machine check reporting of async store
  errors (bsc#1065729).
- commit 0b715ae</changelog>
  <changelog author="msuchanek@suse.de" date="1633348803">- powerpc/pseries/dlpar: use rtas_get_sensor() (bsc#1065729).
- commit 466f31b</changelog>
  <changelog author="msuchanek@suse.de" date="1633348804">- powerpc/perf/hv-gpci: Fix counter value parsing (bsc#1065729).
- commit 628c3ee</changelog>
  <changelog author="mkoutny@suse.com" date="1633348805">- ipc: remove memcg accounting for sops objects in do_semtimedop()
  (bsc#1190115).
- Delete
  patches.suse/ipc-remove-memcg-accounting-for-sops-objects.patch.
  Refreshing patch with upstream metadata.
- commit 2d6ef2e</changelog>
  <changelog author="tiwai@suse.de" date="1633348806">- hwmon: (tmp421) fix rounding for negative values (git-fixes).
- hwmon: (tmp421) report /PVLD condition as fault (git-fixes).
- hwmon: (mlxreg-fan) Return non-zero value when fan current
  state is enforced from sysfs (git-fixes).
- commit 2560193</changelog>
  <changelog author="bp@suse.de" date="1633348807">- blacklist.conf: 3a1255396b5a x86/alternatives: add missing insn.h include
- commit 53a5b9c</changelog>
  <changelog author="dwagner@suse.de" date="1633348808">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 57a6cb7</changelog>
  <changelog author="dwagner@suse.de" date="1633348809">- blk-mq: kABI fixes for blk_mq_queue_map (bsc#1185762).
- blk-mq: don't deactivate hctx if managed irq isn't used
  (bsc#1185762).
- blk-mq: mark if one queue map uses managed irq (bsc#1185762).
- genirq: add device_has_managed_msi_irq (bsc#1185762).
- commit 71f9eaf</changelog>
  <changelog author="bp@suse.de" date="1633348810">- x86/alternatives: Teach text_poke_bp() to emulate instructions
  (bsc#1185302).
- Refresh
  patches.suse/x86-alternatives-sync-bp_patching-update-for-avoiding-null-pointer-exception.patch.
- commit ef191ae</changelog>
  <changelog author="tonyj@suse.de" date="1633348811">- blacklist.conf: Update for 51e1bb9eeaf7
- commit fe28675</changelog>
  <changelog author="mkoutny@suse.com" date="1633348812">- sched/fair: Add ancestors of unthrottled undecayed cfs_rq
  (bsc#1191292).
- commit d8d828e</changelog>
  <changelog author="mkubecek@suse.cz" date="1633348813">- series.conf: cleanup
- move a kabi workaround into correct section:
  patches.kabi/ipvs-Fix-up-kabi-for-expire_nodest_conn_work-additio.patch
- commit bc02214</changelog>
  <changelog author="trenn@suse.com" date="1633348814">- x86/cpu: Fix core name for Sapphire Rapids (jsc#SLE-15289).
- powercap: intel_rapl: add support for Sapphire Rapids
  (jsc#SLE-15289).
- commit 053c38b</changelog>
</package>
<package pkgid="52cd5254490f98a64809da09f63058759e2d7bd21cac313bcd6b39518689b0cc" name="gfs2-kmp-preempt" arch="aarch64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="a7dd0e4018b559ca38d2efd6a075ea1356fd24596b2a198a204b9846b8ad7a46" name="gfs2-kmp-preempt" arch="x86_64">
  <version epoch="0" ver="5.3.18" rel="59.5.2"/>
  <changelog author="aabdallah@suse.de" date="1622203200">- netfilter: conntrack: avoid misleading 'invalid' in log message
  (bsc#1183947 bsc#1185950).
- commit 9338bce</changelog>
  <changelog author="aabdallah@suse.de" date="1622203201">- netfilter: conntrack: improve RST handling when tuple is re-used
  (bsc#1183947 bsc#1185950).
- commit 3e0da56</changelog>
  <changelog author="ykaukab@suse.de" date="1622203202">- Revert "soc: fsl: qe: introduce qe_io{read,write}* wrappers"
  (git-fixes).
- commit 25de66e</changelog>
  <changelog author="ykaukab@suse.de" date="1622203203">- blacklist.conf: spi: add a cosmetic fix
- commit 67d8fed</changelog>
  <changelog author="aabdallah@suse.de" date="1622203204">- netfilter: conntrack: add new sysctl to disable RST check
  (bsc#1183947 bsc#1185950).
- commit 54ae065</changelog>
  <changelog author="jlee@suse.com" date="1622203205">- Hibernation: Fix Hibernate not blocked in Secure Boot with no EFI secret key
  Refresh
  patches.suse/0005-efi-generate-secret-key-in-EFI-boot-environment.patch.
  (bsc#1186512)
- commit d15957a</changelog>
  <changelog author="dbueso@suse.de" date="1622203206">- futex: Make syscall entry points less convoluted (git-fixes).
- futex: Get rid of the val2 conditional dance (git-fixes).
- futex: Do not apply time namespace adjustment on FUTEX_LOCK_PI
  (bsc#1164648).
- futex: Change utime parameter to be 'const ... *' (git-fixes).
- commit c6c39e0</changelog>
  <changelog author="tiwai@suse.de" date="1622376000">- ALSA: hda/realtek: Headphone volume is controlled by Front mixer
  (git-fixes).
- ALSA: usb-audio: scarlett2: Improve driver startup messages
  (git-fixes).
- ALSA: usb-audio: scarlett2: Fix device hang with ehci-pci
  (git-fixes).
- ALSA: usb-audio: fix control-request direction (git-fixes).
- commit ad502bc</changelog>
  <changelog author="tiwai@suse.de" date="1622376001">- ASoC: cs35l33: fix an error code in probe() (git-fixes).
- ASoC: cs42l42: Regmap must use_single_read/write (git-fixes).
- ALSA: usb-audio: scarlett2: snd_scarlett_gen2_controls_create()
  can be static (git-fixes).
- commit 72126c6</changelog>
  <changelog author="tiwai@suse.de" date="1622376002">- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 17 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook Fury 15 G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs and speaker for HP
  Zbook G8 (git-fixes).
- ALSA: hda/realtek: fix mute/micmute LEDs for HP 855 G8
  (git-fixes).
- ALSA: hda/realtek: Chain in pop reduction fixup for ThinkStation
  P340 (git-fixes).
- ALSA: hda/realtek: the bass speaker can't output sound on Yoga
  9i (git-fixes).
- commit 7ba5be9</changelog>
  <changelog author="mkubecek@suse.cz" date="1622376003">- series.conf: cleanup
- fix Patch-mainline and move unsortable patches out of sorted section
  patches.suse/0001-netfilter-conntrack-improve-RST-handling-when-tuple-.patch
  patches.suse/0001-netfilter-conntrack-add-new-sysctl-to-disable-RST-ch.patch
- commit 9d82526</changelog>
  <changelog author="mkubecek@suse.cz" date="1622462400">- series.conf: cleanup
- update upstream references and resort:
  patches.suse/nvme-fabrics-decode-host-pathing-error-for-connect.patch
  patches.suse/nvme-fc-short-circuit-reconnect-retries.patch
- whitespace cleanup
- commit 03158d3</changelog>
  <changelog author="jeyu@suse.de" date="1622462401">- Rename duplicate patches to their SLE15-SP2 equivalents.
  This is to prepare for the next SLE15-SP2 -&gt; SLE15-SP3 merge.
- commit e32f455</changelog>
  <changelog author="bp@suse.de" date="1622462402">- x86/sev-es: Move sev_es_put_ghcb() in prep for follow on patch
  (bsc#1178134).
- commit 61a3120</changelog>
  <changelog author="ykaukab@suse.de" date="1622462403">- soc: fsl: qe: replace qe_io{read,write}* wrappers by generic
  io{read,write}* (git-fixes).
- commit d4c6a74</changelog>
  <changelog author="ykaukab@suse.de" date="1622462404">- tty: serial: ucc_uart: replace qe_io{read,write}* wrappers by
  generic io{read,write}* (git-fixes).
- commit 845115a</changelog>
  <changelog author="bp@suse.de" date="1622462405">- x86/sev-es: Invalidate the GHCB after completing VMGEXIT
  (bsc#1178134).
- commit 2ed6303</changelog>
  <changelog author="ptesarik@suse.cz" date="1622548800">- s390/ipl: support NVMe IPL kernel parameters (bsc#1185980
  LTC#192679).
- commit 36a59d3</changelog>
  <changelog author="dwagner@suse.de" date="1622548801">- Fix patches.suse/nvme-multipath-reset-bdev-to-ns-head-when-failover.patch (bsc#1186681)
  The backport for bsc#1182999 bsc#1178378 introduced a bug.  It's not
  possible to use bdget_disk() in nvme_failover_req() as this can run in
  IRQ context and bdget_disk() can sleep.
  Luckily, we don't need to set bdev via bio_set_dev() as we can set
  bi_disk directly.
- commit cee62aa</changelog>
  <changelog author="ptesarik@suse.cz" date="1622635200">- partitions/ibm: fix non-DASD devices (bsc#1185857 LTC#192526).
- commit 0f96f57</changelog>
</package>
<package pkgid="ea92c3b0c82618074e66bd261443bb83d849751e8487fe600822f9fd9ef95629" name="ghostscript" arch="aarch64">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="08e31fbab1461b759ce6053bbb588a97a64f586c79ba9bcb7dcb86821ac2858d" name="ghostscript" arch="ppc64le">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="e650d17328832cee19272347fdb67cf63b749794fa566aa2367535cfb10fe3e2" name="ghostscript" arch="s390x">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="2dcb2d9973244acaf44e796af95a17c5281d3604c46c52a504b7672793682d15" name="ghostscript" arch="src">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="56aa87e6ef323645a9c12a77279e4fe556ac99c65c17e4ed50146bdb1748d262" name="ghostscript" arch="x86_64">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="69a9a90d299069090f9f00d3e7e64b509d58877a4a3b87d9f4f6892fd496e6c8" name="ghostscript-devel" arch="aarch64">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="65e2054a0be6262967a31802709f68cef6b1e873ac36fb118e94fe395dcf1c5c" name="ghostscript-devel" arch="ppc64le">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="6a3c75aed6fb5771a98e96427444fd58188c1b17e5f9b7b5d9880995169c64a8" name="ghostscript-devel" arch="s390x">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="e1c443cefb09dedf3665d4f3b682a0e62bf940376841a3aa4b9ef6f32037bcc5" name="ghostscript-devel" arch="x86_64">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="4d2ba143bce2b1513b7c4cc9e81401ef5097207d7d4fe257433182cc238196e9" name="ghostscript-x11" arch="aarch64">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="aa7e3015c9288df9a8e5a3868e759ba756e34017411eefb2183030bcdba500f9" name="ghostscript-x11" arch="ppc64le">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="05e562a55b49f1422222939f2bd3d104e394db7d8f4e38649095d6d33236a75c" name="ghostscript-x11" arch="s390x">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="9818eb5c3f3c8f2cf90a189f9e07537b9cffdc9b3c8cda1868cc1be8600b7ae5" name="ghostscript-x11" arch="x86_64">
  <version epoch="0" ver="9.52" rel="155.1"/>
  <changelog author="jsmeix@suse.de" date="1521201600">- For now use lcms2 from SUSE because that is what currently
  Ghostscript upstream recommends according to
  https://ghostscript.com/pipermail/gs-devel/2018-March/010061.html
  because since Ghostscript 9.23rc1 there is no longer lcms2
  in Ghostscript but now it is lcms2art which is the beginning
  of a lcms2 fork, see News.htm that reads in particular
  "LCMS2 is not thread safe ... Our fork will be thread safe ...
  We will maintain compatibility between Ghostscript and LCMS2
  for a time, but not in perpetuity", see also
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c14
- On SLE11 and on SLE12-SP1 there is liblcms2-2-2.5
  which is too old so that configure fails there with
    configure: error: lcms2 not found, or too old
  but there is no configure option to build it without lcms2
  so that for SLE11 and SLE12-SP1 it is built with
  the lcms2art in Ghostscript.
- ppc64le-support.patch is no longer needed because it only
  contained a fix for lcms2art/include/lcms2art.h in Ghostscript
  but currently lcms2 from SUSE is used instead (see above).
- Do no longer require any fonts packages in particular
  neither require ghostscript-fonts-std because the PostScript
  Base35 fonts are provided by Ghostscript (in 'Resource')
  nor require ghostscript-fonts-other (provides Bitream Charter,
  Adobe Utopia, URW Antiqua, URW Grotesq and Hershey fonts where
  all but the last are also provided by texlive-&lt;name&gt;-fonts) and
  those fonts are not required for PostScript compliance, see
  https://bugzilla.opensuse.org/show_bug.cgi?id=1082896#c13</changelog>
  <changelog author="jsmeix@suse.de" date="1521720000">- Version upgrade to 9.23
  Highlights in this release include:
  * Ghostscript now has a family of 'pdfimage' devices
    (pdfimage8, pdfimage24 and pdfimage32) which produce
    rendered output wrapped up as an image in a PDF.
    Additionally, there is a 'pclm' device which
    produces PCLm format output.
  * There is now a ColorAccuracy parameter allowing the user
    to decide between speed or accuracy in ICC color transforms.
  * JPEG Passthrough: devices which support it can now receive
    the 'raw' JPEG stream from the interpreter.
    The main use of this is the pdfwrite/ps2write family of devices
    that can now take JPEG streams from the input file(s) and write
    them unchanged to the output (thus avoiding additional
    quantization effects).
  * PDF transparency performance improvements
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS.
    LCMS2 is not thread safe, and cannot be made thread safe
    without breaking the ABI. Our fork will be thread safe,
    and include performance enhancements (these changes have all
    be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. Our fork will be available as its own
    package separately from Ghostscript (and MuPDF).
  * We have continued the focus on code hygiene in this release
    cleaning up security issues, ignored return values,
    and compiler warnings.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes
  * The planned device API tidy has, unfortunately, been
    indefinitely postponed, until appropriate resources
    are available.
  For a release summary see:
  http://www.ghostscript.com/doc/9.23/News.htm
  For details see the News.htm and History9.htm files.
  See also the entries below since "Version upgrade to 9.22"
  (boo#1082896 and boo#1074266).</changelog>
  <changelog author="jsmeix@suse.de" date="1528200000">- CVE-2018-10194.patch fixes stack-based buffer overflow
  in gdevpdts.c (bsc#1090099), see
  https://bugs.ghostscript.com/show_bug.cgi?id=699255 and
  http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=39b1e54b2968620723bf32e96764c88797714879</changelog>
  <changelog author="jsmeix@suse.de" date="1536840000">- Version upgrade to 9.24
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised)
    real and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * As well as Ghostscript itself, jbig2dec has had a significant
    amount of work improving its robustness in the face of
    out specification files.
  * IMPORTANT: We (i.e. Ghostscript upstream) are in the process
    of forking LittleCMS. LCMS2 is not thread safe, and cannot
    be made thread safe without breaking the ABI. Our fork
    will be thread safe, and include performance enhancements
    (these changes have all be been offered and rejected upstream).
    We will maintain compatibility between Ghostscript and LCMS2
    for a time, but not in perpetuity. Our fork will be available
    as its own package separately from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.24/News.htm
  For details see the News.htm and History9.htm files.
- fix_ln_docdir_gsdatadir.patch is no longer needed
  because the issue is fixed in the upstream sources.
- CVE-2018-10194.patch is no longer needed
  because the issue is fixed in the upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1536840001">- Version upgrade to 9.25rc1 (first release candidate for 9.25).
  Highlights in this release include:
  * This release fixes problems with argument handling, some
    unintended results of the security fixes to the SAFER file
    access restrictions (specifically accessing ICC profile files),
    and some additional security issues over the 9.24 release.
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real
    and potential exploits.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * Avoid that ps2epsi fails with
    'Error: /undefined in --setpagedevice--'
    Recent changes required to harden SAFER mode mean that
    it is no longer possible to run ps2epsi in SAFER mode,
    because it relies upon unsafe Ghostscript non-standard
    extension operators.
    Removing SAFER and DELAYSAFER, and the code to reset SAFER,
    allow ps2epsi to run as well as it ever did (ie badly).
    This program (i.e. ps2epsi) should now be considered unsafe,
    you should not use it on untrusted PostScript programs.
    Likely we (i.e. Ghostscript upstream) will deprecate and
    remove this program in future.
  For details see the News.htm and History9.htm files.
  Regarding installing packages (in particular release candidates)
  from the openSUSE build service development project "Printing"
  see https://build.opensuse.org/project/show/Printing</changelog>
  <changelog author="jsmeix@suse.de" date="1536926400">- Version upgrade to 9.25
  For the highlights in this release see the highlights in the
  9.25rc1 first release candidate for 9.25 entry below.
  PLEASE NOTE:
  We (i.e. Ghostscript upstream) strongly urge users to upgrade
  to this latest release to avoid these issues.
  For a release summary see:
  http://www.ghostscript.com/doc/9.25/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.25 release should fix (see below)
  in particular those security issues:
  * CVE-2018-15909: shading_param incomplete type checking
    https://bugs.ghostscript.com/show_bug.cgi?id=699660
    https://bugzilla.suse.com/show_bug.cgi?id=1106172 bsc#1106172
  * CVE-2018-15908: .tempfile file permission issues
    https://bugs.ghostscript.com/show_bug.cgi?id=699657
    https://bugzilla.suse.com/show_bug.cgi?id=1106171 bsc#1106171
  * CVE-2018-15910: LockDistillerParams type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=699656
    https://bugzilla.suse.com/show_bug.cgi?id=1106173 bsc#1106173
  * CVE-2018-15911: uninitialized memory access in the aesdecode
    https://bugs.ghostscript.com/show_bug.cgi?id=699665
    https://bugzilla.suse.com/show_bug.cgi?id=1106195 bsc#1106195
  * CVE-2018-16513: setcolor missing type check
    https://bugs.ghostscript.com/show_bug.cgi?id=699655
    https://bugzilla.suse.com/show_bug.cgi?id=1107412 bsc#1107412
  * CVE-2018-16509: /invalidaccess bypass after failed restore
    https://bugs.ghostscript.com/show_bug.cgi?id=699654
    https://bugzilla.suse.com/show_bug.cgi?id=1107410 bsc#1107410
  * CVE-2018-16510: Incorrect exec stack handling in the "CS"
    and "SC" PDF primitives
    https://bugs.ghostscript.com/show_bug.cgi?id=699671
    https://bugzilla.suse.com/show_bug.cgi?id=1107411 bsc#1107411
  * CVE-2018-16542: .definemodifiedfont memory corruption
    if /typecheck is handled
    https://bugs.ghostscript.com/show_bug.cgi?id=699668
    https://bugzilla.suse.com/show_bug.cgi?id=1107413 bsc#1107413
  * CVE-2018-16541 incorrect free logic in pagedevice replacement
    https://bugs.ghostscript.com/show_bug.cgi?id=699664
    https://bugzilla.suse.com/show_bug.cgi?id=1107421 bsc#1107421
  * CVE-2018-16540 use-after-free in copydevice handling
    https://bugs.ghostscript.com/show_bug.cgi?id=699661
    https://bugzilla.suse.com/show_bug.cgi?id=1107420 bsc#1107420
  * CVE-2018-16539: incorrect access checking in temp file
    handling to disclose contents of files
    https://bugs.ghostscript.com/show_bug.cgi?id=699658
    https://bugzilla.suse.com/show_bug.cgi?id=1107422 bsc#1107422
  * CVE-2018-16543: gssetresolution and gsgetresolution allow
    for unspecified impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699670
    https://bugzilla.suse.com/show_bug.cgi?id=1107423 bsc#1107423
  * CVE-2018-16511: type confusion in "ztype" could be used by
    remote attackers able to supply crafted PostScript to crash
    the interpreter or possibly have unspecified other impact
    https://bugs.ghostscript.com/show_bug.cgi?id=699659
    https://bugzilla.suse.com/show_bug.cgi?id=1107426 bsc#1107426
  * CVE-2018-16585 .setdistillerkeys PostScript command is
    accepted even though it is not intended for use
    https://bugzilla.suse.com/show_bug.cgi?id=1107581 bsc#1107581
  * CVE-2018-16802: Incorrect"restoration of privilege" checking
    when running out of stack during exceptionhandling could be
    used by attackers able to supply crafted PostScript to execute
    code using the "pipe" instruction. This is due to an incomplete
    fix for CVE-2018-16509
    https://bugs.ghostscript.com/show_bug.cgi?id=699714
    https://bugs.ghostscript.com/show_bug.cgi?id=699718
    https://bugzilla.suse.com/show_bug.cgi?id=1108027 bnc#1108027
  Regarding what the above "should fix" means:
  PostScript is a general purpose Turing-complete programming
  language (cf. https://en.wikipedia.org/wiki/PostScript)
  that supports in particular file access on the system disk.
  When Ghostscript processes PostScript it runs a PostScript
  program as the user who runs Ghostscript.
  When Ghostscript processes an arbitrary PostScript file,
  the user who runs Ghostscript runs an arbitrary program
  which can do anything on the system where Ghostscript runs
  that this user is allowed to do on that system.
  To make it safer when Ghostscript runs a PostScript program
  the Ghostscript command line option '-dSAFER' disables
  certain file access functionality, for details see
  /usr/share/doc/ghostscript/9.25/Use.htm
  Its name 'SAFER' says everything: It makes it 'safer'
  to let Ghostscript run a PostScript program,
  but it does not make it completely safe.
  In theory software is safe against misuse (i.e. has no bugs).
  In practice there is an endless sequence of various kind of
  security issues (i.e. software can be misused to do more than
  what is intended) that get fixed issue by issue ad infinitum.
  In the end all that means:
  In practice the user who runs Ghostscript must not let it
  process arbitrary PostScript files from untrusted origin.
  In particular Ghostscript is usually run when printing
  documents (with the '-dSAFER' option set), see the part about
  "It is crucial to limit access to CUPS to trusted users" in
  https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings</changelog>
  <changelog author="jsmeix@suse.de" date="1541764800">- Version upgrade to 9.26rc1 (first release candidate for 9.26).
  Highlights in this release include:
  * Purely security and a few bug fixes, there are no new features,
    and no API changes to report.</changelog>
  <changelog author="jsmeix@suse.de" date="1543579200">- Version upgrade to 9.26
  Highlights in this release include:
  * Security issues have been the primary focus of this release,
    including solving several (well publicised) real and potential
    exploits.
    Thanks to Man Yue Mo of Semmle Security Research Team,
    Jens Mueller of Ruhr-Universitaet Bochum and
    Tavis Ormandy of Google's Project Zero
    for their help to identify specific security issues.
    PLEASE NOTE:
    We (i.e. Ghostscript upstream) strongly urge users to upgrade
    to this latest release to avoid these issues.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  http://www.ghostscript.com/doc/9.26/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.26 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues (bsc#1117331)
  * CVE-2018-19475: psi/zdevice2.c allows attackers to bypass
    intended access restrictions
    https://bugs.ghostscript.com/show_bug.cgi?id=700153
    https://bugzilla.suse.com/show_bug.cgi?id=1117327 bsc#1117327
  * CVE-2018-19476: psi/zicc.c allows attackers to bypass
    intended access restrictions because of a setcolorspace
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700169
    https://bugzilla.suse.com/show_bug.cgi?id=1117313 bsc#1117313
  * CVE-2018-19477: psi/zfjbig2.c allows attackers to bypass
    intended access restrictions because of a JBIG2Decode
    type confusion
    https://bugs.ghostscript.com/show_bug.cgi?id=700168
    https://bugzilla.suse.com/show_bug.cgi?id=1117274 bsc#1117274
  * CVE-2018-19409: LockSafetyParams is not checked correctly
    if another device is used
    https://bugs.ghostscript.com/show_bug.cgi?id=700176
    https://bugzilla.suse.com/show_bug.cgi?id=1117022 bsc#1117022
  and those security issues
  * CVE-2018-18284: 1Policy operator gives access to .forceput
    https://bugs.ghostscript.com/show_bug.cgi?id=69963
    https://bugzilla.suse.com/show_bug.cgi?id=1112229 bsc#1112229
  * CVE-2018-18073: saved execution stacks can leak operator arrays
    https://bugs.ghostscript.com/show_bug.cgi?id=699927
    https://bugzilla.suse.com/show_bug.cgi?id=1111480 bsc#1111480
  * CVE-2018-17961: bypassing executeonly to escape -dSAFER sandbox
    https://bugs.ghostscript.com/show_bug.cgi?id=699816
    https://bugzilla.suse.com/show_bug.cgi?id=1111479 bsc#1111479
  * CVE-2018-17183: remote attackers could be able to supply
    crafted PostScript to potentially overwrite or replace
    error handlers to inject code
    https://bugs.ghostscript.com/show_bug.cgi?id=699708
    https://bugzilla.suse.com/show_bug.cgi?id=1109105 bsc#1109105</changelog>
  <changelog author="jsmeix@suse.de" date="1547726400">- Version upgrade to 9.26a
  The version 9.26a is a special security bugfix version to fix
  * CVE-2019-6116: subroutines within pseudo-operators
    must themselves be pseudo-operators
    https://bugs.ghostscript.com/show_bug.cgi?id=700317
    https://bugzilla.suse.com/show_bug.cgi?id=1122319 bsc#1122319</changelog>
  <changelog author="jsmeix@suse.de" date="1552996800">- CVE-2019-3838.patch fixes CVE-2019-3838
  forceput in DefineResource is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
  https://bugs.ghostscript.com/show_bug.cgi?id=700576</changelog>
  <changelog author="jsmeix@suse.de" date="1554379200">- Version upgrade to 9.27
  Highlights in this release include:
  * We (i.e. Ghostscript upstream) have extensively cleaned up
    the Postscript name space: removing access to internal and/or
    undocumented Postscript operators, procedures and data.
    This has benefits for security and maintainability.
    Incompatible changes:
    The process of "tidying" the Postscript name space should
    have removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or
    utilities that rely on those non-standard and undocumented
    operators may stop working, or may change behaviour.
    If you encounter such a case, please contact us (i.e.
    Ghostscript upstream) - (either the #ghostscript IRC channel,
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution.
  * Fontmap can now reference invidual fonts in a TrueType
    Collection for font subsitution. Previously, a Fontmap entry
    could only reference a TrueType collection and use the default
    (first) font.
    Now, the Fontmap syntax allows for specifying a specific index
    in a TTC. See the comments at the top of (the default)
    Fontmap.GS for details.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  IMPORTANT: It is our intention, within the next 12 months
    (ideally sooner, in time for the next release) to make SAFER
    the default mode of operation. For many users this will have
    no effect, since they use SAFER explicitly, but some niche
    uses which rely on SAFER being disabled may need to start
    explicitly adding the "-dNOSAFER" option.
  IMPORTANT: We (i.e. Ghostscript upstream) are in the process of
    forking LittleCMS. LCMS2 is not thread safe, and cannot be made
    thread safe without breaking the ABI. Our fork will be thread
    safe, and include performance enhancements (these changes have
    all be been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time, but not
    in perpetuity. Our fork will be available as its own package
    separately from Ghostscript (and MuPDF).
  For a release summary see:
  http://www.ghostscript.com/doc/9.27/News.htm
  For details see the News.htm and History9.htm files.
  The Ghostscript 9.27 release should fix (cf. the entry below
  dated 'Fri Sep 14 10:47:33 CEST 2018' what "should fix" means)
  in particular those security issues:
  * CVE-2019-3838 forceput in DefineResource is still accessible
    https://bugzilla.suse.com/show_bug.cgi?id=1129186 bsc#1129186
    https://bugs.ghostscript.com/show_bug.cgi?id=700576
  * CVE-2019-3835: superexec operator is available
    https://bugzilla.suse.com/show_bug.cgi?id=1129180 bsc#1129180
    https://bugs.ghostscript.com/show_bug.cgi?id=700585</changelog>
  <changelog author="werner@suse.de" date="1565611200">- CVE-2019-10216.patch fixes CVE-2019-10216
  forceput/superexec in .buildfont1 is still accessible
  https://bugzilla.suse.com/show_bug.cgi?id=1144621 bsc#1144621
  https://bugs.ghostscript.com/show_bug.cgi?id=701394</changelog>
  <changelog author="werner@suse.de" date="1568376000">- Add patch openjpeg4gs-CVE-2018-6616-8ee33522.patch
  to fix bsc#1140359 for CVE-2019-12973</changelog>
  <changelog author="werner@suse.de" date="1568635200">- Add patch gs-CVE-2019-14811-885444fc.patch to fix bsc#1146882
  for CVE-2019-14811,CVE-2019-14812,CVE-2019-14813
- Add patch gs-CVE-2019-14817-cd1b1cac.patch to fix bsc#1146884
  for CVE-2019-14817</changelog>
  <changelog author="werner@suse.de" date="1568635201">- Port latest ghostscript 9.27 from factory including latest
  security patches to SLES15/SLES12
  * Port patch CVE-2019-10216.patch to 9.27 which is the orignal
    upstream commit now
  * Drop patch CVE-2019-3838.patch as now part of 9.27</changelog>
  <changelog author="jsmeix@suse.de" date="1573473600">- CVE-2019-14869.patch contains commit from Ghostscript upstream
  https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=485904772c5f
  to fix CVE-2019-14869 "-dSAFER escape in .charkeys"
  (bsc#1156275)</changelog>
  <changelog author="jsmeix@suse.de" date="1588075200">- The version upgrade to 9.52 fixes in particular
  CVE-2020-12268: jbic2dec: heap-based buffer overflow
  in jbig2_image_compose (bsc#1170603)
- Version upgrade to 9.52
  Highlights in this release include:
  * The 9.52 release replaces the 9.51 release after a problem
    was reported with 9.51 which warranted the quick turnaround.
    Thus, like 9.51, 9.52 is primarily a maintenance release,
    consolidating the changes we introduced in 9.50.
  * IMPORTANT: We have forked LittleCMS2 into LittleCMS2mt
    (the "mt" indicating "multi-thread").
    LCMS2 is not thread-safe, and cannot be made thread-safe
    without breaking the ABI. Our fork will be thread-safe and
    include performance enhancements (these changes have all
    been offered and rejected upstream). We will maintain
    compatibility between Ghostscript and LCMS2 for a time,
    but not in perpetuity. If there is sufficient interest,
    our fork will be available as its own package separately
    from Ghostscript (and MuPDF).
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * New option -dALLOWPSTRANSPARENCY: The transparency compositor
    (and related features), whilst we are improving it, remains
    sensitive to being driven correctly, and incorrect use
    can have unexpected/undefined results. Hence, as part of
    improving security, we limited access to these operators,
    originally using the -dSAFER feature. As we made "SAFER"
    the default mode, that became unacceptable, hence the
    new option -dALLOWPSTRANSPARENCY which enables access
    to the operators, cf.
    https://www.ghostscript.com/doc/9.52/Use.htm#ALLOWPSTRANSPARENCY
  For a release summary see:
  https://www.ghostscript.com/doc/9.52/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.51
  Highlights in this release include:
  * 9.51 is primarily a maintainance release, consolidating
    the changes we introduced in 9.50.
  * We have continued our work on code hygiene for this release,
    with a focus on the static analysis tool Coverity
    (from Synopsys, Inc) and we are now maintaining a policy of
    zero Coverity issues in the Ghostscript/GhostPDL source base.
  * IMPORTANT: In consultation with a representative of
    OpenPrinting (http://www.openprinting.org/) it is our
    intention to deprecate and, in the not distant future,
    remove the OpenPrinting Vector/Raster Printer Drivers
    (that is, the opvp and oprp devices).
    If you rely on either of these devices, please get in touch
    with us (i.e. Ghostscript upstream), so we can discuss your
    use case, and revise our plans accordingly.
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  For a release summary see:
  https://www.ghostscript.com/doc/9.51/News.htm
  For details see the News.htm and History9.htm files.
- Version upgrade to 9.50
  Highlights in this release include:
  * The change to version 9.50 follows recognition
    of the extent and importance of the file access control
    redesign/reimplementation outlined below.
  * The file access control capability (enable with -dSAFER)
    has been completely rewritten, with a ground-up rethink
    of the design. For more details, see: "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * It is important to note that -dSAFER now only enables the
    file access controls, and no longer applies restrictions
    to standard Postscript functionality (specifically,
    restrictions on setpagedevice). If your application relies
    on these Postscript restrictions, see "OLDSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#OldSafer
    and please get in touch, as we do plan to remove those
    Postscript restrictions unless we have reason not to.
  IMPORTANT: File access controls are now enabled by default.
    In order to run Ghostscript without these controls,
    see "NOSAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#NoSafer
  * We (i.e. Ghostscript upstream) are in the process of forking
    LittleCMS, cf. the other release notes entries below.
  * The usual round of bug fixes, compatibility changes,
    and incremental improvements.
  Incompatible changes:
  * There are a couple of subtle incompatibilities between the old
    and new SAFER implementations. Firstly, as mentioned above,
    SAFER now leaves standard Postcript functionality unchanged
    (except for the file access limitations). Secondly, the
    interaction with save/restore operations, see "SAFER" at
    https://www.ghostscript.com/doc/9.50/Use.htm#Safer
  * The following is not strictly speaking new to 9.50,
    as not much has changed since 9.27 in this area,
    but for those who don't upgrade with every release:
    The process of "tidying" the Postscript name space should have
    removed only non-standard and undocumented operators.
    Nevertheless, it is possible that any integrations or utilities
    that rely on those non-standard and undocumented operators
    may stop working, or may change behaviour.
    If you encounter such a case, please contact us
    (i.e. Ghostscript upstream, either the #ghostscript IRC channel
    or the gs-devel mailing list would be best), and we'll work
    with you to either find an alternative solution or return the
    previous functionality, if there is genuinely no other option.
    One case we know this has occurred is GSView 5 (and earlier).
    GSView 5 support for PDF files relied upon internal use only
    features which are no longer available. GSView 5 will still
    work as previously for Postscript files. For PDF files,
    users are encouraged to look at MuPDF https://www.mupdf.com/
  For a release summary see:
  https://www.ghostscript.com/doc/9.50/News.htm
  For details see the News.htm and History9.htm files.
- CVE-2019-10216.patch CVE-2019-14869.patch
  gs-CVE-2019-14811-885444fc.patch
  gs-CVE-2019-14817-cd1b1cac.patch
  openjpeg4gs-CVE-2018-6616-8ee33522.patch
  are fixed in the version 9.52 upstream sources.</changelog>
  <changelog author="jsmeix@suse.de" date="1595851200">- CVE-2020-15900.patch fixes CVE-2020-15900
  Memory Corruption (SAFER Sandbox Breakout)
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=702582
  (bsc#1174415)</changelog>
  <changelog author="wolfgang.frisch@suse.com" date="1619006400">- Hardening: link as position independent executable (bsc#1184123).</changelog>
  <changelog author="jsmeix@suse.de" date="1631275200">- CVE-2021-3781.patch fixes CVE-2021-3781
  Trivial -dSAFER bypass
  cf. https://bugs.ghostscript.com/show_bug.cgi?id=704342
  (bsc#1190381)</changelog>
</package>
<package pkgid="cc729d742a73a4802bc63a5475741f84c55aed2f8b44abce366888eab13fab16" name="gimp" arch="src">
  <version epoch="0" ver="2.10.12" rel="3.6.2"/>
  <changelog author="bjorn.lie@gmail.com" date="1520510400">- Add gimp-gegl03-buildfix.patch: Port to gegl-03, patch taken from
  debian.
- Following the above port, replace pkgconfig(gegl-0.2) with
  pkgconfig(gegl-0.3) BuildRequires and add libtool BuildRequires:
  and pass autoreconf as the above patch touches the buildsystem.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1524830400">- Update to version 2.10.0:
  + Image processing nearly fully ported to GEGL, allowing high bit
    depth processing, multi-threaded and hardware accelerated pixel
    processing, and more.
  + Color management is a core feature now, most widgets and
    preview areas are color-managed.
  + Many improved tools, and several new and exciting tools, such
    as the Warp transform, the Unified transform and the Handle
    transform tools.
  + On-canvas preview for all filters ported to GEGL.
  + Improved digital painting with canvas rotation and flipping,
    symmetry painting, MyPaint brush support.
  + Support for several new image formats added (OpenEXR, RGBE,
    WebP, HGT), as well as improved support for many existing
    formats (in particular more robust PSD importing).
  + Metadata viewing and editing for Exif, XMP, IPTC, and DICOM.
  + Basic HiDPI support: automatic or user-selected icon size.
  + New themes for GIMP (Light, Gray, Dark, and System) and new
    symbolic icons meant to somewhat dim the environment and shift
    the focus towards content (former theme and color icons are
    still available in Preferences).
  + And more, better, more, and even more awesome!
- Drop gimp-gegl03-buildfix.patch: Fixed upstream, following this
  drop libtool BuildRequires and no longer pass autoreconf.
- Replace pkgconfig(gegl-0.3) with gegl-0.4) BuildRequires.
- Add gcc-c++, gegl, glib-networking, pkgconfig(gexiv2),
  pkgconfig(liblzma), pkgconfig(libmypaint),
  pkgconfig(mypaint-brushes-1.0) and pkgconfig(poppler-data)
  BuildRequires: New dependencies.</changelog>
  <changelog author="mrueckert@suse.de" date="1524916800">- add BR for gdk-pixbuf-loader-rsvg to enable svg icons
- enable jpeg2000 support: new BR pkgconfig(libopenjp2)
- enable webp support: new BR pkgconfig(libwebp) &gt;= 0.6.0
- enable OpenEXR support: new BR pkgconfig(OpenEXR)
- enable email support: new BR/R for xdg-utils for xdg-email
- set LC_ALL/LANG in %prep and %build to silence warnings about
  encoding of the translations
- make sure we can see the compiler cmdlines by disabling the
  silent rules</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1524916801">- libbabl is required in version 0.1.46+</changelog>
  <changelog author="jweberhofer@weberhofer.at" date="1525089600">- let libgimp-2_0-0 require libbabl-0_1-0 &gt;= 0.1.46 to enforce updating
  to the required version.</changelog>
  <changelog author="badshah400@gmail.com" date="1525089601">- Update BuildRequires versions to be consistent with configure
  script.</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1525262400">- Add gimp-Fix-reference-to-gegl-0.3.patch: gimp.pc: Fix reference
  to gegl-0.3 - we require and build for gegl-0.4 now.</changelog>
  <changelog author="plinnell@opensuse.org" date="1526904000">- update to 2.10.2 bugfix release
- drop gimp-Fix-reference-to-gegl-0.3.patch
  + Core:
  - Discard fonts which fail to load and popup an info dialog to allow
    people debug their fonts.
  - New API to suppress updates in UI until plug-ins are done
    introducing changes.
  - New API to calculate histograms in separate threads, with possible further
    extension to handle similar cases elsewhere in GIMP.
  - Tool options are now properly saved and reloaded per-device at
    startup.
  + Plug-ins:
  - New plug-in for importing and exporting HEIF images.
  - Enable visibility of rasterized vector layer from PSD.
  - Single-window screenshots in Windows fixed to correctly snap a
    window even when it is partly off-screen or covered by another
    window or when display scaling is not set to 100%.
  + Filters:
  - New Spherize filter to wrap an image around a spherical cap
  - New Recursive Transform filter to create Droste effect.
  + Usability:
  - Warn users, when alpha-only painting has no effect. E.g. when target
    drawable doesn't have an alpha channel, or the alpha channel is locked.
  - Make the splash texts dynamic, so they are larger on larger splashes.
  - Mention pressing Enter to complete Foreground selection in the status bar.
  - Make sure that clicking outside any selection prevents Rectangle Select
    and Ellipse Select tools from creating empty selections.
  - Improve mouse wheel zooming behavior to keep the same point
    centered under the pointer even if the image is completely visible
    in the canvas.
  - Add "View -&gt; Center Image in Window" (Shift+J) as a quick way to
    center the image at any zoom level.
  + Translations:
  - Updated translations: Catalan, Danish, Dutch, French, German, Greek,
    Hungarian, Icelandic, Italian, Latvian, Polish, Russian, Spanish,
    Swedish, Ukrainian.
  - New translation of Windows installer: Chinese (Taiwan)
  + Build:
  - Add a --with-bug-report-url configure option allowing packagers to
    set the address of their own bug tracker. This address will be the
    one opened by the debug dialog for reporting bugs.
  - Add a flatpak manifest for the gtk3-port branch.
  - Remove the possibility to disable script-fu.
  - Add a --with-icc-directory configure option to customize the color
    profile directory. By default, it is set to the common path
    /usr/share/color/icc.
  + Documentation:
  - Updating the description of the XCF format "devel-docs/xcf.txt", for
    third-party readers wishing to support GIMP 2.10 XCF files.
  - Add documentation skeletons for all enums in libgimpbase/, there is
    much room for improvement.</changelog>
  <changelog author="mrueckert@suse.de" date="1530792000">- update to 2.10.4 bug fix release
  Core:
  - Remove gimp_display_shell_draw_background() and all clipping
    hacks for drawing the canvas background. This optimizes away
    one entire step of drawing of image size, for each expose.
  - Font loading does not block startup anymore. Only consequence
    is that the Text tool may not be usable immediately if fonts
    are not fully loaded yet (and will output an appropriate error
    if you do so). All non-text related activities can be performed
    right away.
  - Change of the URL from bugzilla to gitlab where appropriate.
  - New tool option manager to better keep track of user context
    and paint options in a consistent manner.
  User Interface:
  - The Dashboard dockable dialog now has a 'Memory' group that
    shows memory-usage information: the currently used memory size,
    the available physical memory size, and the total physical
    memory size.  It can also show the tile-cache size, for
    comparison against the other memory stats. Note that the
    upper-bound of the meter is the physical memory size, so the
    memory usage may be over 100% when GIMP uses the swap.
  - The Dashboard dockable dialog now has "read" and "written"
    fields in the dashboard swap group, which report the total
    amount of data read-from/written-to the tile swap, respetively.
    Additionally, the swap busy indicator (used as the meter's LED)
    has been improved, so that it's active whenever data has been
    read-from/written-to the swap during the last sampling
    interval, rather than at the point of sampling.
  - Fonts can now be tagged. The user interface is the same as for
    brushes, patterns etc.
  - Some icons fixed: larger spacing between broken chains and
    gimp-tool-ellipse-select made symmetrical.
  Usability:
  - When a plug-in cannot be applied to an image because of
    mismatch in image types (e.g. layer has no alpha or image is
    greyscale), GIMP now displays a message listing supported image
    types for this plug-in.
  Tools:
  - The Measurement tool now has an "Auto straighten" option
    allowing to rotate the active drawable (layer, channel?) so
    that the measurement line is used as horizon. As other
    transform tools, the feature will work on linked drawables as
    well.
  - The Smudge tool now paints correctly on images with a color
    profile other than the GIMP's built-in one.
  Build:
  - Installer: set compatibility options to run Python plugins in
    HiDPI-aware mode.
  - Put back compatibility DLLs for really old plugins.
  - Install binary tool `gimp-test-clipboard` on the system to
    allow people to help us debug clipboard bugs.
  - --enable-bundled-mypaint-brushes renamed
  - -enable-relocatable-bundle and also make WMF fonts looked up
    on the runtime prefix of GIMP (instead of the build-time path)
    when this build option was set.
  Plug-ins:
  - gimptool-2.0 binary now accepts source files with non-standard
    extensions if it can try to guess appropriate language from the
    compiler being used. It will also properly quote arguments for
    shell usage.
  - Run explicitly Python 2 as Python plug-in interpreter to
    prevent breakage on systems where Python 3 is the default.
  - raw_input()'s argument in Python console is now optional, and
    input() support has been added.
  File Formats:
  - The PSD loader now provides an option to load "merged",
    pre-composited version of the images that becomes available
    when a PSD file was saved with "Maximize Compatibility" option
    enabled in Photoshop. This is useful when loading PSD files
    that use features that GIMP doesn't currently support, and
    therefore can't render correctly, such as adjustment layers.
    When loading the merged image version, we avoid loading certain
    additional data from the file, such as channels, paths, and
    guides, while still loading metadata. This option is currently
    exposed as an additional file type ("Photoshop image
    (merged)"), which has to be explicitly selected from the
    file-type list when opening the image.
  - Embedding GIMP's built-in sRGB color profile to exported files
    is now optional. The default choice can be set in the
    Preferences dialog.
  Translations:
  - Updated translations: Catalan, Czech, Danish, Dutch, Finnish,
    Greek, Hungarian, Italian, Latvian, Polish, Romanian, Russian,
    Spanish, Swedish, Ukrainian.</changelog>
  <changelog author="mrueckert@suse.de" date="1530878400">- bump versions in BR according to the configure.ac
- move library requires in libgimp to %requires_ge and also force
  the libgegl update</changelog>
  <changelog author="ecsos@opensuse.org" date="1530878401">- fix build error for Leap 42.3
- add missing requires</changelog>
  <changelog author="bjorn.lie@gmail.com" date="1535025600">- Update to version 2.10.6:
  + Core:
  - Render drawable previews asynchronously.
  - Merge the file view filter and file format lists in
    GimpFileDialog. The presence of 2 lists was very confusing.
  - DLL search priority is now updated before running a plug-in
    on Windows, depending on the executable bitness. This gets
    rid of one of the last remnant of DLL hell in GIMP, which was
    when running 32-bit plug-ins from a 64-bit build of GIMP.
  + Filters:
  - New "Little Planet" (gegl:stereographic-projection) filter.
  - New "Long Shadow" (gegl:long-shadow) filter.
  + Tools:
  - Halt the Measure tool after straightening.
  - Add an "orientation" option to the measure tool,
    corresponding to the "orientation" property of
    GimpToolCompass (i.e., it controls the orientation against
    which the angle is measured, when not in 3-point mode.) The
    orientation is "auto" by default, so that the angle is always
    &lt;= 45 deg.  Note that the "orientation" option affects the
    tool's "straighten" function, so that the layer is rotated
    toward the current orientation.
  - Text layers can now represent vertical texts, with 4
    variants: left-to-right and right-to-left lines, and forcing
    all characters to be upright or following Unicode's vertical
    orientation property. See also:
    https://www.unicode.org/reports/tr50/
    http://www.unicode.org/Public/UCD/latest/ucd/VerticalOrientation.txt
  + User Interface:
  - The Dashboard dockable dialog now has an "async" field to the
    dashboard's "misc" group, showing the number of async
    operations currently in the "running" state.
  - New Preferences option to enable/disable layer-group
    previews, since these can get quite time-expensive.
  + Updated translations.</changelog>
  <changelog author="ecsos@opensuse.org" date="1537185600">- pkgconfig(glib-2.0) &gt;= 2.56.0 is needed.</changelog>
  <changelog author="sean@suspend.net" date="1541764800">- Update to vesion 2.10.8:
  +Core:
  - Use adaptive chunk size in GimpProjectio nwhen rendering the
    projection asynchronously, rather than using a fixed chunk size.
    This provides a better trade-off between throughput and
    responsiveness dynamically, based on how fast the processing is.
  +Tools:
  - In all selection tools, show error on attempt to
    subtract-from/intersect-with empty selection.
  - Fix text along path not working with vertical text.
  - Fix Text tool's frame position when undoing a move operation.
  - Streamline Text tool's drawing blocking/unblocking logic.
  - When moving a text layer using the text tool (through alt-drag),
    don't change the layer's box mode to "fixed", which is unnecessary,
    since the layer's size isn't affected.
  - Transform and deformation operations now maintain color for fully
    transparent pixels, making unerase and curves manipulation of alpha
    channel more reliable.
  - All transform tools now apply changes when you asve or export/overwrite
    an image without pressing Enter first to confirm changes.
  - Heal, Dodge/Burn, Smudge and Convovle tools now adjust the processed
    buffer and mask_buffer regions according to the changes made to the
    application region, as calculated by intersecting it with the
    drawable and mask extents. This fixes wrong application position
    when painting on a drawable whose origin is above/to the left of the
    image's origin, and there's a selection active.
  +Plug-ins:
  - Port all plug-ins to the new iterator API in GEGL.
  - Improve automatic detection of HEIC/HEIF files.
  - Improve RawTherapee discovery by looking up registry key (should
    become useful with RawTherapee 5.5 and more).
  +Usability:
  - Compatibility information in the Save dialog is now more understandable.
    The minimum GIMP version for the XCD file is always written down when it
    is GIMP 2.8 or over. The list of features warranting the minimum version
    is now listed in an expander container rather than as tooltip, which
    makes it more discoverable. The warning on compression is now displayed
    as its own text under the checkbox and not as additional text to the minimum    GIMP version label.
  +CLI:
  - New self-explanatory --enable-win32-debug-console CLI option
  +Translations:
  - Updated translations: Danish, Dutch, Finnish, German, Hungarian,
    Italian, Polish, Portugese (Brazil), Spanish, Swedish, Ukranian.</changelog>
  <changelog author="mvetter@suse.com" date="1553515200">- bsc#1130407: Remove dependency on JasPer.
  OpenJPEG is actually used.</changelog>
  <changelog author="mrueckert@suse.de" date="1554638400">- Update to version 2.10.10:
  - Core:
  - Add gimp-scratch allocator, a fast memory allocator (on the
    order of magnitude of alloca()), suitable for small (up to a
    few megabytes), short-lived (usually, bound to the current
    stack-frame) allocations.  Unlike alloca(), gimp-scratch
    doesn't use the stack, and is therefore safer, and will also
    serve bigger requests, by falling-back to malloc().
  - In gimp_drawable_transform_buffer_affine(), avoid modifying
    the clipping mode when transforming layer masks, since this
    function is used (among other things) to transform layer
    masks together with their layer, in which case they should
    use the same clipping mode as the layer. This fixes a
    regression introduced by commit 2ae823ba, causing layer masks
    to be transformed with a mismatched clipping mode during
    layer transforms, leading to discrepencies between the
    transformed layer and the transformed mask.
  - Moved swap/cache and temporary files out the GIMP user config
    dir and added new config file substitutions ${gimp_cache_dir}
    and ${gimp_temp_dir}.
  - Pass the GEGL tile-cache size, swap path, and thread-count to
    plug-ins as part of their config, and have libgimp set the
    plug-in's GeglConfig accordingly upon initialization.
  - Layer groups are now rendered in bigger chunks rather than
    tile-by-tile (which used to pretty much eliminate
    multithreading for groups), which improves the rendering
    speed.
  - Make saving/exporting files more robust to errors. In
    particular if an error occurs during the process (be it a
    bug, a memory error, or anything else), GIMP won't overwrite
    anymore any existing file with incomplete contents, so that
    you won't end up with no valid files at all.
  - Fix a regression on support of various graphics tablet.
  - Remove the "Edit -&gt; Fade..." feature: it makes GIMP use two
    buffers instead of one (east into system resources), it's
    broken in 2.10, and we can make the UX better for filters.
  - New generic canvas modifier 'Alt + middle click' allowing to
    pick layers by clicking on pixels. The available layers will
    be looped through (starting from the upper one) while Alt key
    is hold and the picked layer name will be temporarily
    displayed in the status bar.
  - When clearing a channel, do nothing if the channel is already
    empty; otherwise, align the cleared rectangle to the channel
    buffer's tile grid, so that all affected tiles are dropped,
    rather than zeroed.  Furthermore, only update the affected
    region of the channel.
  - Brush and pattern saving logics has been moved to core code
    (instead of plug-in).
  - Clipboard brushes and pattern can now be duplicated.
  - Parametric brushes are now 32-bit float to avoid
    posterization on large brushes.  Note: raster brushes are
    still 8-bit and plug-ins only have access to 8-bit versions
    of high-precision brushes/patterns. New API will be required
    to handle high-precision data.
  - On-canvas preview while editing a color in the colormap of an
    indexed image.
  - User interface:
  - Enabled HiDPI/Retina support for the GTK2/OSX build, fixes
    blurry icons.
  - Add a tooltip to the "better compression" checkbox in save
    dialog to make it clearer it does not mean that the file size
    is necessarily smaller in every cases. In particular some
    best/worst case are possible when an algorithm less efficient
    in general may end up better on a particular image.
  - Add basic support for cursors with a scale factor of 2 for
    HiDPI (artwork to be updated).
  - Foreground and background color icons, as well as color
    history will now display out-of-gamut warning on indexed
    images for colors outside